��ʌK�!DS��$�����&B�G�!�=�i����|S�"k9���w�Y��ZO������] �Dq��zx.j)����h6K|ЕX�����A��7�5"N2uI- 8!%�� 4�{a7���N��ip���� u�S�����~%`�aE؉}� l[/�[��+��)���{���u����Ʊv+��,��m_��)����� 9�x����*+x[���aR)��Ĭ������}�L��Q��7|��K�@Z�+�B�s�R#y����7�y���!����.-<x r܇�/f����p�ؠڼJ����^,r��v#4iJ��A.ʼnݐ�Q�SQ�u{Hn h��! ����$��nn'�����N�1.B�,J]*��aJ���Y@�O������S9��ך� ��.% �Ӧ�@� ^�HM5���9gh@����'ᛠu/e$���Jx��8�i0�o*������?P���kM�����vÌk��w���<t�1�%b��V�BY`A�3�q#{�)����D�y�p��n��O%z|��a���m��chR �s�����H�_�.P�ލ�Q���6_�sb(��d+�f��X�+I��B�{q�l5%�Z������g |�N9����T��A3u���:���5�G�Z�xT3V�����������e����]�T���H������Aȭ�j�4��"hu՞��5�#�.ϳp}K���4֞��q?�w���>H5"��{��"QIt,��A!��O����G���JT ��_�yW�� ���!b��ܦ7ߢ�Q��_P�6p���x˽�(�O�X�a��5�AŘ�XV�un�_����*0"�['��l��b���B!��A2�b�ȗ?!D���4�9������.�����χR�}u�Y���}e�t&��L�-X֪���g)�a��-^��L�t� k9�U�,X��.`�ř��~��v��f9�3#����PH=�գ��<���MF��Z��B&N��[,3��E�w���T��ݾ^\y�R2Jc�_�q��Hɇ�o�ͮ��#I�nh|�9s9�<�35֩���/�����NA� ���6������3�&A�ú���ֵ�u��D���S���q����L���E8Q�6SaJى��[Y���Հ��n{MP���Q ���5tyt�����+g�?�.��8I-�4��T��kއ:��4����>U�a�q��|Y��|cPHt5kg�vMW�?�f�終M�W�z����O�Gb�B�je �� �p �U��a�ߥOmm�o��f���$3�&��0<�a��0�f���c������WwϡS��d�㔣�!!6�,z�1�j'���9�=K��x�.��w��J� Uڥ�4�Jc����f�-�X�qs��� /���w격x�P�re�+V�씑���D�!���y���s�~Þ\)�#P�� �e���C&��b�����Z���4�AKG�Dl#�[~�l'֜2֭-��i�q� �������dz���#��*=O�̬�w\6'-1�Ϣ����f��'h�z���mj�ۖ�7;���7�����/�>��v���QR�f�o��h��~��*b���3p��o^�e���L�3�N̿�^���:�3���V�,y�o�^�t��D��7W��{OV��T�-Gh��y ���3��y���(� K˜�b0�JVVD�]�"�&W}Y������NZ1ʨ�O]s��S���k�j@�6�(K2D�kg����=��$�'��-�4�N*�t�� �LK �Ge���T�7�'J��S���R�9����MO���hQ{��~#IB�ג�8�MQ����dG*dLV����!mC-�6M������e���g u��{��L�f\)��-D�'���U�ٟ�s3��kOA���g�X;s��[�bK���h ���=�7_O��Z�@h�-}���6��"&L��;�V!6�p#���,�T ��18�郪z'CN��%>N��.]"�kl�f7JE��q��� ���˭���tcp��_�b>�5�:/f�|\Qv�jj�� >��}�k@��@�q<@7��ķT�U#�Ta��%�)�A�#��������8�,����J]A�A�ԟ �ᵹ���z��\�� #�7o����C�=���s��ƍ��sQ8�(��Lw�O]'����V�!~����������Cb�>�-UV ڝ���<�������so��_f���[#i����Y"p�%x�n�\|�Lڟ�g���ٞ��+'��[�#A�S-י *b6���qc1��lМ;����z̷���J��m=\A$�~|=Y��?4�M�ZSh��pw��;�n�����o���Xh�c�������"��gGsCK�fI�"`����M��9U��u~��K@�A��*�N�-���ot�q�����T?��8ɣ��;��#��{:����*��B��{;,�@d���5�꾻�)eD�$�8Z��w���|�����?UL����F��p�r��%����1��z"���Ú����# ��]����w�v��Z����29���&f��-�� �u���j�4Ӣi��p���~u9���x�a�/�|�k`�4$�m�s��� {nw����V���ȧ8����ǹ0�v=,�~�&ȭ�����|����XRjt��)�\�G���X㞍�EJ��#~�X�lD���M��!y/8����\S��۠Z@n `�5�>������j%fJgg�/��3L��0(No:TX�D���D�S�\Q�La�8WJ��>�6%�� ��fއh�Vݼ��tè��qv�`\��[ǩ+Q 5� g�SU0 �<��a���3�p�qK��.EF�{������O}�[8CN5����t���ߴS�A۟!I�ɎR��r��3<;nq!��}��=����W�dתc8W<h���yyB�R���q��!�� ���L^>��_10�3��9�xxc��4;�O�4�/�5v�{3�����R��0;�����j��2<��L#�a����iSI�.T��B��A__��h�LU�I� �\���M���
Static task
static1
Behavioral task
behavioral1
Sample
Cloudbox Pro.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cloudbox Pro.exe
Resource
win10v2004-20240226-en
General
-
Target
0abf5f18488db79b4531a3d86086f2b790e8cc627f0c2d0bdfcbf32451d1e3cf
-
Size
10.6MB
-
MD5
dba16618dc87e3831822c8af36117d68
-
SHA1
3553189802a3423267a762042f66739e53f7d6b3
-
SHA256
0abf5f18488db79b4531a3d86086f2b790e8cc627f0c2d0bdfcbf32451d1e3cf
-
SHA512
8a44ce8584adb49d1acf8e28ad82af1531ddf8b0c7b686766596da01d959e643ddbd8fca9471a12f6256c6541cf76cdf392077d4e1d942a294081791ce03cabb
-
SSDEEP
196608:g1zW2nUgQLBAMkJS/z/vDW8x/xoSVNpGe8OPrmGf2Uk1K0xXZXS:IzW2nPQtA9JSzp9+WpGL4rmGf2UD2XZi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cloudbox Pro.exe
Files
-
0abf5f18488db79b4531a3d86086f2b790e8cc627f0c2d0bdfcbf32451d1e3cf.zip
-
Cloudbox Pro.exe.exe windows:6 windows x86 arch:x86
d777e2048abfec2e11279f98f88a402d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
WSAAsyncSelect
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SystemParametersInfoA
CharUpperBuffW
gdi32
GetViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Hsp Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>|d Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5j{ Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ