� ���ؗ�z�5q^�x���(�������G5�������'xt2��gg�\��O���cu}l.�n��s�EkU�T4�����IV��~��pr:�N�3���T#����/&<U����Tg��,��թh+�X�`��qt܁�lE�"�r�ְc��)_;s�����h0��n{�}p���������LV��i*\�mN!xeE���?*����b�E�������6w�M�"/lw��o��� �lwd@��n-uΌ4��O7�lH�wG�/l���9���*8�f��y�.M�@�{�W�&{��K]�+�����ٜ�C��P��K��� D>�ʏS����be!4��eF�w⦉��1�aw��ݲ#��"W��"Z�*6�C ��c�-"��2��5~ ��P��>{���+��+ɾ�w�rNc�ju�~��/V�q{��:(V2�� 櫻���I/��w{U弶.&�_��:Ҟw�����/��i��:���d>���K�|�\��'�{��+��M����a2�+*V���8C�@��{��;�����X���v�7��6`ϟ���-;N�E}���(n�QE���)~�?����[! j�]�b��G��/ܝ%�L@Ku��|��|��������BOn���-σ迎��#�aX[�X�|A}A�Ө��xHY���'����i>���Q���+D]�_&�8Ӽ��V�I̚/߫�P(8�Ek7�$�ݪ�5u� r.��G4���Z, u��B��}�� �/<Ҟ�b�4��i�ZY1��VEF��lFI��[U�>�pE�\I�۳��g&A�~']L���01o�!��|�Iu�]�[\o�;}����0�����$���ծi_8G�t�1V����^��J G�/e���Uv�*7G���[=r��4�L��o'����pI3`MR��0gRn�s͂�<�F��4�"�lˢ�t�\�l� ���r�A, +�dA,'��S�̬��-Q�E�u�ԩ�� ��"��V��� $ׂ~���� ������A� ˙���ư�u��O��4�U�@e ���kii0��&FJ9�7ɩ1`�=�G1<F*&����/]3x��8�����A�Ȃ�e}W1�Y:S�������O�'�tD�����6�I���������h�5�p?[�� DŽ���[�<�6��w0*��<� �l�n�iO��b����W�����Z��di ��]bc���eq� x����M���uݠ����Nӥؕ�/yH�?7LA���ebS�E����]8����g�a�A�iY�EO���u\bW��V9����ʈ&���O���:!��W����q�� �^�v�_ �����(����Hk$ʂuxˍ83�,�`�'F��J[�]�@K �c�V�ؖW\����yw��wJ04����l�L?`t�C�b��2uS�%�;<���� ��Ѻ���[�O�S��B'�SI���t�#��K�3Z�&R����)y�)4A`��Qu���� ̈́���D<;�|�騑^�m��0��fKc٭UI j�u��/i�$��u�{ګzi֍S�x���Ծ�Ukg���})$t�ķ>���JĤ�6K�EEI����[*���&3!��/��2F^P���L65���ƠqҖ�,�$r�'��r���J�=�yT��w�"�߭�&Υ=0gc�k(����ژ��j���*�~r����4M��R���q#K��S_�bq����E��I�S�RXG�0[x��E���mX����� л�'�.�4ˡ�\���g�udY������.i����ڰ �`RK#�&[��b7�O�q�z�@�˿>�^g��{?@���M���_}�N�n1�f�]uʶ���-WYi#/���������O�\h�F�5�cW�I����`�k�г��Ō>|��ܿ� ���P�ʇ���mc�eG�)�htd�WF0�.��h�eiT���A^?�������a����G��a���[�0o��TA;��J'p��/Z���2���� �4x-�a?R��ͫ*W��|�d�L�f���Iʨ�r�5|����Ģ���%�s{}^�\��Ͼ��ҷ�(�� �4[�5m�����π�����4s��l��6��fyӈ hia��§C "��3a(!̰�NtHw�������f�cg���R(�b�8��!g�"�w�>֥m�j��\���+"S� ���H��?%`�|Q�Ṵ.(ݏ�{_c$�U��,���$���U���}�N�g����\���J*��!.�23t��|�c��~h�1%Lj �:�߉��[��>���]�����hA�0|�Ӓ&_.��촏�d�u4�(n+65Is��"��J��a.'cf�!���U퐖��T<�q��?O��B�4k�~o��[�8 .B��|i4�(��}i��Zw?��;U<��6i$��q�.LBP�Nj��� ߬��+���^����w1WA�� ����ȶd���wә�� ]m����P߉�i�ݲ\���~�����|�I��\hvmAި�gZ.�p.��뉸Vq:���F;N���K�a�0Q26LRP�TY���t����Z��˴Rw��,YIX.D��&/�ܨߴқ�'j��ZX���Ƙ+���iq�������G��v��$ը�1�܆�}]0Կ� -��ѽ������N�u>'Xh]-��U�7��8\f<�n�y�'�f�&��Z >�����%��١�hM�Ѧ,W"��d�cBY��h�,��r�C�H���g�B��1eo)��uN��sa�t�w�n�]�U�|EK�1˶��F�s��<��.��i�!`}Ə�q�$M����gc$�2�5 �V�<t-&Bs@[�?٠���wX����E�ANBZ�p�!���~��;{zWz~uea�>N���wqhg4e�#���*T���w��`��M�����}�-ϧ�|p�M���H<�ޔy����;�-��>���5�>��48�=2�p��:Nz�Ӡ�!Vi� Mn`�ȁ�r��FY��U������a��$�(Y�K�]�8����y)5~us� ���qr� .��adk�to{����R�)�����z�V''�U��q���P"Fp���P�"'���%|��A��0r�e��i��jG)XEJ@YwN3h�sȷR.G���:� �B��SA`UU_m1�����ת���f�C!^5��Ђ+@m��}0�e���p�����/�m�]Ԉ9�K���� ��=s!��
Static task
static1
Behavioral task
behavioral1
Sample
9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57.exe
Resource
win10v2004-20241007-en
General
-
Target
9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57
-
Size
8.0MB
-
MD5
8a39a62e60fa7de32bf866c70df720b1
-
SHA1
cd0c0a20296de56f6bee6261afd4602fe51c455e
-
SHA256
9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57
-
SHA512
b0081665d894f018f1722a4caa8a20a2f5e08c94557ca555249fe1d1869ca9e6c960137fea94f5031488837dd1ee9f0a6fc0359a2c7ea7e00fa9db16f3aa9a1d
-
SSDEEP
196608:9XQBD0WAauLW/sRriw9Mchx++2z8HGH4xTIoOI8Dr0:9X0AUsViKMc72z+BIoZ83
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57
Files
-
9cf13aae617cb867e684e5ce5db79100215fd421a650e260922fc35ec46f5e57.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 136KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d23 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma1 Size: 3.7MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE