|�]��%@��)�,9Ln*�F���]��c/FQ�f�����m���ܢ�2���{L�?ɔئ�����l�+�����3�da~���A3G�1�ry�����6��A'ۊb*r�-���H�и��i����H����/]�qÄ}��ǀ�}��������N�W���m���y�Q��#T�=����w�ݨ�<@6��JP�#��(~u������o�2y�`nZ�3�3��x(~}��R$^lM�<d9)8��=�%LJ��m�X��N4���Cʝ���#��VGa/�,���F����ȍ��;�lz1��Z;z�a����M�t��e�ֳ���./���Q�����[58M߽�:��k��?C�;�\fw�o��+(�!]�fR�I��0*b'(ߛ );V��T�����N�����^?^f:�+?^|Mdĉ7�rL�f���eLn��L8������(�\�J�pμ�M��z���*B�:��}��(#c���Sk�8�03�u����aP�p�����\ �$�3r�RC�sZeQ�u�@����IF��grs�����9�����1}|���ʙ����� �7�+a�f�Ov.ЍT���n�4�@���M����o�IJI�페��E��aRU �xGD�V d,�G � ?�%R/�zxЀ�2G"���zG�&`j�` ���5�w-}��������6Yw4(H���9�Jb�Ug��8��j�;\�'z���kl-�ۡQX�4_./_ ���������Ŕk3N�VWδv���e/3����6��s`��}[���U�K�CcT�&��^8�����2SBt�+�QemyN*�4����EG��H ¢T��T/ۚ!�Fh��W$ɑ����&�QgF,��i�F���H����y�����L��U�\�!U�0��W�Vir1���?��>��^��Ͱ�������Zh7��e�x��/� �8�"�;"��SQ=�<s���m �L�p��AW�X$j�6�<��m�!�]�k* ����nG����ָZ���{6X���S��/v��/�a�0ZH��U��g�lC�n��N^'ʌ�(k�c��`��h���2V��5�͌�T��̇�����4�Æ?����T�� b���� ������K;*(��&����9�f7�}M��*.9�ͻ�3��f�ܴ��t����A��P��<�qR� �]?���:�r���`(ꤏF�q�p+��**�1�����j��l@J(���li�������ٽ���)���Ďݻ{���0�2��"M���T%PgD�� b1�vK�A-��hA�u�Ōڴ 웷�8��M�, ~:laEw_����2��bӶ� �Z#2BU�.�{]w)W-�u�!�J.f��M<j����W����)�k�Pu�$�$�I�B1*�d� )�sC�>�7��0��-�����խG��XC������ae�i��20�)��3� �i���?e��]�y�#�>��*)%�mYh�j��2=U@�Z]��U� �Y���&-�=aN��u�Q��O��!]��Q'=X�Z��QN�4�e ��2�;p��Ya}�D<��q��J���p�L�����ֳ����Z�3`vE�=�W��%���1����AmG�e���~CLj��q��md�ء� Л\h3�%A���s��B���F��^����IK�rE��1�W�%vRѯ$lF���1�83������zSO�][�l� �yx�@g�9���줪V��A�ϗhcl���!�:gCpg�|����E����9-�d,����n����a}����y��*�t��ֲv��C�w(���3k�sz٭��ð�w(��(��Bb�`�2��D�p��1��+ڴ{1_��(����U 8�DYnyg�I�R�YkGW_o �U��E�MA��_M{�Eru<�,�եc;��_Ku��<�����Ҽg\I����nU% �Ϸ߈H�]?p�271[Q��Vco���i�y@�o����Е����"��i��u�}�#�?����ʂ����{O�΄�b��X�h�Kö���� ��.,��'��v�M�?�Y�뗸G�l�1$���Ϭ%����(�-4w,Dr7�,T��3P�"�cE�;���a���T0~7����Mr%���u�K�����!�^�9���>.�I�9���zs>o�������č�X ިU� �nv�h�A}C\��漾av��Q_f�7�̪='���@eK���.1�ő:��Ӂt�U_��e\�����&�&e���T�OZsA��X�]�Rط���{&.��w��U?7eם]�G�%�ֺ��� � 8�e�y���0�����N2�C�=����i�l�[�L���1��1��M��1��t���<�4��Ά�)߾d�K�݇Q`�8\��9�����^���^��6���a�w���5x��#�}�K��B>;&�:$(��: ����?��ܫ�9� #/g_��g4Z�8����҉N�|��T4�Pct�a����"(;0�AE|�ۦ�C���]���+�;O�x��a�X�p��|��A�������Q��Q�im�쏸@�q ����[�N;�y��40��\"��9�����Y|������C�[�g�oQC煞,Y�1G��L�BI��?)�p��Y�� ȲMf;����C-p3JC(Af�o � �6�`�:0�2���g*�������:�S��C{ԔSM"�"��ǜv�� ʮ�.�W=�}�є��(<�n���\��0VIv^a=�G*����� >U)����`�PӃd�j�R��9dLʱgl���f���vdMQ����|O�-^5y�+���5|��]Ee\�cUō��֤�+瞮_��uۣViw����7!��P�Sΐ�og ,E9��=��B��HW�4���v��GJ� S�cIpA� ��G���Z�x��ɼe�v�7�4=Y��6�T�mW��T-E�'����v�D���r=Tg.z>��1-˻KeG��QoiiP�e��'�>W�/ H_'����)�)�HΟ�lH����:O�,�[�
Static task
static1
Behavioral task
behavioral1
Sample
1cefdc6e3e153e88688677263e440d8e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1cefdc6e3e153e88688677263e440d8e.exe
Resource
win10v2004-20231215-en
General
-
Target
1cefdc6e3e153e88688677263e440d8e
-
Size
226KB
-
MD5
1cefdc6e3e153e88688677263e440d8e
-
SHA1
e85c9d1d6bcfa92585bfeaa7aa209c3fea38b2d6
-
SHA256
34b4e29813b3cb52143093eab867cc345e8101e96515d62e195811832bf59cf0
-
SHA512
83ad97658986ed5a5a66330aed0d6cd5b60ff5b275804ee4e3fda012f3fa03e0a84f38d23fb6190f9e17567ef724ebf16379abc29d8b3e7dbab0af5c50f4eeac
-
SSDEEP
3072:fy7xZDQzodGZJqYpmAb2JnaiHanBo3ccv/KEWuSCfA4Kgr8+nS+l98+mHBjc0qJO:weEsZbKlKfzfuA4KNQ6PhQHO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1cefdc6e3e153e88688677263e440d8e
Files
-
1cefdc6e3e153e88688677263e440d8e.exe windows:4 windows x86 arch:x86
cf75f9f6423a10ac00cb9cd36f37aa2f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageA
advapi32
GetSecurityDescriptorControl
msvcrt
_controlfp
netapi32
NetUserGetLocalGroups
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pxzz0 Size: - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pxzz1 Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ