��k9\�A,�m�T�#shvL���(P<�w|��*�Ke��Iۦ�TQ;�~pW���㴵t@� �b�V�v�O�aq��=��=~{�L�k\���P�N�s����I���d��׀�5f�dٮq������C��^#0��I^��w�XZS�{�I�q�nl�C�ج[��Fu'�D~4*-��Xp�M�G&�ug�4p��*6�0P+�)Xj(B�����!I̧�^9 �����==�f'St�Ƅ_݇..�u����l��U�>������gaS�p��@���r��ZE4���=�nI�nC^Ͱ���� �ȉ�_�bx�d�z��50��NB]�d���{m�z���3��c��|�WR?L�P�?�'�W4:/������v=�t�|tyu���ě���-4���l8K��0�N"5,�����mC�`�aHH7P�eZ~"�>�(����P��b�`�� ���� �_�Sm�����WmXb.Fig���a��l]'o�\U<������ -^w�H��C��MMʁӐ�ĭeQ�t?�d�&�ȬRd������*4x�ٗ>4r���Gl��s(�u����)����7�/t1�J�[?���.~�������^S�zx����gw�dWϱu�y`�F��ܸ�o]���¢�o���1�%%�Vl�z�7���<y��N���x[��J���s�_@V,#������-�r�w��DXD^�ݲ놬��b�����H�7��������h�|#���eJ��X�"{4l�O��"�k1�'�2Ĥ��* $��"�7�ׅ�vNl:"J�4���i#'e���yuJ���Q�m ��A{�����m�z��%�?�+�kX���%����E�Ԭ̄.� B�����Q����J��B��\����!3��gs�0�Wq5v)��G�A�VJ(���3���x�����ޟ�-��������V�3$c�v0D�a�9L3���*��k�� ~�Fb��%Z��y�Q�������lDr�\���[�2�G���.c`Z����g�M9���h�~1�|��Vs*���bv�Ջ���B[���n�wX,3ú�|F��y<�W����?H��fXK�(��}EW҅�����Nl�<a��q�'���4l�}B�/!��8t��vr��(_�fꞱ�]Gf��tn0@��e�Y9��y��²�g�g��8�D>�1�Km�d ��x�l�VID����R,��-E~�94��/%�� �ܹ�b^�W7]1`�F:�W&6��v�Q���6�r����'��:#^���btc� ��$��� &]����Zu�v��������i��G���:��Zc�G(�moK.?A~�r����|���(Rg;�-���H�IH&���ϲJ���M�� p(�i���$�Wb�[F���_�m���:��H$ު����/P;[+��� ���i^4u�z�r� h�\��CҤ�Ov%�-�AN��}h0%��O�)��Wr�^ 6< ltӵ����P�$*���ET��)��6{��}�� I��2w Nvh��˄����?㓦���1���sa(#��5e��d?{J�����g��%��x0}��mS>�L�D� ��+� �?{f�Z�%���}�l�|? �����{wS��HPk�B�a�_���.Wv���. t�X��dr�[ukZ�+�X�ߜ� ?�m��>�X��@1��d�Kɋ��]9w��c4|"V�����[2�[�<�NmV�`����gX���/'��P��ٝuc��u���W�<d��L�d) �7m20$�1�~�ր�g)�(�6Pj?�_���8�fN�%9R�,H ;�l�����+3����$��]�;�r���O������r�< ���� ���'p2_'zN�#٢G��� ��+�m�%70~b�=�����4�Q��O{��{R�o���%!ȼ�C��!5nAH<�֟ڋ�mS��t<y]/?zk�5���n��>�4bPŪ�|�u|�gӚ��Đ���"������.�Bpl �&U�>_�+!F;�+[�ђ(~��V� 7aQd�P Dq8�J�?d�ᨌ�Mҕ"�B�P���Oɞ=3NR9n�^ӵ�����-���L�������%u&��,���z��z�;p6�v�]��}�~��T��D�&3^����&��Y����xY-ۿ�գI�Z��\p��R�V���3M*�k�}&�ӎ��Ǖ6t���B��}نoE�~u��>f܋��'yN;ȹ�N`��9��^��sVE��o;t©��a���s����s{Q���k����c��y��z��d& 9�á�,�E'L����ɵ�ޤF�Ѯ(P ���ߝbGb��(��д#��`�B��]�LO�Ĭ�ʗ6� okj��M�< L�!NV�qbs���*���f9��b�xfl�4���F5�g�1g�f���+�Ϡ,�4H��[+�DB�o�T�1;��9�� |E:���P:\����-D������P˼F3���j���K������U�@��k�Z�q�4`��"D���]�vRߪ���h�ݗQ\>W�(ס��ǽ#-@ ���4N˸̢�)����T�t���ɻ˫z`�֡X����<���^L_é�ZF ٤�֞gYwo~j�� ���(���0^�S��$�5���K���)��H��7� dxR���0�j�f� �*.����F�t\�M~�5����`�����ۇ���2M|����xeO��#�l���\l�~L�b�BM%Qh�h_O��L��L�l���!��[ي�� �`&�K_O�/"���Sm#M}jgs@���Z�.7����� �&�L�Xr����9w��1j9jW;��N�Y�>�AX�Iց����3z�l������-�f�ă�}�w�ƿ(�p��x�2�K�1v*��b�g�� <��6��w��_<_��R�d�O]���=@^��6_�՚����Ck#��y��V���sm�����դ�a�)��6�!k�1?�Ϳ���Qد�M���.�v��^e��<,�pa�&5�c�� }��OE0�J�UM��w��-��K����VAW�����h�k��)W%�����%y@���ח�-���k��"k�=0��ݔ�ʭ2�o+�q��d��_{��c���wj�D(m��0���b���aL��#�L��Cժ����|,��>��11�V��5�M�,�Z�JiX~,��5[P��S�c���j��+&V )���'��:��*�l/����DD���T�h;Zgb�kV"C�g�O��!ޗj�3_��J5ף)�uL�d����~�3WЅ��`Ƶ<����n�+�ƕI��딯��,ě��Dr�*)���hA���m��=���P<h���.��)��M7x��`��!?�� ��f��=!J�$0��76��<#22�MJp7g�w�*��W��&(��9ժ-*��X���40x�Q��h� �O�"��v����O�~T�F�+�L���֫@�.�3-DL!���7�R�榹-����&&
Static task
static1
Behavioral task
behavioral1
Sample
bcbdc1f2b6953853bbd45654bfc87f8d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bcbdc1f2b6953853bbd45654bfc87f8d.exe
Resource
win10v2004-20240226-en
General
-
Target
bcbdc1f2b6953853bbd45654bfc87f8d
-
Size
3.5MB
-
MD5
bcbdc1f2b6953853bbd45654bfc87f8d
-
SHA1
8d06686d51f6d87d2a1124e893b8cc83385f9ce9
-
SHA256
e869c77335926fa2f3df2b8687fe23bb8bd5c655efa66239f22610d772a57151
-
SHA512
79d08eff0e0b4a6d0a9a730e2f185b6bb3bbfddcedf8b55ea34699a896905c0bc7656b44a9e3925fbc4dbda956e462350f1b2e78d0f50be1108d3f5f05d1b1bf
-
SSDEEP
49152:CQoM/lbj7O+MXcHzJ1O4BE/Ou3b6pwQtKH5LHMlIUIsgxyYKn/ouJX8qn3bZJ7LM:loMt99Fk4I3USslNO38/oYbXagW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcbdc1f2b6953853bbd45654bfc87f8d
Files
-
bcbdc1f2b6953853bbd45654bfc87f8d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 153KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.4MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE