���W��M�l��:��%��b:�)��L��1"��)@�k˛�ҁ�r��R��]�۴�F?�h_�s���,X!s0i��{���vb�K�hW�:�;���}���b=��ݿ�/o}kq�˧�-� �>�0�z��r��Q��8jP�1���JuC�D;o{�;9EQ˖����i�s�-K���BL��h ʖ�3OY ��l¸����EӤ'#(̿�ʕ&5K���-�s�TJJ�̓�H�0q�h2��@s�0��{�7x��%�r^��l{��CnKUnm���շ�����q:�{�o��>�1�^� 6C�!%�iu�����{�h��P�9ɰd(�����o_��du���B���O������k�Ǻq;�����ъ�5�E`y5��~�c�-�^Z���GM��I���ܲB��m1U�T�P#� )v�)hb X�hO���MmO�V�,�y�*��gd�}��*�����b���}3����K�t֣1����f3���R$�um��]���������(w{.�Nn��X5QJzT���e�����8��t,M�4��;�x����]��gY %�40���@�4�����2�,j��x㛠be�+0���w���j`:N֒�j'�H��)�,�~֯��;�d��L�|bF.�|��q+��xwh#|���Qb(���AO��w��Msw*��ѩ���ܦÀ�#n�?1�o[�=G�e�F1�ѵ���<��/���a�Q�鶾�M����ԳH{[��@��='b_����1��_Ɠ�=��i�Fe��J� �'T�����N�&l\m!�_kPR&e���I�S�5�p��h�T1Qk�ZA�}������� º��e������C�y9tV*g�?(H�A���o�����KFm��Q͓�����1���>�%���Z�� A2�wB%:��������^� ��J�A�g�Q6��Y��N�&K��]�>l�7�C��W67rf��ՆZ�p(���ێ ���C �*����X��?갓�:Jَr�K[}�J�ǧ�yI�8�[�[���]Y�S��S�Y�o*߰&2�z=H����;�丿g�a`$2��j�L<���Y��xS��)>u�.�99Y#��x���)���������.Q-�?�;��VU[���]�%���EL��=�X��XW�����j!&ғ��HG"/Å����˲�Z�����+����^.�5��s��;���uk�Ь;���mt�/}�rZ9����0�=-;�BQ�W^��m<�3A��S�����ٝ;��XJ7��-"�@ڒW�L! ʘ������i� �a�'t-嫈��&�;���k����K���(S�#��1b%8���,�"� �)ڰ��t��0��>?�a��<g���)m8|��sW�R���� ��O���Y���!^�Ui�F��_�`,��ifW��A-yzF��y�����~�2�)F�|s29ݭXt5<8=>�Z�Í]Zb<��zp�<��P�O|������ �~���,��1b���C��K���8�F�T�Z��� �œX�%���N-:0nQ��8��ڨ4L��L{����E���g���P�s�m���7x�&I`�`�Pcz,Ra�2�/���J��N��YZ���=��*��/�.�$]�@����«ٻf�1�ț�Sz�%����-�{V/T�Y�h�џ@A�� �y��6F�މ��>r�w� R�!���S����4s���V����wd�!��$h���% ��&33ZE�z���LJ#�ZІ�q�}oVFY���M�����}8*�혏�C-�u�p�t�[���g�˝c(+�+a����]`�.���}�Mz����pT�@�{�I�4�7�`H�Cł�ɱ0y���s62r:���� /iz&V,���[ۀ��v�.��n�|���S��� �;>�0_�7�=E�� �}�_W�#���9y�z��*�p�X�o�Q �w��M� ���=����VR"8� 8�D��fD�(��M��q��|o����p��f��?L�zT�#�%�]���W�x��I��]�֊�eճ^|��fy��aJ��RO��VAx����_swV�m�j�e��Ȼ�*�L��_�)~'Q99��F�g�<*_S�b)��L� �~B��(�X�s*#���?Q�F�az�r-AE�6��Lo�I��l��SK-��j����9�����lLf�V��1�k�RQJ�Q.R��f�����S���-�.�$�zRJv�<�Lṅ-��������{��N��Wr�ZY��u�v&�o@["�mtU�J�<�/镧��~B�wKNvtI� ��u�8�3ە��֒K+x��k��z/��R4Yv<��y*�(�9I���tc�t7U�h��(�_w�J��m"�0�ґY|]��"�d6���X@�mD6��zBk!a G�h�� �F�R6��]���!�8�_�4�rC�7D,�]3�Ǿ�㻿4�*�e;����0V�����f�0Y1�;2�@�o iM����_I��Jm�nb��{��TCO_*?*��OR�Y���"�m�Y/�gA��c����uI�{���d�����4Ih�ۅ��/�|(� ���Wg�v\�9� �����P��h_�_m��(�}��iO ��sFq�_� jtO����0?+��J�M��@ d�k�~{`��G�x*(8>*��H�p��3m2�u����"%�q*i�v��E%Q�o�'�%0dtEwwߠ��i~��9 t���>��!��(��22���_�&*q��4T'���*{)�X�ię�( )nE�4����/q3�E� ���i(�b(֝+x�j�L�wnE�T��imܤ�,&��71d\5Vy 4a�z(�AO�dx9.A��7��cg�\��8 �+~&��2��ytAn /9���q����QU!�(.�ha{2�/����ۉ�K��U�����J 8�ɄN`�x6�|��%���e��˖��w˱��ǒ��ɟ��ε��N���7�2Y��� +B��w Ϻ�<|3D�D@�9���]�Zr�����&� .�o;a���G���d/E�Z��� �E�#���>�x9������g���mS!���a3cqw+�BA#�/�Y��C�q�e���05���tsj~K`2\�!���m�V<�r� :�(L�E=�yò����3T�܊|Á�G
Static task
static1
Behavioral task
behavioral1
Sample
f00cf2cfcbf68f00dd9fe65864a9e96c4a5725c560023c66a5d4787ef190ae91.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f00cf2cfcbf68f00dd9fe65864a9e96c4a5725c560023c66a5d4787ef190ae91.exe
Resource
win10v2004-20231215-en
General
-
Target
113ed3aa5d9c70d41d01311bbcaa4975.bin
-
Size
5.7MB
-
MD5
a668ed56446e8135f05d7c29ee517155
-
SHA1
823b0b7adaeb24f9ccd4195018d3bdc32867c49d
-
SHA256
387fdee6efb1797af47be50d190a0e46e0ac470288a916c73b7f480931d83863
-
SHA512
2938230062a87828e7d70a242b02853793184c700c216aa8fa800b61739f3db8d030c6ef8aaaf88186953021c348e4b09453dca86852afdeb28098f8a1d20a9d
-
SSDEEP
98304:tCQzOlh9wwa7jSvHNp04xErcfT1tyMVfyvicZ2Ce:QL/9wb7uFfxErcf3FSbZ27
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f00cf2cfcbf68f00dd9fe65864a9e96c4a5725c560023c66a5d4787ef190ae91.exe
Files
-
113ed3aa5d9c70d41d01311bbcaa4975.bin.zip
Password: infected
-
f00cf2cfcbf68f00dd9fe65864a9e96c4a5725c560023c66a5d4787ef190ae91.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 83KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 21.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE