_� T��k�d�u6`9�11��;��F�벆G>�� D�\��z�bm5��}���k���z�,/r����*%�w�ю���3���F��;�I������.l]��K�������F�UԹ���ݫ�_䄍tFb��Cc}�^�\�/p�7(�@nh��W \�pl�㣽�D�n���0�J{������ٯ�!_���������d�<����_�L���窘?�5?2��$�R�Rx�.��Xֶ~gAEP����M���uR�#1���������Ȧ� ���v�����l�bL�*%�iT�{=o�\3'�����P20;�8�kjK��������{5�c�̿1T���x��LJ��FG^ۜ�g��<��0k���-mVh�+�&�Y �#Qи�o���� �QrK�M95q+���WP�n �nQ�z�&����B��}�l:��~���@~㫘�4��N��M��.s8J��/��:/$��������c���!�ͬ"/ ��U_�<��ω�S�EZ��v쩾���P�p?�;����njT�}�<C�"�H�e�KC1U�uW0�����|i���O(� �e�(V�+NN�l��ώjP��e����b#FN�8��4�4����D�d��ݑp��N+ņMx�xK�4��qn�@���pLtM^�Qݿ�?m�͞����z���@C���Ə����u~��K�#�*�����ŋ���y��(bv��GwB��d3�����ٲ���s~���w gP�����f{��L�� �[�"�}��a��yn?F�/c���G7m��Fav������ݟE5Q�c�x���)n�����b�!7���s\v��H`w��h���Cc�U�l� ���k�lm[��_g�BTv���� �'Şfܿ�%c�%Ȭ�T�H�'|\������p<�%��oیff����}����y��^��2��nmY�paؐ9�ήgD�Sɗ��@�������͖ �X��k�����?jqx0 h8�*��6�\6�v�b͞y)�a�Sgrǀ�����yܓ����BU�u3�&U��+k?j[w�&��T������ysR��)z~�Ù)�����h#�%u���R��)��sB� k�n��j�O |���7H3i*��)�uN?��1��m*Yr;j�q'��z'K��<�����HKIS��Q�SR����Բ�h�&�X:�L����C��zJP ��y߯�DMC� g!�ݞv���Z8N!�f���PWE�����u��\i������� ��x��x&���%�Z�i���� Ԑ�>���9�m�݁㔔���X�yY^�M ����q�'`��)T��gM�}��4...Q�q g�-J���oجĂg ��-[��hQJ5���^r"m:��N�D|��b��C�j���5/P�]^)��R�ƜN��3Xx>'w�#(��.����V(K,v��g�ղB�~��ﶬ)k�����حl�\65خ�eI��}�]{2w4v�G2F����,ݫ/g106�����܋;$�v���Y�a��M�kA�>��F"*抑�l�4���J��y�d�i\.`��pk(�UK�P��x_.E��6mi�B��U�h�~��X��'7�h{+�]uC�i�"���)��r'�@VOvTٹ6������y.x<���(]1�q���^����q�U�~��h�i�ů@/���T\����5����ӝL�號�nbpk�Q3��1l�������6���-I d��;Y����<�,CF���.�1�����v�p�$�s�4���u[�Б�',�������V�U�/�&܊�+�CDI������� ��Mֹ���XtRsl��[��73�⇌�Ba���V[�����W쉺��RòLb:E�Ϝo(�� ��$zK ���, iAY�N��R�(hq9�Q̢���5�ra�t(mf_h��]�T� d����^%�#ji��0Ýt��Ȱ�nw(��� I�m�G>�Y_ڪ@Wp�~Ǎ�DzJG- �zV�z������2{�8h�"�8�q9 ���6��0����z�*�XO�A�)����F%�_��{�)y����`��h��.j��l�HD����0!�1���MGZ���,��X��sS����x ̓DZ��TW&G����Sf�/r��z�x�H>��Q�q�;��{و�H��x��}ϸ:���V|����k�����hCHw�'�:�"|p��Uw�ִ�v9[�$������=�z�܋C������*��Nq��_ն�߬J%� �&/#-�F���ә�ɭ�p�T�����m����yOM�r�O�XM�Yǚ6��5��ūT�ݪ^����u��*�5l0�-G*&��G)���-�/^��y ���T}U������ �y�q@��_��y�G�(=�Y��a��i ����懱�\V�Kq%���1��<? ��|D0t̮�� 1�*��'�F7�����?8ݙ��L��`�%��\����v�J��`\�q.������%��0+�wG|Z*Y�����E�����{`�g�h&f��x����Ќ4��RZ<�����b�yM����ה�Bb��N���z������V �8�8�:�)�ns3-8��M�AHً��F�V����v��B�JF'Ӭ�J��ț�5��# Р��l���sO�{`�T(L��O)zd���z�<]�B�]]�2V�$o�V珨$�>��Ц+���i5�qd&�i���H�<� LP�^��q]y�u{D� M�������ߋ�S���MIQ�.��F�I��R�QT��i����;�� |�*q��n�Qb5�N�6�Nm>�� [�7h�צ���Y�{S�l��~>{��]�zeo}.�ڤ2>�.y3%�L�� �~�С��i��79'�"����Fz��e-6� �2�-�ם�R��{�t]|� J�4!"(���j������oc��ꡅr�m<�?�MX��۬�c�����RV�;���b/�ZR�FEˋ�;�b�0 �{U�7(�Ļ0�)���� <t�*4K�P�%��p��6gyN$W�.T��A��5�k������Url�aBKH�M�c�k��L:K�^�n�+��X\���7���5��Z�g��]���B���1[�l<����uv�&<.����6��p�?ˏg�>��}��8��&�i�ժ�:֎�P?xjW���Z�R�p�6�ܻ�=߽L��v�M�g��G�F���5�7��Х��K�Yn'3z�?K�x�`'�U���c0"ĺ�O�+����W���0�K�PV%0o2��($3�M��*�F��!����;p�.�FM�Q�����M�Jj�?�T��S^#'�⭛���o�������"Zɒ��B���kb�8RV�o���2��5!���w��o-9�6r.�6-�F3�����W`�|���q� "�_ޒD'�����@^���{�E�S��H�v��pƛ,��5ۯ�n��\�%�>r��ޠYt�� �ה�!+�3�3��8�%��8�[����R�� �������Ci�l���ʈZ_�>^W tsh��6@�];��Q��Z�'�4���� 0ͷ��:�(�B���ْ��$aZ�Ar5�1�!Z �1��$$p��G���19��=J�c�!�/r�pE}�"t�پh vd<�d''�y���E@�]����-�\Q�����|mCo
Static task
static1
Behavioral task
behavioral1
Sample
bakon-protected.exe
Resource
win10v2004-20240412-en
General
-
Target
bakon-protected.exe
-
Size
7.8MB
-
MD5
73338f8b09cb77aedac8e3c1c33f955b
-
SHA1
76ac785858ba35ed802617cad60b4eb19f00222d
-
SHA256
fd7a82bc399e12e0fa1d19b2cca7342d98bcf6bd2b9ec2b44ac2bd5ed60a68db
-
SHA512
25e2dbabb5b7e96fcaa6ed32e8eda622ab5ba9bc178049861e330283be4105028130d7bcb94f133510ff024b3d11ead27aca09adfbde3e79934f2141fadb962f
-
SSDEEP
196608:GKEI+BAh4uf4Cr/msGr+v8DpxPW6kUhftaI:ZeBK7f4Cr/mR+v8VtkUpI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bakon-protected.exe
Files
-
bakon-protected.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 313KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 52KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 32.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE