�LRT_s����H5�����Ay7wނ���P��������h��>ꭝ)TN���N��������N��Bпt���2�<�`�F��C7{���%(�2�� ���� ~-�ڳ��O������:~0I�t��6��4���b4mq?<b����a��zR�}nWE�2�y.w�HE���Z̕OBX��>�'p��T���>b������Ǟ,m�ּY�Zb���B�sR0��%�pID}�hBN^����������;s{0 g�k�Oj-�{��D��>�k���+(2�N������ǶND`F��ュB�aB�>��V�{[��b�>�8Ԧ�2��Ԧ,$i� �w[���T}���a��C��@j�B�3�k�<�f@�m"X���*E�bR ��{�W.)�)U��p�=�`������X�6�U�A��EH�\�bs�?�X��v�[�`;&�Э���c��SD����M�&R� ��<�6��Koz��sh 7ދ��`��9XŜ:q��)>1�uNF��PS$JB��d�6�Y��O�1;�2(��0J��u�@�<�&����|���@��r�eU�O�aн�G0](?>�rG3�~��@S���t�w_N��+�g��oO8v ��X�,�� ��L�� =����L 1�Y�W��W;"�b(��5���[%n~u� ���W�ZE�@���w��ns��ϋ������.���Tq=w'�I�oI���:Di�ro1����x�*���A��X5�&qS��wZ�n�=i��q�jQPDk�U�K�;�L�����C�d$�����l^�x6G�ptpl�����9�M,�n�$�5e��P~:�vG�E���;�5_��9�g�b����B�y*� ��# ��4>� RG%����ݪ�y����q�伟���2��Wx������lQo~ �xb0��`$u�u�{%g�������Ɍ(���`��ak_�gL���q�ˁ���k��J_F0�M����u�L�t��Qr��� ����Ă�֖j'ϣ�������:L� ��\�Nsrh�{�Ϣ��5ƈ�@T��|ُ��2N狔l�h��Gf��8{0L����]��jy��tF�3�|����%�<�c�Y����;�w���*� ��J.OY�t�8�S�'�]�m!�B'�Y���`��u.i7J�țg��"�A���]�0�A��,m�b��)�.�8�������C,E�A\��"����;�ɜ�U]/?�|��mr`���9�#�6�"xp�Of�izs1 q�ZٔS���BFt�f���D�rf��4 ��D�¼��]��F�b?��TZB��m���]�S�#-$�}�#7�o���!\��c�c�*��_�>���k�zL2��e{�%I�ϷCxON���`��\`ʔ�N�9��j���&�cC+BJ��zj��66��!<�䴖�����c��[ܤ����61ڊ�~�s"����"�H�Ç[����ǨG9�h&�-sn=�&��2ap�x���8ǐّ���*�l�H���Č����,��i뢗|[~g���$����f0A��[��3���'bӸ�E��>��J�,bE6e��D��f߱I�F�줞j]���C�{L�pr�r"�c��nL��$�iG"2�g�v�(#!�r��5c�,�J���_�d�R��f3�H�B��',Z9s~���w"��?bM�|G,z�fYqAJ�Y�Y�(��O*}�H�wV��¬<��npW�GL���L����&0L*^! L�:l�Ei;2�I��w�'���i������Pr"*'�=%�����#�`�%���ƚ�(:ur�M��x*��@�ϟ傩�ߏ鹳|V��p&�Fk�t���ǘ��l�.<1��� �4ls(C� �w��,S�� �v^-SE�����o��l���\���{��{@�H�u�N�\��̵�Nv!�v�NT!?y�/Q-�{qԸ"�r(�@���������+b.�6G/<�8�V�w7�uz�61$D�8�Uhx�Sj�N5R�/yrPs=2����!�g.� �`F���fS<D%h�*�}��(���s�K�a�Y��M¶{���j�G�R��q`-gK�tY?���K�$Ǟ{��t�:�z|-Ӗ������^���3Dž���Rp��� ����emd�M^�w�k�@�˓�KYXt��-�A��X#%��y��_ά-Bx�< �](]���}�7-P�F����*a�8�P�P�&��]�����%��6�����C �5�5L��+�#h��biV��C��B�'���MuYJT�f�����#1�AIꋪ �\�Y�`�UB{��z����}�l���p���2��-���M�}����e� )C�e^ �N�Ar�X�ZV�h��H��34�=������C���>��r%��7�7�LJ&*~�Q K+��������bpo_��[�����o�8S\ai`��0�����þ��2=R� ����!%�&��B�f��_iB.�;����~�;�+�R9�N+�;k�C�ThŎ�"ݜ9o:�U��}m �H����G�0�>u洸����!Jy��E��t��������B{ �d1.h��R{�o��/('�²i���Mz��mSKE�_ѝ�^���w��[9k�$[������l>�^���p�$���;��ţ�;�Q�E�H�f-��O�~[�ۗ ��io����˳2�[^��İN<���j`9�P�=)�@�J )}����d������@ZG�ç��M��(~=$�<�/~���D��q(9?�U�����WI-�4��U>�bt�d �[��s�PuDE����� �3B�Z}T�� �s�� �`����G�����c�*�zHO��[� �R�?��ؒ��g��\���v�ju�UY z����V�2v���$��l�?["r���M��Վc(���s��-���� �oA���^7��t��Mi[M�V��&���T�5pX�|d nJ�Q�v$ =n0���!t���}�������L���kw�s.wa���Δ,��I�o�C��Gtj!0�}�D�T�MV��k_h������f���W�w��ȭ�r��^i�!��.�s��T�/C�;���<u��7�b�<T��@���4�M�f����Ѝ`���6�ôR8Z�@E�� �%w ��'V��Zy$sJ�m�.M�'�l��.5!���b7_Ƒɑ�n~3�\1�M1GeL�lݺQ18�ö S#�3t<i�c[+�kb3�ȤN�U��5m�ͷ��iY�������dz#�L 5���0s���>�� ^M�x0C�V��`>vgz��&�1:��M�-HG��3��� S���JL�G�������p�M��r�zP��T�<���Q�WRN�r��䏚P�2�)R=`��a�@D]�H���o��N�a� �]NԌ y��\�;�:�F}�HJ�@%�KP-h�,�MM���-r���-�n��+�d��8m��<�/��3���40 N���]���9�W�~:}������u7XK�r�&��� |����c����������W�����ۇ1�Z[�ֹ�7#�L�mA�w����G2F�1�!�y4�r��E��)Hҟ����������ѭ讈�:N�N9�r��L\��Y���v���D"���I��{��%�ʶ��9W�x>��}��iC���������Y[m'7�8�ʇ NH�x]�9.�-�
Static task
static1
Behavioral task
behavioral1
Sample
8cf4d609b5de5a572b1e30d14e5f1855fbe0a9d4c91f01c8b3312d44460ccdf3.exe
Resource
win7-20230220-en
General
-
Target
8cf4d609b5de5a572b1e30d14e5f1855fbe0a9d4c91f01c8b3312d44460ccdf3
-
Size
4.9MB
-
MD5
2fb6f653920fbc682bf6d560d131e6d9
-
SHA1
cd86cbc077ec306c59284a41ea2845f53c61398f
-
SHA256
8cf4d609b5de5a572b1e30d14e5f1855fbe0a9d4c91f01c8b3312d44460ccdf3
-
SHA512
5dc914e2fd49f0392d7ce335c6e108230aa3126786d06462d620b44b41bb6cec96095909d034279c89f8c8ac38ad96acd67c00252132071f014a6a6a3ec66c51
-
SSDEEP
98304:R5ZmEAuoeTj9TI6oMOMOG1Xhf24Fa2kIt+eXjfQcKLB:kEAEYMpe4FaJO2c2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cf4d609b5de5a572b1e30d14e5f1855fbe0a9d4c91f01c8b3312d44460ccdf3
Files
-
8cf4d609b5de5a572b1e30d14e5f1855fbe0a9d4c91f01c8b3312d44460ccdf3.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 732KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 90KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Qursa Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE