�D�uf,}@�O��2|���"cQ�O|9���M�!���*�]W��/_5%d���$�V����06�e�2o�Mz� ví�@`(N���%K�#��LI��S��ʏ�n��~CWۨb��8mgMzE�;|�@���*�� j��G' �&d��^VjóP+p��WԻz�l[�hȧ��J]�$������w��Ik+3Z��qܟu^���@�vP)&�uaq���:�<��i+�T��ji9q.��J�]]�;�K�7��,�v��Т�i��+��!�4m}(z����@�l�6�Q�'� /��C��MW/nӇ?�r��r+S(�|_��,��~t`!d�ơ�%�zM~�����?��>��SH�+_�5q"3���V�~�6�ͺ�+��)A����S����`h��f��Qo���PK%�������]�o��F�'�aJ�5 � |�3w5��3�[F��0tY��MN�Fk���k�J���&���@��[��q����rљ%a���?0��)U�Y{"����]G7�7�И]߅�ۉ��}���_����n� ��yZG֓D~N���KS�,~\�1dM|e^ݎZ��_}X���Y��������G�l�0c>�o���$�0v§An&-��1<Б��\n��=]�@A�W�Ń��]��z;=��t<k[[ˀa�{^���vQ�Q��!�P3.��{N�}oԜ��3�yJ4��-���{-=;A|K�-�:�_-n��G�Ó�UQ�e�Q������9��R���=v�ҽ��'Ɍu�y���T�����d��b"Ln���,q�O_���Qʜ#��~�=`Ev��P�m��� ���t�W��z1nn�,�P���G��ad�����n$�N��-,��(ضN_0#���C ��*A��)�')=��tR�!|��j��=j)D3e��q��?��%��WH/`"`��Tf��MG��~nO�]��w�՜wB��8QOM������V��4��^��y�����6Tl&1�ށ$�ҸF��Mt����-�4,,�OD�g��={]��z��`�5F\zsPdN|��z*�->���\E�>���2�1h�±�ɳ�S �"��=��!�L���pOoѫ�b"�9 8!�<0�\_���N�F�:��L� ��X_ba��^����(�>>*��:I�06�����ƍJ��O�����-d3Ljl�>�{���`kw�j�e�8Fv�8C��� ����� @5J���?c��O灱|�lM�|�n�*��R�sa&υ������t���O&ɷ3]�����<IDf=U���s���(�qo�0⽔'6;�ڪh�T���J,��@�͕��mZFf���+!�hk�F4���`��$6�.���=%��& p�����Y�4�T(\f���N�J�����E�G�������v'{�\-������ I�Y�r�E��B&za<z�Z3�?Q �鼈�ٺb�{*f��i;Q�� �s}*J��Z�j�g>���`xs�_��&��ի��H뷉�I_z�z\���_`��=S�y���5�#=������/�I��U�0=�v��Q���`&aq����+%7B�$�P��3����Q��P�*9���avd��G /n$���2f��w�R�\~C��6�p�T������ҝ\^w�6�� ���Y#C W"��o�ZQ�}\et����n�V6��cn�/�f}Ĉ�����G9;1;A�o����ИI��c�A���P��Ґ���N���"+L�ݟ�b&�� ��8�ڳ� ��6|"+�X�T���Ԙ['R��A�5R��8*7�q�[���)�c��)����: v&s�g��b#$�W7Ϣ���\D�'!�� ����n=�s��ye���*�nR�fs���Mq��ʼ�l�ό �ii#! �R�M�Y`�HN[=gx���s-�:N��7���A_�� �t�Ӎ.i��hZ��bJV+�^+�F@�ٳ�.�Z��t�h�m�f=����e�)��s��}������oQ` �-?��'�I�0�vo.A�n`�0�C�!��o�X��`��8��A�<�ģmI(�t�*@M2�e�v��)��-�}�@��z��(��3uUo��Os2 >��YO�_����R�d#T���c��;SC��cȂ0!*�'��=M�ɾ�T��� �~^��KU<^�ú����H�{�6���J���N�� '�=�~�2���RkR~$���ZN�����SV�a��W���ߓ�K&�?cP�(u��[L�d�I��F����.^Q/�LP�cl�����@e�y6�;�����fy&P�R�"t��o�^V�Aa�g�A�yV���g�� 6UYsҀ�B�QK� qa�~O������vV�.��R�ar����ؓ��_k"f�,ZJ���l+m�jR~�ڭ�gE���r~L�1+���� э�y�C{!��S��_��_�c� UXˣ^����;$l�* 8!�ME��,B+D�q��j,���%���1醶�û��R���PBHN�X����[�N,@M#�Ps���G+0BP���2��/�խ5���x���1,<��������F�0����i9��'�j���ԷX�TA��7�7�e�cm��_�{������Ӂ峦�KѲ&���%%jOһ`̹u3T6C�Ak.�NC���� � e�ǣ��}ǂ�ba��ɀWm�keLR��ݘ� ���U�c�d�k-�����US1X��;��@���H/F����a�sM���X�+�E�%��.�z��+`�M�P���VpU� vL��z��ЁӁ������W�i��8?^�,�҉Y�|�-�L�9���[5ډf��d�GMM��N�|A[�g�.p<L�X'� ��N���#���~�f!����g��Jh"�q�<1���dV3e?Y��N��im��Lk��|ai����"�㯨!�5[,�YC�^��*&��0?��%F�ۯ�w��#C�W��]�vRj��"��R��@/���Q������2�%;^�ġf��� �٧�xw�g_�ٗ�e'H�}F'���'&}-��Sw2�yRH ���N�z�և<Qk<]4h0[_�Et�qx�=� ���c�F�� �L�V1S���ʙ7�$A�s�bF+��������r�G[�ls��B6�-*.*�����Mj'/'����F�c�,�O�9����?]�2V�Z���-�H���2���wu'z!؛�I�xs�1��Q�H4�5a�f���T�浱�QX�96Ju*H&Ҷs�[�nV2f)RP�[���������f��oهY�lX������%��y6�@�����k���W¤t�h?��>������#��k�7������
Static task
static1
Behavioral task
behavioral1
Sample
bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44.exe
Resource
win10v2004-20240226-en
General
-
Target
bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44
-
Size
3.1MB
-
MD5
84e1a04bd49c53d39989d89feb8b76c0
-
SHA1
c71680d9dfb4b444c0f9106ef4e746e21ba8060c
-
SHA256
bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44
-
SHA512
70b021c06a840236ef6ce0a628a2e49fd123d92d2ebaadc679ea4392aa9eebdd54b54439b6d28edfd90d8cddd115c2d693d12ff070654f9c291d4b0bc9ebcace
-
SSDEEP
98304:6USoAi1qvstEpBLGLqK3+D6utMc4s77GBfWOZS:1SoAi1qiEGZ3+2utMN2GBfWj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44
Files
-
bf050f137e9d6eb36f4dd552d470ed82bfd170ab863a1750407f6920bde16e44.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE