�����f�(ק�I��}3�NlB�C�Vc�dҩ���Qb���c}���2��n��iK?k�ʂxl���5� ��\U :D�� �9"�K�!�[�� �y��_��vtWz)sv�f���{ҦM9QL��� �[��3�����ãB͋o��W�q�U�V�!��32W3a^j:�� �?� ��|�#Q�_�G0Ԭ�4,��o.ՃF��93.���\�d&Q8k=�$�3F�=��t�я�&E����B�LX|��3Ѥv�~�����&t�R�6��ym���� ;$wct�Cb����&�'{�����FM^�IާV�zH�{d���d�Y��D�}J���k�şP|ػ7��{q��7H�L���s[Kr,H���v��'.�tm8��%���Y��nt=�|Tӭï��L밒�;M��m�xJ�}9��m]���:mY 3�g���G�S �:��,>~|��һ �K�qOx��|�@7F����{�Iv���9jKYl��J�M<m T��4��b�`|��f�V��lQt�f �i��A����0;�I%��o�ඪ�S��He˺E�Vb�=:S!ڿ�X+�<NQ+�� ��UF�q��>Ua:)x��u�����uHv���q���8_�KV?�hF���� &:G��#��Ң6���#s�;"#^O��Ou���Q\��r�D"��ĸ~`v�1��W6��"��d_����+���y=��OC�s����n�o"�da����0#D�: ;�Mfu5{�4v�5le!ˌ��b�nw�Ni�˟=h�=�T�������7�@�������릷Q�t��#��c�P�U8�}٨��e���X�ڃ) pq����mI� �h�s����D���S^�R��^N�[7�9G��\��xD�����¢P��.%���o>�V��p,S���#���nJ�E��(r��D)xړ*p� �j�9�������H��5�4Q�]R8<A�]�|�t��f���"�u���8b�m�i�T��y�� 'P���o<��,�����6���68ͼ^~l[�4�9�鎫���z�@����#X^�.Tx��8�zI��X*�ޫ�����g��;��H�餪~(4]rT�ȱaX`m>h�S��lg��X�e/m��g�x��$��\V%G��h9�V��sd��9Sꔊ�����62xcbj�����b0/6�ٺM&*��I4���p"����sӇt6��0\�q]7Sl5y��Č�]_��B��F���>�����Y���TlIlkfٯ8Ș�%�\������1g�s/��yw����0iY�����d�������PY�:�-e�8ϩ�U� e���0�wY���HT���w�ߪ�47�#�a�T�6���<���7s����tN���A�3C����k��7�M�}7�c�Рm�F�e��ts7�LW��/3��k�+�3����LQ�?�r��-� j1�'u�M�шd/Ȋ�/|�M��/��.�[�M|�Ƀ���,����WG��y*+��ZN�:D��9X��Ҽ鱔wp�UBu��uk�{� /�I�ȑ�OC� O4&�a(IZ��G� ���Xލu�,�,?�B�a��5�/xRԠ�����*"a������/�]?�7�q��-*H��*�7��Q�uR��8������Z ��v1�Z�d`D��n��� }��LN8����,�{���xG.���|GJ~/)�8e��[��E���Fi��/T�t}��8ϗ!����'��}����r��ŷ��2@J�B:x���?%>����a�e�bcp��q0.j����P��&��<e�I!��WxC��gg 9&��j>CO���p��gE�G���K��c�%��������+n�!�TVD��v^�S$L?%A���Xo��Mjz��b��!3hz�bW�!�0�M��B��#�Z]�"�%���ⓦoj�!��|ܬ���@�Y���4���s���y)o�[�,��J�93z�EW��oz�p�;���۠G�&�]�\ɥjF;,T% �ɳ��Z�����44����*2�/Za,g"��M� M� /�������8��۾.5j.{*����:���8�?�\Y=%ś��;�4�O���.ol&���?��u|G ����5���Í���������Kjɽ[��4�����8$����(�aL�&����&rM��V��b5�i�K��t��ew��ke K�84��-���Pб��i�.,p�D��|LV�>?mi����d�JnZ1�c�k��:\-�X/c����R,�����L"sM��i�>��Ώ�tJER�� O�:��)4��V�����<FL��v(Z��j�-����|"{������J�ӵr�K�%V�.nb?�oo,�,�m�>[d��Ā1��%����()��\��Y|�lNm�w�g��ܴ�0�������� �����*�@@��WD����ĥ�x4��|�6u� "ن$;_�ӻH^����L�rE�[�kf��A:k2���wtM�8繃b���,}1�,l� JqN�tkMDc���\���v?�|}���#��($ju���-�����o�����F����\j����"�DR��e�d�'^9�x���],MWN��,",�ւ-Q���x!f��Kϴ�����K��hTG�X����0��^Q�ЯYK��f��0���� @�gS\�j]g�I'O~�$�ǖ��� p���@ΑL$=3u�,�"�߯��q ?��ĕ۩�n�E�{�����C�6ʰ�c�2V��u���u��ć���ƨ���~u*݀^X�vMb4�]��&��<���s�W��Z��sc���Ɍ��K1�?�6EF�M��w���kb/ �1��1�PW;�!�U/�*H?Y��K��q��<sJ;U[ƽƞMMJ<�!e[�]TT�I��V��S/�0# _�N���\62&�U!�S�Ũ���2�Yal���D%���K%`�>$#���g� ��|u����9����0 \R�iq�n֫�ݚj,�1�)%�?��MZ�G��|�G_�+&�;�}��+���.�Oj�$T�NpF!
Static task
static1
Behavioral task
behavioral1
Sample
c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878.exe
Resource
win10v2004-20230915-en
General
-
Target
c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878
-
Size
592KB
-
MD5
7dcfd48e5fa1dd8e1687a615c55f345a
-
SHA1
d830066e980a14a78c7f4f97131cecbe790f2444
-
SHA256
c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878
-
SHA512
4923a44df18dcf114e17e06e69fd24ad4dba23a95f7e30ea10e86efa556751a50fff5ba919ae4d45d311b278650ea33b89525953f599ea895af38be2cb5748e1
-
SSDEEP
12288:2p69ycPPUYDdhSBIC7Qn+ma2KQ+nzzdrfkaqWx3uUTCCnS:06pPcbGn+mdKz1rfkan1/TP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878
Files
-
c6d21d5410fdc9b83737674850711ca8ff276f61fe7051866db000c2dd433878.exe windows:5 windows x86
40e42527416f49fc4d6e4fdc4e791081
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord631
kernel32
LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 580KB - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ