,Ks�1���hE�$�TH �E|h់���FX����X�J��>���W� �) @A�,�ͣ��� �@�U1v���=�e��������v�JPа}翖�Ƈ�G�o���=p>Cų�3_�`�CE}l�B����@^%�)W={=���D��)-a�����h��f��˻9c!�xyS�g¸���Fi���)n2��`�U9*�2�bl?�dy#�������:p�,���ݽCM���Z��\�����a���s�L_���\�����w�����:�����y[���p���|���<Z�TKz��b��ù�4�/Đm���I���K�y�Qöo{$�p�qiZ��\�'�� 1�0*�d2�,�Nh��8Sl�X"\� �֘0`q��������Gk�)�]At��y��~�뫳��F��(�g���e���<W���P�b�=M�WYzd2�/Q(L};��*y؟DNa+��\q� ?���z��r��A�e�&�z�}����`�L����]�w�����T���3�PX7��������3u?d���)`D�nk]�ũf��"CA@�hNL���#��/5�5"j���-|��Dd����tl�Q\ b�Y��iX����ۏ3R�|�exM�k�'H!�|+(K�(K�5�őX��5��i�i�˽�/��W���LN\�p*���!���D]��G��̉�藱r��a&���є��'�S���x�e=�����oؗI��g?a> ��.=��#춨��j��" F_��2q�M�4��YcP�_�����-+��9�g 1��_����J�(�h�������{�t�9����mj����&��P����i +�Ho[���r0 ]��v�#R?�x!�w�<��Y��wzu`�w�_������l�4��c��D�AG)�V~��쏠>j�sy�<�Q>���qW0�_���`cۖI\gu<"��;��8X���Ƙ4����g�G���z�C������`�P��,TVE$Og/�E�'��wi�"���u07 W��j�"�?�C9bx&)�py� P]9y��B�/$F���b̉{�^p����}�(��vJge�ŏ���J���'E��:��~q�����y�a�aC�����w�G��D�)Y9�-�=`96���R�� ������P4��V�������Y+�Åក@�8W�j�xN����M��ڍ.� �^_C!�9���jc�+���*���yGR ��-%p��&JϜIL�4D�+a]����;ޛK�Viݺv}hh������ ��S�?S�������<��D=��ˤ>�j1=ib�FÚ": ��`_݈)"��N���,�+YP[D��!����uR�KЀ��]��U��j`i��� �� �`K^�cZ[�3R�隞j���1���76�:O����#to���i�.`g�a?FL,-���5Z���I��a�л��Z�d��Ո�#[K��gY*o _�'����������������=W�k�&�'k�`���W��ٝ���!m�P�;r������"�T���3+%Sol������NA���+a@j�\l������49�hԷS>���bf� �Wp�� ���]�_Ҿɢ��"IB�%O�T�@�{�ԣ�J��'|;o��� �{���QęY�M����c�̔ǩ�@�m�wL�k>[����I'��C)�B��z: �[jf���LC��$u+���_�x�Ac6}r�= �����0��(���zM�-!%1��6�%�1 Gu�8�ʼ�q�������p� ��O��o������d$�0G��Om?^KZ�J��q3�P��A-�/�6Nx�D�z�Uf��耒D�-���)4��,gk�0����U����C&��(�P�]�ft(�����k~�ǻ�����e��N"�Ʉ���>#���T/����$���|�RS�J���K:f�-pVcԉׇ��\>3�3��z��&�栀2���s$��������������B�a�5e��`�)]&�]B�W]6�&G��b�W���r����)�~�#���T�k���@�F���f��t�\.z�rG�*���K���9��֕����ݸ%�j˾��˼g!�+{��Yl,*�[ׂ�2��O� Ե�]A�m�������}H�Azz'CRl���cƸ͝�����j����9�����駉��}3�Tw*r�j� /ϑxN;���}CF��n�[�w!�F�6�C6 ��m���EYᠯXl��N���_���<�C�"7%�]0�f�� 4�Zo�sB��D�d�+Ҡ�M�~ ���M����=�=�G�x�k�S>!�~v3o���NJr�-Ć����l_p�)S��V̟vxC���"R>�����o�ڤr�aN�и�LB���c���fx����5im�R�.:W�a�2�=�QJ���jH$�����;���G�� S�$�dyT6�P��w�Z5d�g����r��ȻOw���G+�ث�+%:�ƚ 1��68w��������)4�p3D�a}���(��.$ʺ�~�mp%5g"B��ծOb47�i�t&r0v�f5L��.5��K�9O�Y�A�-bGQ� �+��u��pvţ�@�|�<�H��T%��i���-l+ʫ���֗tx�f������#�?#�2mr����t�,�J,���>r�i��P��*��4��y�/��m_�� d�FG%�Ah���f����W*���T���,���#�Θ*�B)��d�}quy\<�q��Uxg_1qA�c� $ ����bn��� >���Ǒ,��6))eeK(���ƪZכ�^FMe%L�c�2|H�KgJ�j�[���bw���J�L+T��<<�z/�b�0�6�����;ǣ�mҶQ��w>�@4�jj�>i[O|�v���dg��^�8qAg��1��go<-�߄,���!b�u��s8��[�VX���1Tb!��\vYҞuW��WS�,_u��Mհ�kp��T%��eBM��V�;T��|��ٮ`b�m��k�c�T��+-:����+%�SHp�"�,�Q��K�������B�E?V{%`��2?� G�q
Static task
static1
Behavioral task
behavioral1
Sample
CUBAN_PANEL.vmp (1).exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CUBAN_PANEL.vmp (1).exe
Resource
win10v2004-20231222-en
General
-
Target
CUBAN_PANEL.vmp (1).exe
-
Size
10.0MB
-
MD5
52de12701b769d9c571f7817bb29c9a1
-
SHA1
70f55d9600c62c7d1aecba36d733249b04e8fecb
-
SHA256
d09babdbb1ad5fed6bf71535cf22706ab832546d38e087691a985ed780b1fe5a
-
SHA512
58687813f56f9717d9c5fca89b333e01b3026d9ad13ef718f77c39bb51293e09a4946de18e844921914d110c139ea986d222c5d03042c4f4bd8acc81dd2d3dbb
-
SSDEEP
196608:4b6qx7yOz0rs7R/LZSr4mJvbztKdBs1FFJFfErw6QJlKgRG3bz:4jQfr2Ub0ByK0ZJllG3n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CUBAN_PANEL.vmp (1).exe
Files
-
CUBAN_PANEL.vmp (1).exe.exe windows:6 windows x64 arch:x64
1f5dd4790d2b533505ba51ab4de28c95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
VirtualFreeEx
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
shell32
ShellExecuteA
ole32
CoCreateInstance
msvcp140
_Mtx_destroy_in_situ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
ioctlsocket
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
NtRaiseHardError
shlwapi
PathFileExistsA
urlmon
URLDownloadToFileA
winmm
sndPlaySoundA
userenv
UnloadUserProfile
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertGetNameStringA
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_msize
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cuban0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
cuban1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ