���p�ic�[/�`j���5mE(��T�@�Q a�*��RR�l������K.�2e��N8�3�}�ҟ_�&rC[� ���R�o����Ry�u�<n��]������t���'A�fx���2m��dC���u��t]d$����@n� ��cA�z��%r(����|���_��-;Q�cj (��6�����~��虾�L�0���v��c�������O��@$C��nd�۞;�s��Q��! &43i�zӖ���0���}��j��^��A�A�Cù�R�����ō���������OB?�3a@��n8������gc���(Y#�5r�m�ˆ��� p��}��й뙎��O�:șMo-xؗ�8��U<3j�8W�,�T��;Ֆr�<��nmϕh��˺��7���V:�ƃ���hc�6�P��a��&�*��<Ζ����H\�龹��{],XL����$��S���Zt>�u��|�H�C�\������S��� 겈�*3y�\�Z��ٲ �t�I��v!� �X���?�Mp����w����� �q�W��I,B��@��� {����+.n/#���w���Ό���v��y������p��}W=g_�]��7��MJ�lF���z��Fx����6"�� W�Pg ��nfGG��㙖�ꎍ�������B�t�Ύ��n�����;���"�f�Լ |33�GR��\�E�Sj�{Y�k3��RҿB��3� �ļc���7R��r�. �t��ك�-2�.t���S�I�o���?au&ua!����r�ޫ�����B4�vr2���b�l;��i��6�-!��.aP�p������)��>��/kp}r��|L�ГR�{�/���N�VK���d�9�e.�?a6?ӫ��A�XH��̧ۂ���T�J�����t���\ᡣ��1Lc?�hUB�n&�i�M�i���7�X�W� �^�yέ � �6=`e��� ��^fҺ�&����!�G�;��k{�DXނ�w���&�~�0B1�ͱ���즇�#��H��J����(��1��Ս)���yA��(�&���-A�&h�t�{A�Lg�5�f�:�%o���+���i�X�z4 i�(�SăB�ʉ��cry�O͢�]������br�hy4�1 ��u��d����.��a�*��u:�p|���^���=�r b!�E ΰ���4���$uJ��g?�����q�L쁒f&4KZ��F��7�#O����o��@�v��� �/&ن��A<��Mf��;[OK�&O��hTT��~�px������-�����~tr�Lªi�EUY�W(n�k�����t���-It��hC����K�b���� �B[C�~fC-��RR��3�8���;��1�>U胛-��燳�[!(��d��b���V�+$U�r��!]��i�_;���|\�N�����dF&n��u�(F���ecE~>��#�WUb�B��&"��x�\gop{W�?��u;������������q_�׆a���{� $W:g��1z#���~66H���[D!ք��j�Ru��v\b<,��"�_Ds���}�H�v�>U��W���U�f*1?�]�M�L��#�ZS����V��n Zl&�4�l�g�:����w �+��f�U��Na��D �.�#��_�e��FP����*91/)_��JxF��\�6|,�YI�z����w!k�kO��p���ib�-Q�v:�'��S�!##Ӧ6�ߋy�[ ��"�/Bv�3[�]�o?����?�hh)-i,C���*�Be������JA4�Slh� @�K�;˦dS����D0T�&+@���{��m&��] |����K|'�gt���Pl`洝T��; ��1���ZD*X��$��$~a��*��xc�GN�A���h:��{�[GIK=�v�k}E����u7�!�.mv_4%�^��} $ � O�3�m���߁�����ҡ:V[Ur����S�ʺ��o|؆k��7�C4e�5.�/�SZާ�j�#����!�.m�X������bFp��ȿ�q�5g&A��H%L�r��̊ҕ��aK��\�n�ޗ�x.;6-���ض�J���ۿ9"�̰3?&hw?�.�u:�M:y�<�(���G>�'�6c�C�@~3�.v��jH("�����>UuTaPWl�y���}�6y����" �7�l�A�Gs�|y��t-e�&��Bc��jW��;c��P�X�ɶ�{���o�������A�S˶a�g�[(�KD ��873 $�,�0�E�t���p�t��n�����'�Z��M��>�U'[��1y@�+]��U{g��˪��j�W��R���7�2Z�6.�ao�h?caK�T�����$�ej�"�R�����۹־aM'IA��@E/Q�p��h�����0�~�U.GQ�W��r�A���X�Yj�N�R9ʯ�@� ���a��#��[t�\@e��y*n��N��B �2�,�/����=o����rO,�;����>� .R?�3A�ʍq'��^*�4Q��u*�["R�-f8T/��9������|2}�ʃs�ѽL�ҕe>���^�W�}t�J͡��e���݅�ڠT�3���Ӫ9X���!��:`|��ﴖ���@����s��{�I��h H������t�ύp�����p�5���xK��J�/�7��>)� ��c�i�����e���� 0\�|�i�y'_�N�\�yUu�$j� k/C�v�a�\w�pM�j�j�@5�� �M�����$���p� �Ux���#�<y�$� �X�g ��cч`�Zo�e�|�R/��ʜD� ��M]���DdT���(�*ï(�#:0�n�bܛUl�Y��8��%��s����Z~��7�2pR��q�1;)(IYYt�A�uv��� #�\�,Ros|xj1����pE��7��_ VAs����Ubֻ̦9���.��@�|���o����*��74��Oo��(��m٫�_X�X��ڔ ��)u�0Zkf�CտU�qw)�'���茚�TW&���*���e�{*:�"4t]�pV/�����Fc;�J������VO��H����R����&�������S��/�yl��F��}-�?�k�q�e122k��TV�}�6<��L����V�*n�������^�]_*��8!��lj�X.^�8E7We����>0s�R��M�V�����{6��L��;��n�S����7cG��<�x)�LWW��'v�����d;���4kP���������-E̟�N��}�"���Cb.��F9Q@�⳻�������MșjL���V�w( �<���RI��3*�@ȕ(�?%�b
Static task
static1
Behavioral task
behavioral1
Sample
Fort_tCfWbC.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Fort_tCfWbC.exe
Resource
win10v2004-20230220-en
General
-
Target
Fort_tCfWbC.exe
-
Size
655.4MB
-
MD5
05ce840729abf60820faa24bfa4b549e
-
SHA1
82ee8ad907365e1f637860b97e241f81e326ae22
-
SHA256
9f8d6700e2f60654d709ee22ff3669fc587792ac3dd41cc0766b7a345d72b3a6
-
SHA512
4d13082d53adf0983a9475ab87f74202ade2efa218b9f81ad73de76a00498049056f1c5791f0a98780d6b66b0eb67e39c3b7aa41d10972c8ef0f749d3dd4d417
-
SSDEEP
98304:VFCKrvYDbcb4yaHSqf2/1MlE1j55ca/XfrLSNecHVJgwONMqlWhWoWGbOa:LCK0wby5edPlOabuNec1JvqroWGCa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Fort_tCfWbC.exe
Files
-
Fort_tCfWbC.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 64KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 11KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 90KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE