�r�8E�d6�v�Q�r�2ٙA��A�I�JY�$O�!�����6=���9�xc}j�ŧ�m��;H�_��ۜ� IF���Pry�����3�Y�{^���fcb�|��N��b55�;X?Ҡh�� `�O�uС��L�$��A�W#��X�K�I���G���sN�Mg�V���Ĥ���o*B��P�����:���k��z,C�b��`I�����~G���VX�`�e��_ŀ�����W�|jAe��6������f���F�����^C\{�@�����eµ'ȇ~��V )�S��>J�{ �<��7�1����/U�3.�]KPA;W0l|�o�ݡ�6�J$�3�[��}�דc����%�����z��%jI��"fSK½c�u���M<K;�Ґ����R 7u5�D87�/��ܟ�7(��_k�M��+������;��,�M:leB_���B��{*��?�-H��w��7��e�$�E��˘�$��.-E.ɗol��,���"�U��)����MN����%zk�^���7[4lJ��Jg�� ������/�R/�[��L1lG�F�{�_R�ƙ�D�������ur����ZO�*�J��h@X�a��soMb�cdۏC�1�����g�H/+y��'h��^͉9#}oF��7}. �K����$V@������A=��Z/�k<�ֽ(eX-|Е���[+_��3J��,'!�+�-)[I�շ�����:�n#�#���K�0��}�ѩ�w%+��)�=��g�ŏG�`���c2f��E�Li|_�,����U��pР���*�h�� ڤ*f4?�BD"8�z�g���=�s�UYS)g��Y/�Bb�?�]�-\������)���MSC�q�ރG��,��ZЈ�?5.�w�]�Xb��~���[x�Q���D�n:�[ē��#�xgv��`6��qb��;�������M���?sK$V��qk[�h�;���B"5G�'M���> � upmH�1��h��u�P,���<(���e�9� 36��2P�d��Ӯ����6S��tZM�_{F�������8��sn��)���t����Ғ5�� ��xp���r�P���K��]i����xD��UXJg�o3gY&����@���ڃ�-y�� ��O{u��'}@=�j�"y-�>�����t��,�Y�2��괜�v� %[���mؒ.pg/EΝ��=����Y��k��r���MO���(� 1�0��J_�/�8~���R��c� Bw����y��l�u�� �8{�?��@��i]s �M1��%^6�����ĴH�?r�;Eh�m`��b���#q��ҳ6�14����N�GZ�*� �q�� g�^4 ���h�}=~��~(�g|Ls���xd��_T�Ŏ����O��_%�|�~g�b�`e�:}���+!4����V�x�~��1)��������J�TH��d�f���"��������<� ӆ|ĕ��Im�2$h�l�WM��5E���c��,ϝ�E��٧�UM����F���N�H��(��z��x���r� d�� 0��h^�x�Ĩ��$|�����C)������@o���d��5(l�l"��T���J�,�*��TUb�1� н+XhUU\�?u�MW}�,���?�^p{NBW�,���A��UAe�C�*�v��T�H�ZN�J>���6�*L��X���RMh*{�D;>�=bm�:�]���oد��zU�������Rz��Dh��\ ��M3Ji%�����wܡ=M�W�����v������� P����M��)r\��2��x�λ�<e �l7�W?E��q�l��ܱ�>F�הZ���Q�4� �e�M-U,~��WC��ɽ5�<��E����ylh���m�#���$&��hH�6q(�8s&_���j�!��h�ش�'x}�$�!��~���GzOcw��6 ��"Αu��j��94���EJ�i��;�U���)E�F�+͏|�k�Mǿ�n�� �2���� �pK�֫�1�P�>�A3�h��ޒ����G*�`=۫ }��}J�^QS�nx6ja-� ���i|1����e{�����-5����bi?&n���]��{*�vx��<xB�,�aF�J\yu�Ku@�b�G~4S�B]��r��>n./�������Mъ��//y�>�i�w��AKB�;���3��s�!FiO�Ħ=P|h�#=`��[º�yce۴Ư�35z�A�@`ٖ�GuM��2�RM�)�T~���_x+����M2[���9�x��Q�#=/�5r�Z[���? ��y���64�:E����:|j0(��ܓ�$���m1R�Z!~�)j@���Ăу����M;m�Y֣|Xg�~ޔ���~V�br%���V�.^�������.^pM\w+���G}�_Y.�.��9�)PM�*�7���L��xf$뒎����־��Qf��M�$�d��B�#"���������s���Q����2;��iq���=�x�X�Z�t\����� LV8&�0�� ��G��s�`��C�,u�B�j�U(=��R�t�rN��К���<����Ow?��: [W��jp�ؗ�Gj�mpV�7���}������awU2��j-&>�l��LqA�l����%M֕y���2h��U"BpL���@O���$�\���i�M�~�n�ErV���~�D�I���*:��Ā�{��.��A���n�;���b�;���gLZc�����;G�2V<B�=�f���R��Ax ��s�J�}8��'Eq���%�ߥX��S��\W�� ��`HP�E`:�J�n���(��J\1��d�x���{�o�9�239���VB�/�PKH��]�]ÄP8��9Q�H/�xE���0�f0(D��x���l���} v2ZE/�re���QC,o�}���(��0�z�����!O�%��]�*Ƅ�-2�������oȩ��V�UͯVh�m}K��F��'z=RS���sӱln���� ��Z��O������Bϛ7�|N���-���b�������u�U�F$��#�V_B���J>�yM>�� |ߨ( ����E�ѠW])���X�f����Z���¦�L���[� �~ �Ś����qE5�����M7�t���Ab��,^���Y�.Hg��?��E8�v��l'���hr<���p�Jv��Px��թ@��`0�0rj�����@G*^�"J<�n�0}�mSݮ����{MQWUS��S示�#���/�K�m�Hy�J(��t�>C����<�PD"�=+DL����]z�v�J��BYU��A�r��r$��!���/�����$����e`_�����ʽ�`���Lg}�/W��t4��O�=l����K%�����h#�xP,)�6S��� V�&&��ٳ�b^Gp����(-}Օ�c-J(�ڧ.5/Ev��Z��d����?ۚ�w�<�[��b��,H�T����?H�A�V����vj��Y6Q�$e�;D���AMT_CƑ9N��D���%�p�#�2��,�D� BZ��Pw�{��s��t����ڠp�GG~_�A�����8�*2}��/��+ ,��%>��m����6�f��� ��$��d��A�q}��2����Zed$@n�F/�r3�����w@�*�$+J��:ߖb�VselLjĘ{B������I�����S�)���C�-��i�(�r�3U���2B�@q��-y�
Static task
static1
Behavioral task
behavioral1
Sample
cf361aea1198ea2ea7e608ac3950eab8.exe
Resource
win7-20231215-en
General
-
Target
cf361aea1198ea2ea7e608ac3950eab8
-
Size
2.5MB
-
MD5
cf361aea1198ea2ea7e608ac3950eab8
-
SHA1
48575acaa251918ad515728b01f68cbc2ee694a5
-
SHA256
d12b78b7be43750a57e10e2f989f01dd22fb3a3c8bcec4d15877be0d9dffc3ef
-
SHA512
201677f87d496343bd71ac2ebacba77d5f28226b0721d91fe13cfef4945d50db17af504a2577dfc3bba7492a5db8a5158b02da362bb8baacb646c9680ef53f5a
-
SSDEEP
49152:rm+I/bulQHFc67Tms3Rhg7U28gM4HC7J6L7WRm+qoqaE1aYJ8/0EP3KNfuvLzMJD:rm+I/6lka6/pRIUTgM4uJUic+/qa+a5V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf361aea1198ea2ea7e608ac3950eab8
Files
-
cf361aea1198ea2ea7e608ac3950eab8.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 141KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE