��g̝����зN��^RXM��F���iMp�Dj�qA{�ۚ�}�x�C���ۘ>��h.-��X�և*�-ط2r��d���HR�f!�����p*V�G�E�R-�-8�����l� ����\��d\�W�.�< W�?�%��[Ɨ~�Al&#P�_摐��U�D�D��yU`/�H(ވ謇�����бf�=(u��fyF��є#-�ɬO�_��Nou�TK`�����@ &5��0�}���,�(ޤ�P�&Ek��m^ ���htl�E�k�u,�륔b�9>�qk������X�S`�c�Ȩ�J���/��R|�F�ޗ�+�9(�v��z�3v#6���.�������I�>O����#_�Vz�l up���c�7�RQ!��^�r�Sޝpmg����`�с�|�H�5�Ȑ�N�hG��y�o��e���,�[�@%<Y��1ȵ��k��ZwS�#�������4k�I�{>S��J-S�+�=[Ή�xNQ/�}��+>���ع������*�F�"E�V���n����S�2�6?>o��[j���C��~,bx�Y�؞q� �m#�.��j{��t�� ����k��S��LM8�l�e�X�?�Z�.����0�O5�����?��6P*]��G�� &�ķ�}?c�z߭�״��u!��- �*?�]���cL-�����N'Q&�������jd�HѰ�=����"�_�z���U�c����q��4�w�Yl���]���k2�B�!���-,��ט%>�yW����ug!�p�KAS�(`S�WI���Zx������� ��nH0X�ι9�� �P����10u���9�:�H[q�܆W�B���T�Z��r[(�H��E�3�-���d7Y�)Z�%W�!�O�jwvIJq?���k��'���~gD�9��9/g]�W��G�i������� 8ޭ�9�$ ,�Z���T$Q����ጸ�����/�:\��V�؏�al�ݸӓ�4@��\� ��7�BM�����f�%K��V��<�'�ԅ6��A���u��)��+XC����)�i���Sq�^�[[��sC��J��ݲ��ZK�X$z8����x]\���6$��=N�b�D�;"?'=3��^�i���)��?by ��� pmBv����a�d��~yT螺��}ڑ�%�;�qE�rz�{��D���;� �+ ��9e��IM���㈛�? Bf�I��ܔ���'�W�QZ�WM���X~�l��!�"{�&A1`d����0��̐h���2Y�j��P/���+y ZHf��櫼.o���_� ����"y�P��G� ��'0w��o '3����X���!y�)Tѫ�PT���+�p�N1����4f�;=R*�|#`}#!��t B��o�����a5� ��v"���S���/��9ckz���G+�ȩi �4˼`���Ȟ�L8~��3u�-^X�*hS�7��H�J/�Ԃ�+/��Wl��i�"z����P�KdI��S�t�'c*&�=̥,�`�Mp���gB��*o?�5�|+?ɥ�f�U�������H\��W<*C��\^���p�Q'2��n`�b�Q�t���}j`���k3��Cr: |Q���?D��v,��5���<^B.������i�e:wN�> �^dա� w����SD�����C�'4T�8)ue����5�Y�U��5פ��_��j��$@��ؼ� �0���U���4���h���4�X�UB� s��^/0*ziktz�1f�*����\��aUa���Ki��i]= ��8��i��[�ˈ�����}���^����$G���r4���g��k�-�_�Γ%�ciip�������p/�k�?P�o_QC%��-?͗����TbA�:/H�(�����#��H>g;��P=J�0&����ae�� ���:�r�b\9$�+A�G�Y����k�vO�70��Q�ƶ*]���ڽ�qE��I�AA���g�[��D��ƒsѕ��J��UۿF��h��JM��t4��kPw�p�c[�U��KQ�\£:01$�ГD�65�)+ݗ�g��[�jr�<`Tv�m!�fm)��vN�!��雎�X��6rΪ���e;��>{�W�6�n��������=1z�D awh �6����= +0�ް+]��GT0v�qw� Y"�C���C��V�����N���O��q���fz�K眉�m�#W�:�T����2+�����|��!�q�'18�3YR��C7�4������{��Z�8f�̀l�翇�s����L���A�/��0A<f�=�q��GR��1�N6��q��ݧ�W]Kt�@���T{��*đ�v��)�PO��X�ޅ�0��4'om�9��x":��a>�A)�H�,8�L�+-��֛ q�M~�Un"���ָkxL��v�ϕ�S��Nµ�o�3؝������[+�#��w��TB��G�'$gw���T�#�b��]�3:v?Ɨ� ��yD��B����"�����=F�����#�oM2���0Tv���8J�)4k �f�$���|�1&�����(���Zȅ�Sap����=���A��쑦�&�� S]�RT2�J�z-�6ψbϺ p�"y���q��`V��n������r5�����m,֕�A����Ƥ��t��q���9Tq�z>n�G ��F"��I�YV"n �+b�[E��4휦�K�˻wMt�)���M���s�"�X��p�bZL&��0�:u�S�PǠ�ao������ V�6ф>�e(n>�7�@̙�ћ��m�j~Wb��G��i���c<�u�C��RK��a>�U����PIԥ�&�P��1�j ���z�at#���!��b�b g�y�|q�8Ňhlh��/��4��Xr��.�)���_��$�t�LCpGC�g�gY�-� )k��D^���� ����X�����~ �B�رwϮ�u�DZ2�V���LH�1=Xz�!nd;|���Q| i�yv��3��c5���'߫��X�ߧVR�<�ʿ��V�����s�͌�XD*��ʈX-�ڠ �z��i yך�
Static task
static1
Behavioral task
behavioral1
Sample
cbb56961eb6132a4fcb77558e7bdd556.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cbb56961eb6132a4fcb77558e7bdd556.exe
Resource
win10v2004-20240226-en
General
-
Target
cbb56961eb6132a4fcb77558e7bdd556
-
Size
5.4MB
-
MD5
cbb56961eb6132a4fcb77558e7bdd556
-
SHA1
982e27102408f363b4ea07b715d174a0d5dce20b
-
SHA256
7fca46d0e87435ac11e045efceb20d5e4f641e71a77cca0337ff75f935dd57b6
-
SHA512
947a02e35508e607518ab02746746fe9f6a5d5b804c929916bc02f3ca79caec3e359ce496535a6d34652f8c6a3e36089236f315c7432aa08f34fe7c44beb2822
-
SSDEEP
98304:tyYKYIvnMSojVKHdhcl+1/Zx6zk41CBVE59PwPhw9rKnievtq2CY:J2tb9hclu/KzkDc9opwytqE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbb56961eb6132a4fcb77558e7bdd556
Files
-
cbb56961eb6132a4fcb77558e7bdd556.exe windows:6 windows x64 arch:x64
25699f0ea927e5e49e266d464629a365
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleScreenBufferInfo
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
winhttp
WinHttpConnect
vcruntime140
__CxxFrameHandler3
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ