�/���_��O�!T*��Y1���?�<ک�?H� |���\Su�1t�9uϣ�`�36���2ء*�v�w�ey��d3�Puoa��k x�)L:���,kX��M��z�d�����H�=�k���贛��?�?\%G�5�ca-6�y�;Pr���|>�tخ���a-K7�u)Z041;��V���&�g��8��0���EWHRϊ�����*v�)G�]KWZ���� &�z�VC���� �~��I>\�AO��ķZ�{�;i�]���=i����2պ��V l�H��Zҩ�U�2"�4�����z���a&y �@�5]�_��@J�5#� O��H^y��oVneT�GV�//gF���� ���H�z������09�t>P�-1��c�/(�����u��e�1=Z���$8�h���}��gO�f��Ku�(u3� ���J�mګ2�>�?_0� ���N>�����Rn�՞�� �pU�[p~�[�z�:�Ȁ�������2�X���f�b����A鮔<��S$$�IH�f�x��)���G�7�3�������Ѷ4A��@w�� �0�wA���K����"|��~0x�Kr�/�G�WB�g�����< �+&�]��(U�f@��4��:g����B<&t\��n���.�@A3�CE�d��m�E������捬�X��[�wq=+كrL8��7 v����옷T��{��IhU�ji�i_�Hwi��oqN��":����Q�ٌ��=�/ P2<�Bjs|w��z�Ƿ�Xh�wI'1{j$sL�����_4Yt�u>P]w�J�����lt�Ӝ�]?}��ߟ~�L>/K+����z�h���^����I�B�}X,.�4Q��d�Y�;�{wS��Ƭ_j��J����_� IrT��d�]���>��i�5 �HB8��W�_��rjO�x5��-XC ��{���O �,^i�Qj=�h�Cm���~�"$5�n�����Zt��3�L(�_��O��Տ��6���q��ȟ���>�]�8Uny)Ivf�X���������s������Z�<����^$]L�(����c+����H�=��G�Wٷ�A�y��38�H�רּ�s./gb�$'h87J{��.䆳ǐ"�/L���<P�>~��O���^[�(�$5 ���8���Iʗ�Q���������n�"��4�2.�(�O��<��A|�r����N��P͢�YE��>���b�ݹۆ)���$t(���m�����J A ���^����b�^B;��ak �Z!����x(V�~O��Q���������WhaA����~A������d���|��p�i�[X W#��^�|�ׄ������p!���}/�]��H��Z�+���� {����>a�" �{�R�&`֠�,�����cov/��l:ã������".-�k��� jKе�1��n ����8��/�cM��e�J1��X�햷���C6��|*`K�&�p��<^������E��ǿd��([� �d�A#����)�S�4�c��6��=�Ɓ�0�VN��ǯ���Ɇ��c�lfW�������;6�*5�[��{gܕ����/U�2��`�j{y�yv��������i���W��zs�2r��������0�M\*|U��1O9�c�� ���}��b~�ں���ё<�i!]!s�lA��31�� _Ŵ&T'�L0��Yz�����jU��'�-�s9� �1�5�H�R���7�{8r�k��}���H��r����N��{�YJ'�G������%$���Kv��U�����ڧ �*��A��pC��1od�h�2�|���P�������� �PN�#>靡?I��ӽ}���U=�l<�Lg�R��K`%YM��LZBZ��&;�V0�m�j)�F���z�Jy�?�a�:4��z[�a��MB��j�"�^'볧�<��Gg����F�������5U6�����2�x�V�c��;/�D�%�.4GmL�����/Ia�,�쵔�OE�Y����7��އ�F̦O�_���Ѐ������ ��N��Ѱ@Ԓ��W~�����S� �n��&�� y;���v��3#���b��FpQ���Kţ6�F��,2ʼos@R������ �P�Vֽ�R�ӿC��0~l+��sc�j+\�ݣhd��]��&q '�yj�j�\Y�Y>DӚ*�M�W4�A�P@�bdr�.�{wo���z�Ԙ�?��dN^ϋ�9V_=���s}`H�E>��75��"yV�]��)�k���O���ۯoRk`N/<���V��n����4���3�sF~�5�Z�ٽ���ی�Xat%%|��u��v�c!8��0��j�X��h��h��qH�xO����p,8?#��4����1� <7N.��oM�:�z5v�h�,�*]h��Q�q� $+%���zۀ�G�cH7�pʜ����d��<�z���B���D���]W�������L���^�1�"�M�>�q�>[7sI5m���]���C�9��0�ɝ�ՙ�M����?v�I%t �r,8�jR�[.x��xaq��s,�p$M[d"���� @��Ĺ�T�(����/�1w-@���0@S�_�����Ϟ���A]���]�wx�v�{Uc�+����~U��&�?}����P��)�@7$0$��FK�����}���7�f�:����lA����H$>`�9'�ܜ�6�& ����e.�O��j�)F�[i�Ȟ��_���Y�9y�@5�1�� :0����d�G_]V�\���E����\�+�k��R�2��4��+R���w�_��p�Z��d�4�)gW#��+������H+L��ڏ>�f$�[V �<ASm�C�����)���?��:3�")*�y^��Lb�C�)o//�����5=+��0����q���Պٶ�'���RG�:��{�KŲ�O�g!,�;�_u�9�����_c!�$�R&{�}����䆋�I��5T���f_��g:�� ��18^�D�.�x�b"�M�ڷ�> W��r�N�wLc:
Static task
static1
Behavioral task
behavioral1
Sample
1fdcf4335faa7b7b88643a2e465368d6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1fdcf4335faa7b7b88643a2e465368d6.exe
Resource
win10v2004-20231215-en
General
-
Target
1fdcf4335faa7b7b88643a2e465368d6
-
Size
288KB
-
MD5
1fdcf4335faa7b7b88643a2e465368d6
-
SHA1
dc0f11784bab835337afcf8be4f805610553ca97
-
SHA256
434a471541de8230efda6f7b9874018f3e57ac2c9cf9125f25f4287244099eb0
-
SHA512
dc2364e3d245346d1de8ca521dff04aa025fa83aec6e808f1c705781b69a8a2a6310171bb4c1b85f18092d0a9fde89fd0fa4ffa6914bf3195e8e530c01776c5c
-
SSDEEP
6144:wFjwDg8uNhrDQE4W3ijyRs3ZPzxXmV+or1lfrcO3ZDEKaBJ3+GRqp3rUEPAuc/6V:MjiduNh354W3ijy23ZbxWfr1lfrGFBJm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fdcf4335faa7b7b88643a2e465368d6
Files
-
1fdcf4335faa7b7b88643a2e465368d6.exe windows:4 windows x86 arch:x86
930283f7d4c61d31a946457a696a58b5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord519
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kubom0 Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kubom1 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kubom2 Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ