Cxb����Tv��,ש����òrȚ��wt7��������d�����~��L�^���3-N�����W4� m�� ��� � �Q���<�MS$"}��6BRxJ���uO����\7��ޥ�@�B�ȅMT��p�ˀ�:>��k��B��B+�Q��Z[,�-�Q�I�����B�b�|��֢rX�t�?�チ�_��,$1�r���`�R9A���� b39�{,x)�ֹ 9�ok�ঊ �\��S�B4%��!Jaw!L.���>�%�U�n�m�����xLj1�����>L���Yټy�i�xf��xÛǓQ*!-���i���qM��W`���m}Nt��!�هq�RF���5'��}��n���g�H�*��%9ݙ���@C>i81���!�V�/�`��W:�_$Gw��G^,�z@xOc�D����r8�#\@���4J��$;2���1�G[�1�@�:�(�ŃK�/�(a��� ��O9���F��B��f����b�4�ן�\E]}-nLl���JC���}#�4Ƚ8*X5��Sk�߿��^�PE'멇�������>I*�)����bj�R{�q�v�F���S�=S�.ѿ?�#���Z�ݘ_�+��J�'3�AF��+<X�*����I���[B�G��P�[�E�;�@(������?�@�W�0��ܩdC�����v�/J�����˧t�P��e1[�F��|�:���U������{�8D�Ȟ���H:l�v���"1⡞�!,��ܢ��Ӈ�8�{W8�����zcJ-�,�?�n�3�]��Z�H:����\��3���Q"Y�u��+�U�x��_��p�le��x⼤8�R�����M%����r��R9~�����$�xr��9Dl�����[(`*ӃBa-\Ι-��;[�+��@�����Ԡ�*��E'$���c�Y[y���NfOHSÍo����g&RW���k��}WI�0�-�F���=��O��4?��`��kl��"�ql����3��沮>�����N�7x(��}R��eP��P~�������D�_%�"�G7� TیЬ>�ϝFTaCQ-�����G�I�@T�+�tr2�m>���RC���;�E��'���/D��PƬ�<TG�J��Dׯh��;�_�`��FVͫm�0k{e,�د�����~ף����)�̋&7��BW�.�}\��L�j�|ۘ z p�N�Gl9a-��XLd�����,��a�� m2�X/�&��oq��`�`Ƀ��܆R����-13�;$b��$���oH��#�yH��)�!^/e�u<��TGbS��W&Ԫ�:ۍ\n����CV�͛h�4TM�lae$E�Sɔ�m��ߨ<��p�>NwH�������QnS�Lg�����ȴ�������f4txz=��="��?[M��kZ`����m?�}����%Y�>6�����qN�;G��f���=B� [��@�wb>�j���y��Lk�I��M����#�~`���s&���r����:Ła�w̯M�H�������힋���3��ݸCC�Ig&�+{��+-@k�U�(���z:J3��Y$����2����8���{���@���{���ۀ;�h;��vY>[�W�8,��9�Y�p� =A��@��W=ڕF�t�+��T�i$� �i,Wz�䎠j�fK�*eӜ����DtY�����~�ZHI3����aN��+&ĭ�,.���K�>��ލ��D��� ���3'���'��ٺ#8_'���ΤN`g��c ���3�,�2��Kz^���fV�oA/ds8����ܟo{x�oLr���2��ç�����CӔ��@�A�����&��`ܡ��g����>a*�O�K4Gó�_���?׃ �_H<��Na��戙��>q����#Z���k����'�$pڴ4�Ս0_�Y1C:-Æ�퀉����̧Mм��� C)��\���Y��U2�p��?{S#��BPg�J��4�C^8����ٺ�ׇ�����a}�̂*3�.�W�V�]�:�r�V����x�hJV�>1M��A�>�4U@�`�W�#,D����%����O�v�Q��ӥ6V��|P�I.���&���А���8�c�i4�8��5�ҪE7P��ـ]@�yB*��N� E���6���$���z�H��=>{���zw�~�`���ɦ�����P���.t�i�������M����;Q�5�TM���}�O�[��5�u;"{��4����K�R� ��+���}/\����>^<���a�N��IN�d-Z�0tĆT��2��lYe?�i�g����=.1���;{�k��N��.:+��������X�����0%V�����O#*HP5c7���H�͙��;+V0����B>�ѡ�W =NB�����yz�M`xAo�XC��V�<g�Ѳ��3aKGց�sH}M�\bE�'�p��):H�j2����ȷ�m���:0+��<)�yW�l��p?JJvT��-通����km7wA�~���8���qo�_NO�m��8�6���3���L�G��n����cU����oE����x�|y����oO�Y�ǣ�o r�)rw]�V�TR$�z���o�����}��c�� �fW���t�,'ٸA��F���n3�A�P��io��'RV)�x�ydÆ�y=5��(��M�d#�j��y�'���Ғn�9dS*ҿ����X(��S���5:g���{o:o(y���d��L�y�x<�X��]�;�z�����fX������6��!cſ��D>��.����A�-*�L��rƠ�q�=(%n�*P��K~�*�� @\�;HYA�*����+����������+~k���W�0���QZ� hV�Ԍ�C�"y�����B��d��\� B�C��rt'������z���k��ɦh�5CUB5�n����՜y�.�_� �L�ť,a�����ǿ�Đ=��9辗�m�zK�yB̈́d�$�1 xd���Y[4t��<_�d�(ho=y��7ʈ*���r`��0�My��]}�S啙}M�nM��X�#s�H^A��d�<%X0ٺ�0蔳��_mt�&[�������J�;knH�2���?��du�� �&\���apfL�=��j s��?�����P��XiҸ�$A~]���&��W��D���,ѕ���#R�L��:�'b��D�l�@�OQ��o� ����3nsuJ� ��ݶ�h(�u`
Static task
static1
Behavioral task
behavioral1
Sample
dd406b14fb92c84e458c7d5e6c9f7b05.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd406b14fb92c84e458c7d5e6c9f7b05.exe
Resource
win10v2004-20240226-en
General
-
Target
dd406b14fb92c84e458c7d5e6c9f7b05
-
Size
4.6MB
-
MD5
dd406b14fb92c84e458c7d5e6c9f7b05
-
SHA1
aca27224f1781cee1ed84552cd6429141a7904b2
-
SHA256
49ddc60e4f4ed4fddbbb61e6f59561e2b4e93db91baeccb1b3e447f181a587a2
-
SHA512
b045e6d9582c1e740ae733c1e22af0da4b0fa2aa940a0591caa1ca839902bef25a9db7ef239fcb858ff030ca9a7322658bc905483bc3d26e867f003c68799f38
-
SSDEEP
98304:MgoFvQ/wmDfSDWgr+XU/ScF5gbwjE8IygRbZSoQuqcvQa7etQk0O:gF8HorxSagENKdSLwJ7bk0O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource dd406b14fb92c84e458c7d5e6c9f7b05
Files
-
dd406b14fb92c84e458c7d5e6c9f7b05.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 2.2MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE