6�7�|���zb�ȗ����GW(iC>��q�6+����t�n����*"�7!I*\�@J\����+�� �=d>�͡�� :�����j|t�;�i�d��5���Q��A�n���Ғ4 �8��z?Л9>�s�ZƼ_6k���l��.��\qD�F���כT�7�Bxނ1c�����LӔ�!�z=w�nP��ܾo����Q}�(a=�2& )�p����2�U_{UD 5�%��V�X�����p4�Nx{��~�\s�s�+=J-��1���fگ�{�'z�4!�1/u�FM�BH�/'����/�U��qWQ��F�����1̃��8�o@$�Ȋe��F6WX"<s���ne'd��/�K�t���BJ��a��ADkМi�����h���8����`0�����A/r\���z��;X���d�u`��F�����_��c�(�Z~HYjp���2b����k)�j�R��[�T����H^xA8*��A�k��i��J���YD\K�KG�ƺH꘍�+'G4�N��Wߦ �<�`���6p�$�w��P�va�j˙��;��n]j�X�]� �$�tf̠����ݏ ��g��N%عBtn\ �#�3����]�՜�U�b6�p,�����.-�|�6w�aZ�Z��҂� ��.������8!H�qd���u �8*lU`�Ԫ�_�C3Oᰎ'ئ�V��:<�0Ns�`���$u� ���S��s��|}@��?�Y����5ܰ.\ �+u�� ����*3�=��� F�l�H�����Ӕ�=O"��P�IE���Ag�w���SdK����*�'Ub�$���]���$SM�p�>�}�K���'����3�V�6N��0�Ʈo"��$k�)��D6?�<^��&yC+�����&By�=ujc��=F%���CR&��T��FG�9jcB�%��0�EH�e��vx�VH!P��4����B34�v���MaΡ%���}o�^0"N>�7x3�8��d���JI�%f�#��C|���Y���h��tgfߏ�t�veH0��Bw�����Q�s�'�ÛE0��.��FJ|�O}�Rr�;n�����.��՛���}?9{�1�?��ч�[��3u�g���'P���%5M���Y��TO�R�Z9�ٔͩdi���An�u�`]>�@��"�]��L��q��}��!�U8m�ܾ���$梏o�7H�衤�&�3��U�0�-�6伍P��9ڢf1��p�qKz>�e���7f��è¸λ�o���� �\S���@K���TAC-�a�;�C���ͮ����q#_"��a���}�u��|��1�-R�8�Q�-�ꎧ��zPLW����mw#mZ�m�{��rfs��5�B&�؎bQn��,���m�V�������2H@��\�F���>�C�9�� [p����؋��>�����)��j�W���4��=��PN��t�B)թ<���N���JgG����z��٤�~i��Ԋ�H6��`z�u��g/�w�3��n7�ܤ�3���p��9/$8=hw�l6'�X�؇��:��j�'����_�q�X:A��?�Zm�w� �a�%�R���v�u��)�kF,j���6�$�1{'���̆4>�k�RK�l;@��c�TR2Ṣ"��ک���wS���[�����ގ;��2�:j���2bD���f���7�p��6(�ܦ� 4m�����$��v��p��vwM�I�,�A�?~+��w]���k��}��J6a����Y�_j¬��~A�װ ��8x�=��^n���q�:`F�My������Ӵ+Q�,�[���$��#����@�TȬ�����z'}ꝛ�����l,r���KZ�7���.��l8�?���M3)h�4�pkDپ���� �ekr��:�Cڡ�v���%�3�+/̰�ף;��>3�F�����bj�������o�er8�aE��D��pX#�� �绁.t��d�q�RL�x���5��*�"i�&��zܦ���1������l�Г���3�~�Y�I���Ѭ<�=��&����Y����i� 8B:�{��j���������q�� �|�8���]f�Q[��:�eW8t<���ʱ�Px��]tPH�C�U��y ��m�2�����'��}���Xs����i� �C���fR�)\�������ؚ��ZLj�8�|�K�w��P���ۛW�>���A�B�{b�R��E.�\�q�c"�:(eQA�%7ӭ���+�)��u_�C&�3z�ۇ�{��I{�{B�H��#ݿܫ���F� ����A�%� #K�o����\ 4� �r�g$Rv�?B��>�FԲI/�f ���#o~���y�f��1㍃ՋTj(��]��8��7]<_���EѺ���̔b���P����m00k�q��%a�����1�;��Ę��H�3�z����M��6��c�Yj��8�� m/3�3�!�a'ҟ١L���X�����D}^��I9��j�&��I��s���Q,����`)��� ��bUj��n�WX��[�Z^K=k�'�����_����OJoW|Q����t��cU�d��,�>2�����1�:VJ����R2����}������c���k���ߺ}��ME .�� �f݀f!����tg����������Q��P���A��d@�+.��z���5k��~T���c܍�t)�"%l��-cBa���I��Gx�ӘnT� Q>!w�y)����kٸ 1@hK |s��H�pgߵд�S�U�� z����$Tb���_�Y�,�c�m(ʹ�Q��夀Fg���u:� F��"J��Dn�O�����[�Y���XT�������u��x�->Yٳ���p�t�M��ՅUQ����j������ː���O �#l�i�C�"�ޏ�~�]���ڥ�n1| 5��|b`��Cd�k/bW��'uG������}��y�i����T�9P��.�h�\����\؈��c��;����I�����N��oG�h��yd�I4
Static task
static1
Behavioral task
behavioral1
Sample
bdcut.exe
Resource
win10v2004-20230220-en
General
-
Target
bdcut.exe
-
Size
4.1MB
-
MD5
d597126bfbb5b290a3900ff3bd6e1175
-
SHA1
f93b4d9fd1db212ca1adb368956aaaaf2ebdcc1d
-
SHA256
b3303f8484da9d35b37cf961527447c90739b7a3bd60d46c6d41c65c278a657d
-
SHA512
af3022b8069b3f75f6d563715521703fdd50404c36a56f9fa09c90af3412a903957149105052637dd51586079d30bb1afcd159df72d2c924886fba5ecc5fd1b3
-
SSDEEP
98304:Qz7KYeSFM/XqyDJt1EOdp6J0eJzzKC+5PHnOjZGVswjH2:QzNsqO7DpC+5PHnUZGVbz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdcut.exe
Files
-
bdcut.exe.exe windows x86
ed847bd58fb017d172b8563cd62faeac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
FreeSid
comctl32
_TrackMouseEvent
comdlg32
GetFileTitleW
gdi32
Escape
imm32
ImmGetContext
msimg32
AlphaBlend
oleaut32
VariantInit
sdl
SDL_Init
shell32
ILFree
shlwapi
StrStrW
user32
GetDC
version
VerQueryValueW
wininet
InternetOpenW
winmm
PlaySoundW
winspool.drv
OpenPrinterW
avcodec-54
av_rdft_end
avfilter-3
avfilter_link
avformat-54
avio_w8
avutil-51
av_d2q
gdiplus
GdipFree
ole32
OleCreate
oledlg
OleUIBusyW
swresample-0
swr_free
swscale-2
sws_scale
Exports
Exports
Sections
.MPRESS1 Size: 4.0MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE