}�a�9%���l���oI�^�0�˙�MXȰ�ѷ���}e)��"b�!��x���g�i��Q�2<�w]��[;�7�m������@U"�k�X���N��b>�V�f W�s��� ^���[�����F*MC�{eQF�}���w-�y�I��4���@ոJ���[Ô���FK1Ya�Z����N}R���*�l����B��yr�Q��ȃ�¼�ޮ��k.�)�ʁI�M,�3���]�h9.K�����e��� �(!Nry���=�C��i �&ۨ�Z�{�hsc����XE^ɋ, Ca����ʠ�bM�m�K�;l|sj��� Z*�a�B"�����A�)�����&c(ed��0 �hruj����gd����N�J�gS��k2!\7j~UD����f�>�A�`$������Q7z���2��aXO %�6�^�T��G~�3�I�??+��D���*|��a�|����0f�lo� ��%��0Y����a~,�a��D�)�#\���*�=^Ў�ɥ�H�5*0;�X���m�Ba$>9f��d�cYD2ҷ+�������iԩ��>O������z/#�p����k<1羉2��Q9���A-]��|�F[^5�:O��k(,���������B�(d��C������T�4_����C�u��~|vX����R�ߤ�5��+�� ��$���&���N�YOvz��ي>|0A�0���8�P�L)K��~��Q�� a�[��|K�RJKn��*� (��c�8o�M��ǚq�LK.d ���1�y+��E|��"����d�1\�h�f�ˤs�B��p�w� I�x��}����z5w�����~c�M�C�sHM������\���Dn�G����D�Ha�v�}i�-%@\��sR�к��ɡ��_lzY0�!�鞩f�߲�d�|��G���_v� �I�}�0� pJ�����)���#4��Au%.������3h��#���?�T���2����5#���3�u],և_��Tx� �ʘ��t�b�@E��p�[$B��cf��Ӎr�弛SA���2��U%i ��a�p;n��tSsX%EM���V>hʨ� Bwo�ta�����èI�ԙ&2�/I�����тZ�^��+�0`�r���{?���n&?�����UaVDE�$uS���EG��F�[�qך&���7�[��V�[Z2�Jڂ[/bvz�z���jy�A���d�W��Q̹Eefp��=�oCO��h�a�F��,� ������u���]��\� �Н���jcB�7@�>�[��Ԓ��d#���|����%��I�+��A�����X�J]�щ>�*���ۼ�noDȕA�1v�y���)s�X�g~eU��n%H������!FX6`.uka����֗�>���g2]���.�:�q�!����D�\�D>��&�G[: ���ۼ�%�Z����Ӄ�i�$D ��y��w,�z݅X�b>�����$��bB�ݽ^m�? �>>t<�I�>��Cof&#a����W��c}7Uֺ�{���X�F��Ql¦�3���{�N��ii)w��1�p� .�]�_�:aus<m�8�� ��ىՑ~��� ������T.��C���9���K�D�a�<?s)$4�7&���ׅ�.Ο���My��4�Ʀ�)t�V��PAXԛ.q��dg�v�ݚ�w�l��]Z����+���Z�s�f$��t��(�'����D�qU�^߆!��jR_��r�Q�x�)^�VW5Cy5����װ="_�-d����Ζ�l�Azyp���M>���WJ���;I����bP�a�Z�H�����9��c� �T��cm�m�����W�qZU����A�&�yGRf\��#I��|� �����L�.������>?d�74��l|�G]cf���V�u�#����Z��6�J�p�9��SJ��\�����k�ɜ���,���1Y�+4G�&�q�aF�Tk�������aQA�W���c6)\�oWf��+�2�I���Ze���ż�W��t��*��*����sV��> �X�T��b�]�͇��g��}�d��.���i���N,�=��,KέE�����_5/P�*�+uA����G���\�+3:�����=jL=H3u �����shI���XI#!������Bs���:��~�u x�p�o�}��H��!��'�w2��t��e˸�M����H�`�� +�^���_1��_aaC� ��P�_d!^��{f�������<�1�"W�����F�b0E8�ݘ=(�?=V��ߘ"0 V����c���2j�G�S���D�y�pU-چ���pj��N�(�S �>x�P+�&sh��O����nUG��C�g�Cz,�76��2t�e�w=L�����LzG�6hz���\�qzߜ��2^���(r�6{����C/�U�ER�5 ���o���iO�;{��!u+�a=�p�ga'���^��-�z��HS��_�fW�p�%rr֩�a�!��� 3%���(c�ɫg��:�Ҏve�8r�pF���E';��X�^fOR�'�;y�E�9��v\��M�������ʯ+�L�-L���6c����t���E��`�mc�b�8�n1�X�湠�2���2��B�:ʺG�m���0ߝٟ�ٯ������o��)M\ � E�N�3���,WqR�ܴ �k|o�H_�r���b|�����o���l֦J^�1�V�w���N%5���f��⦥b�e<sC�%�t��_:9O�)m"'��U�Q�{��V"�P���D�t��;���ݾ���t34������3�3~��) ��w���|���4Q7TP�!'+i�^*"F�t�h�����3��@G6:?u!�nd�+ �h��������� }��D�)��_���tw�w"���B���\��߽�ol;���,��L�$�ħd�i�Slǽ�x��Q��f���B* =�E'�䶿�����z���+��4���� Si�]lQ�������"��[HQ�zfuՁ�(�����>ɩG�@E|��{ͺ@`��w�*+@7��I�<�}����ɸW�c��冘U $;բ��!�:�4�[wF'R�_��|8L)�������9��9�� ;�2��{y��'��hŀ'����4NB��-9e&(��T�0]��Z����O�삳W|Q}(�=����`NX�)F|n6�\�"���`�x�' *I�N��q�������4���Ƌ�Y��!���Ґs��)Z�f�]��]�f�g���0�K�Ϙv��'#�|S��IK2������`�弽�3AN���y���xU��� ֶ��ʝ�w���ĵQKYP���t�B:?�&�5 ���`�UCӻ(�&�Fȇw�B%��t���Dl'lR��\ޅ2g�{�` |�H���|� Q,����~��'jpt>��O_={Չ����4�)k��|� ���uє�uE��\�����2!+ �M�1��&�+1-�d��)�y2����&r��9h4���) s�ё���-eV��v�ľ4�Zk�Uc������i�fn��~y[�W����J��^�r�ٝ�_���wU�L�n�~
Static task
static1
Behavioral task
behavioral1
Sample
cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045.exe
Resource
win10v2004-20240226-en
General
-
Target
cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045
-
Size
2.6MB
-
MD5
d0420264eb83b0790776b43fe1d82eca
-
SHA1
c56bdd99ec03b320608e04b9084ab1f5f7c91158
-
SHA256
cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045
-
SHA512
fef9971aa4f35cd2cc09ba73b0a0f8f6c07564bde0c09982c3b3f67ea488ce83dff009691227cebe7eff3e1db7c801b73238a873f0da6c5d2cd761a9a200295c
-
SSDEEP
49152:5D1K/nTAu+3S6ayDFKQCOCgEXHFt03aOyaV36jSBMJHDZSPl8uGzaCD1tpI:TKfTcHxCOCgIlG39V3XBMJdk9Gza8a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045
Files
-
cbf6263d9e6afff592bbd030e1ab7028d557fd6e87a8753f15031f459093d045.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 44KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 236KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE