��%`��"�<tњ��"e(���"���:��rD�PzW��V@����=���$����ja`�`ģ�e�V��(4;�O��c)5=�]�����V0�;I���*JR]`J#��2����[0y����m5Ze�G��1ZC�}5s���u��U�tns���Ⱥ!�dnB�p�|�)�n7�j��Jx�l��*9L�yiWoN����F���!0s�*�8����d�)�����SIk�|��y8e��-CM��h5�E�0O��xy鈇dBJ��s��82}� ��ٞ�߫c��c���?����� x�ls�1�O�D��Od ���0ہ���� ��A�80L�=h��H���qʶ�рy�ԇ �pp���$f�H^r���d�Dh�B��"���qmg(14��q#-�i��|�i��"@� � �E�VzoW��إ�k��T�dJ(`�}����A M[� 3��kh��Ԋ��?+NYр�-�R�ӧE�@^��۬��Ͱ���Pr����8�g�� �����"������R�)�0 ���q�_d�@�X����C��(��U&��.���~s/��[H+� Ooô4X��^,4@��������w~��=TfON62�P��|R�q��CM��Р�6@ ���Ǜ�Mìց����y$��Q��:Njw$��T �m��9��$�_��Ê�� ��]$q�,��q7�!�y���T����$0ǿ 0���&ٺ��+���Y�N�OX�^w��y�E�~݂҅^�{�J���P(�z�����?D5����#R?��"��e�2����`�rK������C���P��˾\������v��-?�p�V���\hp�<��r��r��=1��%,�;�W� ���`�W-��cU��P�90� �<����n0�ԛ�v�riԲ}��i��G�۫�|������A��Ê!G�O�80�@��>C������f�����WȐ�5wBݞjLOJ[u��a��W�mI #�31^��n��'��~��* ,�?%2��qβ�r�GQ �r[�"Оƃ�n���X*�G]L�E6���J�:�L��4ڨ[u&K��)�Y�X�x��c�0�]�>��K��)Aّ%ޙ@y�)�? �����=ܝ�KXusd��]췂ue���}��LO@b܉n�6:E��Gpp+�^��i葐�ڹ,�Ĝe�����C \�+Y۔gA��+��k2Ӷ�n�~õ8�h�"D=�kmg#j���%ff���<]�Sk�G[�����|��m_l�j���#��';!�s9���?w�$���D�`f���p16�Ẳ������:��'z$ �݀i�u���V8�*M�2���^���D��,8M +ͮ���@3O7� yg$�A���迭�]����e�~�g O�_����o��4Q�**O��=i�l�h���yo�Y�Թ����>�0�k��U���M���*�i���~�n:p�=�KG�����12�5=�� �D�Q_�=g�����s8^9,����ͩH�fi��yh�s!>���R~�܇�e4$}����W�H]���ʩ�+��*�<��� �S����[��27��n���q�Pbj͚c�.��CO�1r�Φ)�S�;���u",�O܁�>�w�-�:�/������X΅:A���J�(�{,7�[����vհ%�7HCϟt�O�j� ����d�/՛U����:�x>��ٛ��DQ�,i���!���kvrs�=~)�w����π�\����NJ\����OԨ�n���8��FZ�E&xx�8b�*M����U����qbje���N��/�8��>��qg� 8Q����V��d���Kz�ˢ���R��Wܒ7���c ��N ��i�.@���A��+Vέ�驅!���տ*P�aV��I���>��l@,�T)�n�"�ݙ}�VR,s�������U;{y ��ƿ-��O���s�:�߫ԝ)� �\�A�Dⵤ���cAO)D���d�p�����a^� ��w�wif_�"[81Bf���a'l����&7��B�ЮR�Y�rl�d[-o�;�Z(Zqn&�SWhic�z��F"'�=��`�ք�}NX� ��5ut�� 0@.�������wn���!�;@�c�`m!(4�;뮆�R�Q}�R����+�J�V���,v4���,���^s||�nc+/D4P��oc ��w�ڢKZ��i��`��|��l$����⦉�G�vi�m s�=G��voYr�.JP�zc���_ q�����0�6Q�j�o����DT�0�n�:�r�Z��;܂�2tZ�\�Ԇ�n������T��ϻm���6L��ܲ��F c���Xʋ�Li�7�6d���������X���X�Ǩ�ǁ\`n��������p@n��o�=-G�N�b.x����jg��U�N�F����j��J��r��r�GM����9�ٚ�D�A��T�E����)���)z�E^^ MeN ��E����(�P�&�U���B��,g���`Mo}��Yj�:���cZ�S��]��(�9]���p^K���:1!�>���1�3�= �!>�p��S�q8�P��|�z����� ��y'����'�耷6�L�]O�)ۨ��m� ��@�o^%��������%�s��K+�ݻ�� x�A�Z�Jo��i� �"���c�rç˝�j�ݓ/n���S:�Wr�!l�e�u��z<�b���LԗF�Lk(�����5%Ԑp�x�8ˠi��O���_s���@���ё8�����,����̥��P(G��5��A�z�Lװ�ui�O9nuR�8[�����D�хѧ����K.*N��AC���d�}��q�^��m�(�=��EQaAHS]NVU��Z��f&���N�U��ˠ�����t��@�����B�p)�M�ӱ��B��$�Cut�( ��:��w��P�Q�����']SR���No�~Ҡ��$Z$zEnFɮ��#cg��ɫNY��w�V�\p���c��D/4������jy���%f�j��E�~�{w����"q"���f�440u� �
Static task
static1
Behavioral task
behavioral1
Sample
8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c.exe
Resource
win10v2004-20231023-en
General
-
Target
8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c
-
Size
1.7MB
-
MD5
c6a56f729f6b67d7ab24f9d60dc721e4
-
SHA1
8e1743b2514bafc394311755dd7dd9555cc93b50
-
SHA256
8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c
-
SHA512
29eef0858bc6411903c2d0df3f6d255915a6dd81e8dcfae941f1486d715c5e9653c5146f4f6165d365be05f08f0c16fa9325d42dcef415680eecc9b50867e209
-
SSDEEP
49152:rT6ESriPVYhI1FqbU7+C1GBmr3xnuNhSD8kFkxk17JwkIjg:fmhGqQKC+qBp7JwNg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c
Files
-
8bd5cf3973db96c36d8260c3ef95a322181941be2d6c2d22d68cce2e6a50eb4c.exe windows:5 windows x86
6de02a123201e4672899d01732a06303
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
advapi32
CryptAcquireContextA
psapi
GetModuleFileNameExA
shlwapi
PathFileExistsA
Exports
Exports
Sections
4o8Gd Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
4o8Gd4 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
4o8Gd Size: - Virtual size: 921KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4o8Gd Size: - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4o8G Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4o8Gd Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4o8Gd Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ