3��٩;�����Q��Ω-�&���E%��?v�h�ǯUvAȎ@0�4XC�.ٽV9�N�l E�쭿�dm�§n�Z�ie\� .q�=���e~��k 2�kp��?f-�\N�4�kdz�U�������p�����ۖ ��Izi����>|p��V�ơ��m"��&O\r���4�8K�m�����`�%��SP�Q��R�B5]��PJ ��d����Ҥ5 `,�v��H �xSd��1O2��Q������wec�-w��k?��뙂W[����������m����L���P�5������|wd�̫Qa��;�M��ܵ_|7��%����Lm~�`y_��KK��\%�W��;��[2���ݎ�Jc���;> ��(]=���<eI�L�E,�N�E��PU�z����^o/)%���?�V O��DA�c~+Ibn{�E�����{����t��9�$�0� �T��xXX�����dЉB;EeOTGt߀�˭����d<N�üJ.1��X���,����պb'���p�I�r\+ �`yz��w��~�[="��!zG��Y��p�QJ��0�{�̷������TB��Ts��&�×�G�_�=�B��Mm?�l�Z�������`ac.�/���M��[�?w�/�A�M�v)���"��NӥC�vj]/b��v�/P0� R�A����e3yȒ�fnSԩ�x�:P_i�^D�� ��d�sh�ꈽ��Ws��9Qt ��V0���Z9Y}��YR���;8�fCP$~�T5ɸ���E�m�m� �����^���a�����d�S�\ͨ��tON�^儅��(a�������O�:�n��(�B�(T���_I+��f/r��`�U��,�>4��u����n뛚a�Y���{G�u�( ��0�*K�f `Ie���"�Fj�3~0���z�7�&Z}����g���x�띬���4hu�z&��iV��^�����n�G�����S�|*�2z�m��$����T��;դ&+3��ѡ�T�h��|.'�f�4���y���PG(9��\��4.j�s�E�\� |�^~I�HиZ���iʅ6vG��1�+7�����"����)~���o45I���Xc�/��B9�<��=�n*�Jbq5=���;{ ����,��J� y=����@8��ل��Ã�5�y�):i64�8n7����0)Ŭԛ ��4�G��+}S�=��0�3!kk�X{�N�PpTg8�>�i�˼�\�1ߘ�V�=�eu'�� "� ���#� ����:���߅������qs�p�ύt K�s�H��â���Bk&I��+�U?Tɭ�b�@��r%�t4�C�����;��[�����E��q�;����&�<fӜ��+{�uM���GG���#6-mQ�fi����O_����x��cai@��� �m�ƙ����e�વ/��Vq���T_�~�0�J|i�ތN����/����HT�f�*��xEx�� ��\.����½��+��v����]]��Wر)?(�����������# �:"q��Gჿ��r�)'dj.]�7���$��f&��T�r��g�(�t���y�� s;M�y��J���� x��}.��,ͳ`�7:qw5��3H��:�ή�7�9&"{S��Ŏ�~�q4�4��{�G��̋�U!�A�g�,q��e|�Lf>�IX��>�B���q�'�H6a��=�Du��e��ȯL/���Xn������WoM~� 6�����"�M���#��Tb���S�Qd���r4�\�{��t�YB>��u�3o �n��D�1���d>��"�6���{o�w��g�'���u���z��4����S�?ĬZଜ��{�䋪#�g��� #�N����`�*�X�pU��j��yV@�z��1�%Tz��a2�;ݛ:���5 R4��G� ����V�v�o�����3������W��B���o}����}Txy�a�9-y?�_�>��a���Թ��x}x�z���vN�6D9���y��WZ<�[ (��[��a�Jb/� Ky.������B,Y�.��R�s�U�f^�S�W��Ͽ��kɇ�v�^���g�6��$:���m�G03���')��íj��s�9PQ��Ns�kŀ:� ��E��sf�f��h��͵%=�x���%TYM�/0���EJ����y,w r��x��o�M]��`pӔc�j��D��&Tqh���ޱ��J̖�i���(�̠��x��u�E�/~a;�3���N㬏#c3���)������-r���-~f��S��z��e�`[�\�2r�����(�XK;*Cx�g�-���ke���r�O��cΡ��H�~�X\�)�$�RX��N�cy:{p6�n~�p������� ��ýo�f���Է<Ob�g�e<}}� �xZFӺ �AB��:=|n���\�H)R�X͓��o;��g,�FS� �w�*<�)��2i�]#�SO����{��\���3 �����\|����"�V�4�9�&c>��%9J48$���*�vn�K�xI@% y6&�#���<�%eB�Y Vs3���v��>�x�Hd���J�z�F�Q�9�&nS&��qƑ_��<NU����Uk5֫��x��a�*����D<��|��_��O==�����B�c���^��7�D�&�9C߄���-z�9C�� (���J�"��nC�e����R;��n�t��}�,��S�B�}�M3�>G���E�L�2=鴼ӣa���=ZE� d� *� ����� ��u���Fr\��d�)"��"� ͳn��ly����F{� 3����Ϗ�ˑ�����j�����x�xc �EG�|%ݹ���j�!x�a���6��2*�������Lo�����5�iͷ'# _GG1{�+y7�C���X}�٘��d��z��\|������ �Hzh��i%8IU����=���}毈�j�u���"O��]�3&�l|PI�ѯY�gx��]�n�A���ހQ�����^���=^ ���9xG%��|��RB��Fa��]��Z_p�I�[A�-u��\���L��_ҷ��^�B�p������i���H���L��o���U��xVx��$�����x'��]�����X1�wD:o�8�T�c����3},w �J�j�L>�����o�nzM�h���"2ث����C�c��}-@�"#�O�'G���!�Kά��L�$=�uY�o�%O��� q+��������|r� ��"��z��!/@|Os���PM������\�;�K���o�XA �X�vN=S�`0{�46������������y�'� <`���՚ߜY������*������#_d ��`�&b' ��0 F���&���� �BMh�I�+��� �M!O�I��]�2/������� �F����Pl�����X��>c��tLmZ#�'.2r{���
Static task
static1
Behavioral task
behavioral1
Sample
cf8cd7c08f5ce0df5f1100eaee9fc6e341e5aceca2cc464a5a08e9b9ebeb4bd3.exe
Resource
win7-20240221-en
General
-
Target
cf8cd7c08f5ce0df5f1100eaee9fc6e341e5aceca2cc464a5a08e9b9ebeb4bd3
-
Size
2.9MB
-
MD5
cb333befe8aafeedb9ca93d3bf07e617
-
SHA1
db5bcaf8c784f2bfe73e7ab6d6c62de4940fd65c
-
SHA256
cf8cd7c08f5ce0df5f1100eaee9fc6e341e5aceca2cc464a5a08e9b9ebeb4bd3
-
SHA512
4dd436a270e8dea937218f1e993e1b7109afba275e89e5d0740da00d4f9022542a7941509bd2d0e9c50f39b557eccb68f281959090861ab7deee0f259a7c2115
-
SSDEEP
49152:Q5UodHAudDsR9FUoYW32fj+Ib4uMBQPwzBdN4+HMLukYHjy6qNpdk/T8weofH7:Q5FdHBDs1CDCVhV4+HMyvHHq3yfH7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf8cd7c08f5ce0df5f1100eaee9fc6e341e5aceca2cc464a5a08e9b9ebeb4bd3
Files
-
cf8cd7c08f5ce0df5f1100eaee9fc6e341e5aceca2cc464a5a08e9b9ebeb4bd3.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 461KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 72KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE