�����T�u�t�ޕ�VZaM0p�mp�i8��Gx�b7ф�P�N�F�����/��F��q"x��P��g��rS,>�����ޯX� � �~�T��A��Be�h�/�wM}��!�7~��w�?U+��6 �iP6o2�C��"�42�!�9�7��%��U �9�_z���0N�#u�m6��L3^�0���<5�UF��I��=\!�G{�s+:�����S�����9��N�oK�����g��C�Iy����=��;m�����)��>k'L���H���6��ta��VEi��5�j��c�7X��N𔔃s��Q�|��S����ד�=���2�>pA胹g���|� k��7�� ���/�*+��.�B�<��҄���Dz��)����Er�V-mR:�X�T9γuߨ�[�Z��H}W ��d�T���&Q%6�P�$,�X~���Vz�̫�]�JB����C�Q3��\�%֣�:�mh���|x�l��t1����ДcX| �[��=\y'�i�hMN y$�[ )zߠa���z�W���@r�Ğ�R�w���<��]fPjH.�gkO�o�)Hwq��#ѽJ�n�&��1�(� �L�잛T[s.,]#�?Hdϓ��m0�����:�uY�wq�q^��ޡ�P�����b����,�90��s�'Yj�aU����d�Dq,&���S/�vt�-�.2U�t_�������b ���}��Ֆ})QEĪN�@����tȊ{�V�b"�)�r^4�$�eIv{��t�z�"��v��7Z�}�����-z�L暠��"J�Di#����c��-_��9_w��IT=��WV�M��ܥ�zM#s>����ͨK嬻�F��j#�1� �B ���h�9 r��t/WйRi��1��j\�P����dmM����*L����hLk@I��w��0iu�� �REfS8 5}]��!=������X���V������ ����D���R��ń�H�)���K��!O��9�Q �f�Y�@fs�_0<A�AOz6���mI �\�[����o���=�>B�D�)�1/r���lM&�����/�/E��� ?h��zy%�~E�;�q�I�4�0#��g��.�`��O�)������^���� Wn x�Z˥/H{[�\�`�,����*SX�+��]�;;���7���������u�|�E�rUu{ݬO}��RD��(��l��B�����j4�s���ީ!Zg�QX��Lέ�0�7D��l�*,��H\u�FԆ\u��&CV[n��������E���:w�tP�B���Qr�3>�f�����Y�^Sw�;>'7d[��$��u[�y�@��d��&�j(���O;�jJ����^K7 �#����4de5��T�;��2���H�� �)_�����y����]��� +��$@����T.�P���G��Y`R-@�<N��I u�9y$���zQ��0��D�O�]�B���C�*����P�e���m���k�����S̽�i��Ğ�^v��%���-�ԅ\��xk3ghQ��6��U��[��K������-oj�e��-04����dPwnh�|������*���,�J��bC�.�&*��,�|�l���S����=V��co(��(�*�.>_Mt����mPY6�?�Ʈ��v҅F�`�+�d+��2�֡�<��VTMPm�� ?d]2;ߛ��є�Q�� >X�~���-ӌ��A6��m��K8SRBh�\l��G��K�*פF�`C�<���D|:��93�H7J�����9wu���T���J�OTS�+���&����������i��G�k�aJ��H���W4�9jyHC��>�q�Z_j��ި>l!���Ю�3GF�����fċu���[ђ��Z�9����tG����O<Ĺn�����p���(Cj��j��� �ZYs�Ro��+\���q���:��Cx���<-&.q�����3��+dعy��ɕ���MP�ے��]qNf��o\e���m�t��ɵ�ΰ�d���?�|p�n�9�J^�3���ϗ�1Y���e�,���K�J7t?�����h�>2�%�}\��KhW�: .S)��~.���d�~[Řd~\�HL�R%Nȓ/�;��'f�&k$M��5���}�|��Y�jU�Wo� \z�u(��U��к-h�\g�Y�dl��Q�"x�g��a �f���z��C�NzT������A��c����! lׇ&����so�a����P�������D ��;����S0ߩ��ޜzJ]�Ę�� �ZW욌�>zT氀� �}�0���&�'h{!Ԉ�׆����g�I���ˑ�/� �"BSJ$����C(ꟊ�2-�F51��}� �*���=ϳ����)�CJ���C3�#���O��k�����)V �����ʝ2� G���Q���쐴��|�6��7�R��eڸ�������uV���'Ȋ�� m��2�%�-�g��/kZ���L�>��zE���e��?�ǀ�h�\��֭i�e�����ǭ�t��A�M��V-E�O�j@��E�GF�V�;��B Lx��nt<j�i3�����1�JO`ʎL���{{�C������:��0�Ɂ�E�H�m\ �ͺvhi������bu1�%���!��V. »ҙN�q��m������\y<b=��Y���puB��3#|����Qu�x�T���^���<a�z��}���K?c�*���L����C-o��'�kU��ZF��c7�m+'�a���6L�r2�������H{�Jɺ(��_�2��d�^{k�(:�l�K����mp�W�"��e^kGA�FS,��џ;p��Lw9@���b���@;N�ڥ�|&���a�L2�Δ��e;�� � ��b�^�/�D�5 ��b D雋��˶DTb6��h<�c����}�+��R%CP�i�F|{3���ˀ��'�g�yu�:h�.���ȕ.��&��:��"�-Pu������h��4{�v�}±dh��>�M�xd�|��֒�"M�D[�K���ц�;
Static task
static1
Behavioral task
behavioral1
Sample
5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0.exe
Resource
win10v2004-20231025-en
General
-
Target
5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0
-
Size
1.4MB
-
MD5
07f784e87cf3f20589ff12b464ff16eb
-
SHA1
b72198dfed9e0e77264ca2991b24b488119b0f60
-
SHA256
5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0
-
SHA512
00e79e1516fd6e5d976e226783e94f9e17a0c2b347490dc312284e6663ef48ce6d8a9e73da72291b76766e8996f98efd0f27b03c9b5656da2c894478d0fa9a35
-
SSDEEP
24576:ppDk+VdZ7ebpHssYhqXAC0Z1sPCvL+bf+E1i764PfL0M6Nsn2nwQmszM+pD:pdv7e1sntRTXEr1i7VD0ZNsqsszM+pD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0
Files
-
5ccbaf0a7baebf4b235c34cf86fea08033bbe4867675e77d7602846e1f6d6ee0.exe windows:4 windows x86 arch:x86
7d4c667f95c862ad7cf3562cc4fd1280
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVerifyVarObj
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 674KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VM0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VM1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ