�eU��"�����$���vS��2B���Y�\; �����ŧD�=7ւ'�z3����x�fU~>���$[�v��z���<fK5Z����8�cVZg��:ܖ��o!I��,s�@f��l�Mh$�ptJv�S��2�-�~0n�_~���ρ��D)RU���CGˏ��Ŋj��H�(=jH�T9os~t���N��}����g����&l�!�ʴe3��]�y "�����R�j��?5��c�ga�~�`�Eސ��}��oࠓ?�3�'� �����T�� [��l\ҙ���E�<�NkL2*�7�=M!P����to��:x���@��Ëi3OϟM����u;�M��C�c�Pn���kpn�4�#�z҆z��#؞�y��*�h�q:��az1��Z"��h�(ɑ�+1�����+�c��Qd���G@��}w _Z=C���F��'����n�h�|Y��*i��m�����`�V����#����{D�X�pp�P�_�ȓ� A�K�ʁs�� �v�b�d�px~��i�Ӌ�s5���#u�8H�UZt隖��[[�?;l�M��gk��;����uq� 9B�����g���l���"�}<ؕ���:�e�C'�6p�ػS��#�uB�,֮�"Xx���_�BS�Lu:$��~ uH�p����e����B����B�!<�������U���栓4X�K�E?��P�30�8�:7��u��p�֑SF�A�u~߱\����X� I7f r�pG��ח�9��r̀��~����,�Q4�`I�D,�{-hv,}_���W��� ��TJ�4 �_[�+��h�8߁J�g�.l_"4`Ҍ�<�����d�\�������Sm:l.����o:Ӳ������`�K@�y�Z�<_BgЎ�0^a~>����E��Ԅ��Q�5_���4���{ �\Δ[=�K}�BEVYz}��/��g��z�F]풿�ּ��Yҋ��ЛN�팒\Cos�8���ߍ>�K��2k�N�ǽD���I%��v��}�/-�i�ʧfW~��M ��l��C�y���?S�kr����R(����v���X�!�I����3r�L�_z�e���̧b�eB�������;<��<ɨ��AM�O�S�7./{C��.��5�b�v�ΪHo��=�6/gC ^1��� �����<�l6�R�5� 7w����F�0�s��Ȱ�q&�ݸ?����%�~�z0o�|t��f��߃���3�|�E��: qYfP��5���6���LU1�ع,[f�q�9���@R�L�ȇB 0O�c�`!�͑s�fYs�G��K�6����[���s� ���I>�_��� C�Ap�jl�!��T�BIğ≩��(A�C��٪~VJ1�+_�q5d����Z�S,�kii3��ͩ��E��0wP��о:cR?��#z$�����i��A�%�~!{�g�t��<�� ;��l Bë�V��=������6���v��O2���cƝb�_%9�G����B�ȪY��}���c$��*1����щ_�ȴ�ہ��Cv� R#��h�/A����x�t�ϒ"+��x����'��0����|qw#zF!�G٨�"��%��m���^���lb����zD��]r3�EQMr�,��':U~������ږp��~vIH"�R��Wh� n��d��Sڜ�S}kʷ�&��j���A2�����Ϟm�?9���D�U?*|��g��J��T��k�%h)XjM�+��C6���(�@�@���'�X&i2=sy�g�����R�O �$c�x�h��dn������������ľg� <�^����6u�������l�j��'_1�, �������@�~nY�9I���5���(\?r�$M�9t�}�n�a*DU'Bm����b�_��Χ7f�B<Ȇu���-� =�[�ɡ�y�6��g�*� ��VR��M��f�&�s�[����Ҥd�|��j���Je�A��߈���rOh�������ئ2Ĵ�],��=�ƹ\��^��)�VM��@/�`~(����Z��}���Df�#H�8�l��� l �G�a2&��rcKf�(.� J8m�=�u�㫥CP��%dꩮ),���*�F8t&�:ٍ����Z��I7"�:�Ӎmd��y�2�U}��ern���.����F��}\t���o�� ��ҟ� ��*��-z~�$�7����r��1��8�� J��aщ�����/s��*�?0�BMpG �Lp:�Q^R:%����(2���Z�m����Z� ﱲ8p@����k3�/�jk���#ԃ�HMc���*2�P�!��_b|�=��>6��H3�B�ݧa`�s�����!ù��˻)=؋�����R���r�AvK!���\I'����pu�Z�� ��Ҿ25H���n���8A�e���ZT��B�������9���J�!g�)uL�U��dN.�����*�9"!�$�� B)b��`�Ϻ�����f)a �w+@���ta���1�����֨�2�����O*�]ǘ��zr��#�q�Vh#o2�*�~��}���/5Q���;�y-EE���U��5�g��w�����pj���==��ݰd����V�� ��%�I(�E�z!u$cHΥ�R��@��$���mCvYr����G�����x-���jA���8o����zv��g�囱{~����pNK�L�x���� ̂���v@���{WZi�D�h ��k����� *W�Η �{h ��nX)�WJ�(d���_�J�f5)��.�k>�5#z�ٰi��b�\BV[[��{D�A��+5��`"I���BV_A.�0o��8�VGJ�m �j�S���*�v�<g�����D�� �%�1��#�_`���:�ĵ��n8_-Ss_�vn0���^�v�����CտL�Fs9V����Ɉ8?���4s0x��G��8'�J�C�0ޠG��/l�♚�,5}T5g}�å\rffp����R5nX;H�@ʔ��TOr�7Š��H���M� ( W��L!�YA�-�������n�熽.e���!P7�
Static task
static1
Behavioral task
behavioral1
Sample
bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146.exe
Resource
win10v2004-20230703-en
General
-
Target
bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146
-
Size
672KB
-
MD5
bafdcdd017b16eb2701f7098ef41e82e
-
SHA1
99e7b6545d930f04147b6039fd3a4f63dbf8ae74
-
SHA256
bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146
-
SHA512
3f6c9205f6ab05542931a949816585d15b99d24452118cb3033d26691ddb314ce61f9fadeba9a80f74d00d111617d53e71a46a23e69e54f6e63f74da7a797815
-
SSDEEP
12288:k2mJH0LN6bZmBPp5Y6J9MiMEr1tyjYRMb6GfyeXVSmOp/RmhmC2T8j/rsrh1:pmJbbZm9c6JW1ExwjYSb6oX4maCNj/rw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146
Files
-
bdfdb844954b6067c36cbe77960944a84d7c9f862adfd910ab7a0294559ec146.exe windows x86
a6a2a1ff5ed11d9b4a90b56d0c1ad7e9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord608
kernel32
TlsFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 660KB - Virtual size: 658KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ