2.N�ҡ-�*5]8��-�� K@#�M��GD�2Xd�E�,E^�HM������y;�'xu �δEʶ�ړx(�pI;�V�q��lnyʪ`z_��=3��Z����_'��2��� /p�̶<au�u{���H�S�j%�c���w� �*���_�����Bw�S����=�]&���$/�Q�E_�WA�A#=�pzw�t������U�b�y ���@<��Np�������<�8���?ʹ�T���͓ Oӓ��RS�ǏN�1yR�X%�>,s&���u��ヴ7���(y����G}ľ�U�?��ZNΰ��%ͬ+�@\����n;S����}�n B�g���K����6��]�VM���O��i!}=���G�S9�)'��7��#m)���0�LP���!e�k����:ڒ���+Wۊ�b��:9��C�^)O��� f����Vzwu���4H��\��5�r<CSX��3&?���t7�3�5*�gR8:D}l� p��qxf�K��mE���}��ze��\}̎�9lrqrU������X�m����$H�̓J��O�N�Ʋ�s��OK���DM����=�qR�E�']�;�+Ma}�F#�P��<�@�}x��s @:Q_���o9��G�zZ�}�� ���������r������`�Xe����ZH�Դ��9Z������Q����Պ�k"n�W��E���|�ИO5f�g��5j<���F�OTgj���O���]�|�!�K����B�<)���+�-ZE�l;�8�P��a�-W��G�#�\�"�5����bc�W_��� $�}&z>�b��duT�� ���튣��0 ���E�Bn>�2@B�@i�<� �{m2z�x��-zn�_<�fF3oN���쬑�5���kO�� 7Jz�3{I�I�s��6̿8.fP�̝Ɔ���ޡ�U��E?QpRb�"" ��U���'X�\���Kp�K���1UcZD��������A��y�$̬̍��0|^e3��d�na� B����_.�y�8�8z�~c�(���\W�b��E&Wi��P%�p�������E'fo3IYvY ���3�7s��@/��0J^�_�;�zz���R Ȏ�\j��"&�z�8��U7'eN����q�J���;X<���c��F~��!�T�`�q�mE�Q����A�~�p�L��$ke���Tm V�L�� x�<v�D�j�Zt�%�' ě�|��oZ�CDa�k��s>x�/��g��K#�^z��T�J����+ ��˯Me�mP$��a�l�a����Z�ӮI�/�nI�( av��l��,�7�2���^�ZX����Ć���k����9��>iH�y)��U�Bˌ�����x�S�r��%��c�a�+sU�S�hAN.����{x4CX��mg��Xѷ:�wQ����������n����/��*�Yk?l �gXB_z�Co?ݕ+]��&�L_D�����W�{U��~ 㻧9,��#^q jta6�/������<�T 5E�\ �Gؑ�Y ��]`�O�4�/�%�"�� ����n'�q�S������4��}䥁-8Y��g�Q�th`�,����pP��3iJ)�����1]���H��Ʋ��Wgw_Q ȃ�Ǚ�۶|X:6`���q�E��M�M*��>��*h�(�)�^��\�2���uG�)�����Ӗ�����!�I���s��*hq�Bv9L���hb�X/���c�� �����\�J|`P��b� B}k��EnZQ:&�^��]�yp�ܘ��Tb�( �{�?�w��%�L�.I�k�J��y���#�</k=��櫊;�A�0�\�)d��u$�/�G�σ{\��a+��s��仃A��JΒ�����"U�����7�-��Ec2��D�r�^$p��k����f�y��p%*���9�j��Wq����;��N�� gKU������/����ܲ����nъ��p��D��52���f�Wdf����s/ܝ�檙���"s�~��wn��~!�^X����q6���������"��T�d�����>!L���d�6�ߴF69(~�\���r����t=a�i_7#�,r�(�n�8�m�Qɚ&�>�V�/�|���է��n �� ��7���y�q�$�y�W�q_7T< ͂������q|�pz!� �>YF���:?����Yϳ�y>&�V�Q�)����%Zy�t#g�p��l%������2�����mb���YK��>����PeuI�"P��yB(�BM�s�;#k$��%�i�H�K����h�C����z��d�k��E���U[���G�u@Y}EF���r��+"N��q50�MXCs����a^\^�;�yY����'5�U�����T7�N�ω] U ��!Bĉ���L��)��# ��#�����w� NЃ$yz ��O��o)�g��1�� ���4����{7�V�;�1��������J�wa�B�;D'B����mF����ım������5�h�.��*���s����/E����e���}�a��]$��>e�m:露���O� ��KА�� ">w�s?���0 ���{���R�`� ,V^��1��s4�Ț�>�]���M��}ƺ�d2_/����N�<���ڃp�y�2��o�� �b�gi?����j`��- <�3�f�,��ק2P�kf��,�F���;"l(jic~�8�M�2{.t=Г��j�Y%T�(��i����>i�h���?��b��v�Ɗ�ώ$��)���~�z9�rR(�c�ǥx��� `Yi�GgX-i �h�� N�u�ÒJ8��P�;�� D��Z.H �G*B����F��$��a�۔�� ���ɝ�H�df��5�v���r˭��'����n���±�J\�(�#��m.:������c;zm$���q�3�M������L�Z�ۼi��-�C�8�XYwA^��qHmȞ�.�M�;������v_�U�oA3�����+�����1�U�wC%4��XA>�sȕtn�%��p���3>"V��z��;we_%�s����1D��ZH��U@�WHQ�������g��������q��i}�@���& ZtY�۔j&� ,p�uG����ˏؾ�<J�i���]��!rk�������5�#����6��P돸Ě��BJ��5<5�d{ Oŏ��^2�|�ަn�W�%����R�-op���զ�@VX+�A���%MK��|��kO>ǘoO�m��\h��iN� b��W�S�����E��B���� P��zd�b\�,�D�����b��ӭ���H������^�c�y߂3 �(�r�5.���O34E�nb(5����}~O�j�lq�)Z����y��kܶ���#���ݞῘ��%_�������m&���P�z�A����[�d�r���#��k���ć�1��jr�Tֱʆ���3�.^���3��υ@"�P�E7�/۬M`=R6� ��K~̗X+���*�jO��.��7�ϫ��nHAYe��h+L}�n�h2/���f��R��fG�Y�j����E�2m�� Z��te_XOj�X^�����rc��k5�!�S�[�1Op�i1B�@��p���$,��ؒ] æ<D1b�����qV��d7rg$И\u�W����A|�7O���4j�a`�����zA&���kiAv�ߟ_e��ѝ�ܘ�I��j�����q��G��V��tO?a��%K9s������b&Sũ�=����]�W��J�
Static task
static1
Behavioral task
behavioral1
Sample
cebffbdd811f604d41fcc5fd805ac4cbfb92b1e2fdf9ca644de03d39b946ac84.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cebffbdd811f604d41fcc5fd805ac4cbfb92b1e2fdf9ca644de03d39b946ac84.exe
Resource
win10v2004-20231215-en
General
-
Target
6df3f2576aadf922fd460be1b646d866.bin
-
Size
2.5MB
-
MD5
7baf82666bf54dfa4a7b24a4eb29fb46
-
SHA1
8efb7f8aa3d1eebc37222d070256da03614ff4f5
-
SHA256
bbd18f7940022c3615b4770df3a30b9902e4b40f586ab200a6ba15cc0eb22a11
-
SHA512
b507b0f1c783ac00a4e43ceeae966aef495207d33d7b2121810194352ec458307996937e0809bf18769dce5d1e3d0bb81b92ea4b2855d48bc8e22153927ef747
-
SSDEEP
49152:OrNkH4AboDrvfjU+8nzSKHWTcC7AIzLdcEK+V+a6ymP2:YOH4/DrvfjUVrHDizhmq+ZyZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cebffbdd811f604d41fcc5fd805ac4cbfb92b1e2fdf9ca644de03d39b946ac84.exe
Files
-
6df3f2576aadf922fd460be1b646d866.bin.zip
Password: infected
-
cebffbdd811f604d41fcc5fd805ac4cbfb92b1e2fdf9ca644de03d39b946ac84.exe.exe windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 141KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE