�u�5�����\�fB2���Sn��hG`<�Қ~�ǂ)��6nN�V0l>.�W2��RRX�g �A���$##���2#�b���<�1Ϥ���k�oá���qLOj]��X��9���ƃ3�Z��T��#H"tq�J.K����N��s�D��a�D��4^{O�q��/�@�!�6R�v��o�� ���;��&7��T<h�`���Ն�6�Y^�%���?D~vӄ���0L������>��ϼ�@�:nc��ѥX�������6�8���Z��V�:g�?����<����}<�{J ���v�1�)�f0s o�#�k���aN0�?�����B�;�U���ͺ'��cʷ���l4g�{��"a���Eٽ�V�_�+æ� z�����`��"�!;��bh�ɒ��|�����O�h���� ���=]�|w���W��L�mvOw�0vCȣ ��fc�g�$�`=dmh9.S��sd�H�H�҆��iD�?%ޝ�,l՞s����A��}�M�B(�ٲ�Uo�8�Z�����#��S��~&(��XQ���6�o-?��Bgv���U���đ�<�Z ��z2�f%�T��f1�V:���R��a�dwdB���X�N7�����͕�7��ɠ�O�����t^ȟB��}��rSp�@ڽ"-�.Q��gxx)��ג._/��;�/�H�7:�#��H���l��2AJ8�,prw��De��&&���Q�ն�տ��\���ՙ�q��u�wt�|Klh���/���`������r��"��Ę����]z��s']�C��bW�0j�����M*l���ވ�&�i�r�M�J�m��ZW�z�q��������C�z�I�!"��G��� �ʔ�._�.�?ј�cR�YD�d��t�g���۳2s=�]�45Roς�工��|8NsσA*��܅-I��U�R��IJk+��B�[��<i���F=��ʬ�֠� C܇������+M�J]ACV�4(�nƊ ���葭�����z5�����`">�}����8-H6�3���O~�~>\�,�ēp'tt?�H�Kz� �ߩ�d*5�����>�ݧ"��� m�$nK�&ɺ�'�`��s$����`�����y\�,"$�Q�luB��ݑ���q GU����𩛊U��uS�{��xw 'b>A �6�V��+���/<�絔�;1űA��Ԏ�2�7ur�g�4���|էT]�v���:q+E���Ώ�<��A�L(��!���/U���@x���䴓E_�t��a�J��G8B��7��^4'�L�-��H>H�����^���NL�t`@�Y����hWA�=���9��!<JJ�c���a!�l�뛾��67�B��]>[kR%f��g֬"�� �������4�������g��=� ��--?��e'�K�a��z)�f^��Kl۳�E��ʂ����|�]�n�*"����ɩ 1��;�&xFU;[�[gSu6?�}�fQ��A}҈���pAO��ČI�� :��AJ�5��V �q��1��(ncm��u�X~y�G`�:��Vd�ﻛ���ώ�^HPM�{F�Mb�Y� g��t��)�O���MiPR��R�D�aX����s����ZG��wh�kW߃G�L�Q�z�돥(�P�c�MN����P��?r+��z,������W�k�S���̸9�O��8_���$�1�^�9-FɒD:��.� )�V���(������psqr�H�=�Pޜ�HI�G���7���K!��)��p C"T�P���y�IU��~Xb圙����W�@�4Z��Mq�������f�?P��_w�d�Wz��>�ލ������b�!Jy��I�AW���v}J1��J�/�p���,+����ϛ�(d.;f��!!P7IX~1��@9ci��0z>|AEТ�P<X��4'�F���7b��?��=z���wر���`�_�Ʌ��7{:˘����ّ�wXm��C�߀Q��P�h,�zF� k"�D� *�&Sn�QZ[9�8�Y�������S�ezK߾p��;-ٓ�=�C�?�W�����F�_]p�CP�y zcN�;�坅3��a)�Wb,�B�c�'\��H#�ϼg{��I����I�F�B���:OM���ۖ��Ѡ'E�9��f��M��89��u�]�V-���З�%pF���U�YH1 zk�P��`��תf����#��1���|���S��1��|�=0"e�-��웣"'�>�Yr���&9hF6h0Z��$b>LPIds�)������rD�V�Th1�!m;$iyFX�*60n�dĭ`����+�g��f���F�]$g,�F�#p��" כ��O�n��=�)������XE��c��HQ� ��W[����re$M]���F�'��\d�V'�V�2�ϝF��8X������?�B�Rۦ{�8�n� � j�����Z�QA}��I�(t{�%p��i�"~�3i)?�=yDz2�m��[�y'�J�-hr}T�b�K�kes. w�6~1iS�82��m�='�fn�������,�����Ycs��p��t �ݯ��)wz �yDR�����?[ol��HfZo�V�Ӝ��/��7�(���� 4tiH�x��QJW=~���)M� .�����A%�P<�T�x���/¶�y��B�\m���b{�/'=�?�5م��Iy�J�g�����ӭ��JΎ.���fj.RňqM���tL�=��,��O��y����L�#F�IrgR�uݴrTj�Нfk�G�Q驒 h��1�k�r�"�a�*��1��C�eӟ�¦�&ϴw]ѭ<��h�� �f�pN�\�y�eD�c�(���UL�3�PgE�\���S9��?��"b8��QQ=�/=���P�4¯��U�e��b$YQ3?��kV���b8&[�g��Y��oYh)��C���Z����*X�-:����@=�EF#�\&?�1�d��M�w,�*֦roqqDq�U�J���Q�Ϣ��؏DbH/�0u�5Lsb�,������玔����<���=��m�k��~�d���*�^�g閨GW��F��
Static task
static1
Behavioral task
behavioral1
Sample
ccf415f6093429c12f41be45df5722b8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccf415f6093429c12f41be45df5722b8.exe
Resource
win10v2004-20240226-en
General
-
Target
ccf415f6093429c12f41be45df5722b8
-
Size
7.9MB
-
MD5
ccf415f6093429c12f41be45df5722b8
-
SHA1
6124a5ce1f30167667fbee4bd5b323e35fed75c2
-
SHA256
a391202e567ff11aac9cc6d1b43ce99806239c9d5657508d103a68972eaf5c9f
-
SHA512
f8c23fe036d5835b5b55b9cefc56e03308516069576436ec3b1bf989a6c931022a0ceeea836d40f8e47544acde00f79309fcc6ab29e4264cdc6b0c0c1b403147
-
SSDEEP
196608:oDIRTIoVskMS24Rjvim18l1tsDEe7egNxTGTVFvJHM:oD+XsYT2+DEe7eEJWfxs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ccf415f6093429c12f41be45df5722b8
Files
-
ccf415f6093429c12f41be45df5722b8.exe windows:6 windows x86 arch:x86
a599dbeb0814778a638847b9c0aeb4e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExW
wininet
InternetCheckConnectionA
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
xinput1_3
ord4
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
normaliz
IdnToAscii
ws2_32
ntohl
wldap32
ord32
crypt32
CertFreeCertificateChain
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.thmda0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.thmda1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ