P����Pi�8���z��iY���i�Sb�� k�&rbG7'V@���D�H�$�H�߿@�q;���4�M� <Y��/8� �QhOS�8����S8[������ai�6B��8]�b����}��~o���HS+�Ƭ~�l�������r�<�}��k���H�0K��Sٻ����P%S_���c#ojə�B��f3J�=�z�U;d8�3�q��C5#�R�J.�~�+&�T�.�z��Ed�C�V�ӏ���������T���ǎ*9�!���]�B��|�/%Ԛ��g�����@ 1�� ��O{���n�N�?6�y�ɾ�z����#�閲r�l��V{m_�U�aW�r�� ����X;��]ζcTAJf��g^��9'i�`@�ʳ�_��� ��tg���1o�����I(���mZ���*�x�Z59��W���\y2���5��10ʬ��W#��x�<T� L��j�%���Jy��7/�Iz�?��""�g�I�{�?U"$t��z^����ߖ>T.D5�k�p����D�l�"/hf'%��(�g^#��/�Ɉ���1� nO��kó��`p��z�>M-{���c\K��9�dQ�:�A9��9]]�\�<��d\k���Hȑ���<S��r�>�@�,@���ׯ[e{1z#�;�� ����ly@�+�5�g�W'�K{`��Y]*E�M����4r�X`n��xXx@����o�M���d�e��U�jg�gtD'$)�"���1�={�� ��Y<�o��/ܞPo�"E��E��|s�}q������ Q����:�v�oP�-��zh䞞0�"@��?C� �E����5Jé�W���E��X J�`�d��n�fИ���f���$��h;��`�ֺ�G��"~Y��@u4�#dJq��AB�cZu��{��1���6�.���#ѳ_��$jXa,���M9�����$�-j���_6�P,[۱���#�O�H�b�-�)��G@� ���?�$t��ł�]���� �TM��?�"�ca|�j�����/�ĉ�,<��l0�./�9;Q<�MÃ;�4E&�����7CT�&����p�5b���qܷ�w��䢦��[�O�&�m�e��U�[FLZ=�7:��ģ-�G$�=�CIAf�I��;<:pׇ;ۉ�V����]/}����\F�ˬ��,¢��I��53`�����T�_���~������ф��@�q ������3�ʿm��.>�:�T��Բ���O�<ߠ�1������\y�<���;y��2�����t�Id���z���?���,���KTvU�#ٕ��c��['r�-��F*]�}����EQ��a�k?���j�ҫ��\*�M��q�I%|ʗ�w8~~��$m��4�? �~�.l)E�Ï]'��IUF�0֑��(�4�H��[���SdM���u_=@���v�x>n�p��m:0.��Qܮ��R<F��rD�˜,��o��G�@!M��=�0���pVz �����3��Njx�߄輸)�U|�>H2���6+ճ�z���*�s�&B��1J�>���-ی�݄?%|����p�w�Ⱥ/=mX��v/�X"O1���Y(�W+t�0����.O���N�P�C�Y��>����H���$���é�j�z57p�1�������Y4�L��4�h�x����0H���.� ���4_�Si�`� �@QY ��ˉB7&�N;uw�DJ�n8����ڮ����� ��'�Z���Z���j(�Rh�Q�!X �l�i����'��ΉP�������uKT�-�ܿv`��iF��*ʃ%u[|�������2{˅q�pOv�!Dg�#ƅ���y�U�� �\��@�j|���b'"#�R|~�����B�'̎s*؈��1^�V�+ zO��o� �v���R��W#�Ey6��^=� r��S�rI5kk��}�79 �zu�w��Q��p�}�������m|�g���"ֻ bx��;ԥMl /�� ����D�P� MҬ�QhoS�r��Psi�ٯ�o&�E�l��]/ ��L�w�x�cY�V��昢\��a��n�eg��[6L�%�r(���S�6�zE��w��tv~zU3�F��k7@�������/� /!��`j3Т�O!�=:7Vr������Aaз�#_���U]6v��az�1�2����t���W��s��[��_ws4�x����*H�CK&�4�x��(��\f�H�S��J��� ��o|��XwB�#�fGP�H�g[��ϧ�f�*p���I0�4�t���8��RO{�X��E�p �Q,��)����K��A�$Y2�� �8��kv[�\b�>$������kA���!S3�\�M����q��t֘q�����o�ֲ0�������Y���ld�i�a��7�^�,�6��`�(B�`�E���y.�8��[:PL���Ņ�;�= Q~[���?m����fzp��i>�������W?_��4�l\/���i�J,�B�J���#h�/ �aHf�A��kxx^8�qsҖ}��V�w1{G�����:B��PD����r�y^|ԏ ���wm�FV��M8�U62�X�������[:$9Xu��l��{TBM�vm��N`�8X�.��������7MF'㼰� �yt/��>��{b5��ֲ�|W��\kZ'�VʨDw�����8 �y.Jp<!�t�_�J��&����L#�}�����X��8��ž�JV������I�$�(�&�I=U'LaP6��Ȕ�*x���e�#�'wo5����O�u���6Q��"���jB)� ܨV/���-��x���R���B�т�uF92$'o,����,���qac�r=3����A���b������\�Y�е�1�"ϹU�������Ұ� ���:>������d�>�/��vd���.�e�JHàQGd[�l�@Z��}�k��w5������tƓ�@�6��iS$� g���ȁ&���ڷg9v2��s�N+/<X)�R��r��f�5J7ȥgl��?��:�S?L�3у�/)�Xov�s���^������'� q�=8�V�ֈUi���:�.?�=�rq�a��]���<^{��� $W6��w���89� Z�*�rE�k#��ۋ�o�>nЉ� P��UQ֛���n����@,f2�X�/D���L�G��ut5Yd-�\$���L��[%ה�[�!V`;���K�j��|/Eh�ţ����;MBEAT����nA���HWy����B�Aw��������E�52�2[�ulh�=��������!��dϱ*2�)h��h�� ��_8���k�3n�H���(�ta��G�Jg��\��`�IM������C~�:�
Static task
static1
Behavioral task
behavioral1
Sample
c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e.exe
Resource
win10v2004-20231020-en
General
-
Target
c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e
-
Size
3.6MB
-
MD5
b8b3be25f4e9fa49496f2b43b7a4487f
-
SHA1
4547393e256a3efe93e144d7f75d37f49cf0329c
-
SHA256
c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e
-
SHA512
0e7bb772caa8ce437b5e8678f61a170e0b9d3b71a7d4cc2d02d90f49439b6912a730c1450d5aadcb6538a96f3572b72dd19f28b6bccee1a3bb68c3119ce1b558
-
SSDEEP
98304:cm1U/mCINBgpXCft+gabH7ut79ezmTb/IsIDkjCJ:cm1Czigpy4g4buh9e6Tb/zI4eJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e
Files
-
c0d0334bde825cc176ecd40b98a91aa8ebeabcf1c44429e74553b1ad4ef90c5e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 492KB - Virtual size: 1024KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 824KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 508KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE