a��T�5EVb��m1e� ;���P����� )i�)��BR$e���װ3Ƈr�k�y��d�A��;8n͍R[����u���!���\��b�O��~��W+��a4��~�g �qg�J � 2�0t�1�Y��������ho�13hb��D��Ub��-��W"m�l�i9�����)�y��:���romA�'e�B;�����+� v}ȇ��F.t�Qn�C����8q�����[�ӓoX�YD���aI� �����~�،��[�7��>T�,1�*^��P;����Y�p�q���W��ƭ������j~QM����[ۚ{�e�JMv��>Ș��9�eO(�<ld�������9I��P�'������X|=oŤj���u"˰W�U,�s���zk�c�:��5ܴ�0|�CutZ�qx���} �,��� �w�LK�L`B�D/tE��N���n��x9�%L������!����!�R�<?�9���;�uL�.F܃Ͻ�G�1�~%\�W�7֝~�$N }���-����/_��o�� ;�����)6g69_��@��&�ڰ���r�\�mf�V�@P##+���GC���Y�K�ڜ��Cm��:�ջ7n!ە���`#s�z��{ v|g%Z$�B/���J���R���R٨����P��� T|���W@@�i���!ȓ����Fe�� \&����G�P��rɏW\�Nd��8�_�r�k���_�]3>"�L�H���϶��v}�1���,��{���s��c���Q�G���Z!�� �1��ʯ5������h�1/$�Ə�ys6��9��6�s�#I�(3�_/_�7Ѣ.!T�Q�!��ZL���j^�� g��b�ɋ�/�_[G��.c��{��,���e�(?��_Ѝ�_7Kǎ�kmi�v� 6�7! ��e7��D�9�Y�H~�DF�\������Z�������|�1��.���8�:-@�xCn�6����ج�D(�<��^�'�4��*�;O�FF�������K+��RM�ę��X�cS%�{��:Xp��9���������� $������9�����"���QQ<Xg%�i��θ�S]DI"(�<��H :��Db�~��Xؗ��L��-vlV�fY�Ʌ���H���ݸ<���L�u�k��c6��k�� �ЕcWq�E.+�kQpF�z������r�1L��;7O-���`B�Nv�GR�&���-���r[�T�)� s����?�Y6p���o���jM������ �0Qw�?L��<c{5 �>����硐�Z����w��Nby����5pCgħ�2$G�ݞz-���d�x{u ��Ē���ܷ�n�'��'���W� �^j{�R�U�p�we=��G�DAI�A�&Ю�I�H�� x�g���y�����#���'��l��_a5˳�gP���˞?VH�f���0?�Bsi��I���Tą>��f�A:����{�Ow뮺]�̇���i�r�w?yeT��£~3`�CCc��9;p�ESB�3����5��G�eO2��8 `� P��Ey��FI��VM��/�,��6e��"�}{��n�H�,Z�J���I-<��Q#������A)�"ÏH��)��ۡ��yqZ�<t��pE�.��2;��d�\�%�M��TO�4�zw��v�W�.�ɜ�#��q����`����v1�n�6��E"�2s��Gq �]]��Z�q���S�lQ�'�\�w�;C��4��- �q�?k⊶��;ݴ�e��T�N\������ Dq�z�2?��7�H��҆w����Sns~���s�ZS0��AY��0+����Z���:�`�Ō�p����zc�)�b�/���xo� ��t���R�A0ž�V�e��R�n;�sk�P�5�f��*��Gz�������aQ��_/�_����]����K��W^]���<�����[���t���E[5�j('H��^��"�s�:3�h���N�V�Ҙw�����6&��F(9uւ�vu?�ݬA���U$T����+.a�"D5�s=�&U�~��~��\������ ��Rc÷YhP�*)$�$ ��<��G��5@NV�7*G�+͚� �<�h,0"��5��ti:�F���I��Z����/e���:G�^o[���k|�>�:���^���=��|x߸}w_:k��<�>�5͊JQl�&��+��p���w�_�0V2�]R�Q7�$G:� �OMs�w�2@f�y�^ӡ1#�E�?��L�L����,����cۺ��.���T]Bc&c�� tɣu(}ֿI�`�l�Dq̏�y���f�Z6��`�\�h�����_o �}p4���{���@�f�*��̞.�G�OCe���}��n�R�J��vq��L�B YI�$�[ e�/�|2�-���@AU�ޅ��gP[���=�pW\~ɵ�*U�F���r� ���Z}K��X��S��ńضn���+����Xѹ��i�'����ޛU�b�K �oj}����n:y�f��������3�G��N���]�:8�K}���������ʌ��4C����<�nBVN��"��q��ޫ�(���"7J��7;Tm���-��mF��~�h�,FH�Mǚ�f2 ���>�D �m� 魁�� ~�����:�Î�ŕ�Nۯ%�5����i6j/�p�<�n~�$�?��\���`�0�QY-3.���F0gM��Q2���Rm�gk�ʤ��Y]fodҵ�`J��X� ���~�nϵ6b&DuÉ����,ﻫ�J�T}���]����3W�V��b�v([i���.`�w�������2ʣ�C�r��d�_�?��"7�iݫ�����2# #�>�Y�������>#�����Gk������:7�k���.O�K�]��tfQ�[�bD�h!ڱ~*HL�|���W���D��J����q�Q���*p����H r���-�_��'2�ha5;��Z��qU|���㬁�4��j[�H!�*�|�n����w�*F�ͬ���Jne�����2���'j��;�������[o"`�8�O�`�I�,j@۲N�a�2+`� ?Y�^�>{)��� 3 x<4q�>�?��|;���g���:S/���N�K��^L�ԉ�3վ�dT����Tո�HK*V%�������8@�P��M{�S�$ս ��o?��.��nW��_��&]�ںC���� ���w�1AAڨ~�� ���M�������9â�V=��P��Q�>e�����V�Ak��K��W<�s��5V��c�]�|����%Ta�X�$�R%�b�
Static task
static1
Behavioral task
behavioral1
Sample
BE_FORCER.exe
Resource
win10-20231023-en
General
-
Target
BE_FORCER.exe
-
Size
7.4MB
-
MD5
2dd5fb053884a2984a0d05541f4196cb
-
SHA1
05ecb44dbc760e351a37bfadde0f5cf72e0ab51e
-
SHA256
93450c9e14e398447ad6c2cc4b23d5a00a0ed59c55f9a282379b714a9137344c
-
SHA512
ff3523cd697acb602f465feef42e7efeac37836ac5fd4aaf03cd3b2b7612a9112b187e79473aed024ab2d69167294efbbbea5bc8c42ded1a7162b8a5f82c81de
-
SSDEEP
196608:gRIqIFLoElZ+sT7YfO8AJIZU/Vocmax52izzEJ:gI5oRAYmzCZU/Vnv72i/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BE_FORCER.exe
Files
-
BE_FORCER.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 206KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 32.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE