��C.��4$~S�+@��<P�<U�y|E�:V�p�z����5��y��B�d�fj%繍���2��ۅ*�� I�P;�bdJ�$�%O3ڡi[�T�Ϳ�/�g�W��5�_h��;��=�(Y�0@"ۭ���U�W��\j�(�9M�Vb* �z��w~Z&�o��X���q1����Gn�68J�:���n�O���ٽH�H@�X��9��uB&F[\�-�9��2z���S?��K�~pU��ɑw4L�9��wދ��dKx,�Ė'͔9/{A+ŇK�q���!}�x���}W��I� �J`?횳M$����Ԁ�尯��m�����������"��N2wt����8`Q#�kP ݒ�U��Fs�̃bDbU[�M�&'9?5Cr��m12�M.���}1,��N:�qa���P��Ϲ@dl�� ����h�S���@P�8�� �9�ӢW+0Ջ���e�л��_W8����ђ�>���Q�bO)K�͐�_�r��>k���닔nd>��^���3������ۉz�_���L���lOj4�����kR�� ����D�)'�ħ���a�K�Q��mt�/zY�l�B?�R�;�eZ�0բ>Zu�-�G�}����N��k��!�d�:����t�^O��EH��c�$��>�����~��:�<n�Nl1���t�z�M�����T�OS�m�5̛q</���ρ㡝LQֺ�~˧����B�:������F]�&sѫy�c�[d�$ju&�<X�#��L��*Y=�(����g�ǹ�M\(A��T�J��R�6��8��-��pL[݀��D���|� ��nH���[U �_����6�a�{q�~��f�H��E����1x0SL誾� � ;���lh��L^� �5�g�O��0�v����0�y�dm0zKJ��ek<�F�p(=c�w��v%��oyiIG�AM'2y�5<����'��fR�!!�{[�8�d�� �I��1m�|Q�`e�fTAy�}V ��Wy�^�#�������b��.����� fsYֳJ�L(��G*`��E�uÆZc�p ���Az������eo�]�)И����q�˓��tJVY��U2I٬�Y�����"101�F?b��9n�cou��/���W���>�j覻�BCPbR�Ax;��s&��f�����_��1���n�>N|����ZO�Da<�~���> �_xx{G�С����/&e)���ǎ�7�MJ���־��05p8 ��/Gɢ���H��:��&�w���i�<���c���4��������s��E9�<!s'����0�z.QE �� �����yvM�T������+/[�1�j>�g�W�X�@��u �0� �UlLy�7�)��.��P�9nY��r�����K��[�0;X_X�!1��4[��g�L���a��� g^X�{��N/���$��}���ࢣ���F�y�<�[21�E������*�R�=�����n��<t�B������u�,�d�ľ��ΌA�e>��gsS*$x���õ|�E�h库�OW� ��)d�� �k�H��Y��j{�R?=W�'zN�� D�W��G�����g� �'Nb����|G�/�4rg�߈;���Hn JC�d�#b�i��3�b| �a(��ߨ]��2|�}�r�3�ο�^W� � ��7Zh�S��zl��ޡU��ܿ>�X�&�W�@i0"������������7)+� g���� �?W� �m� � �(P�΅�����H8{y�p�1r�ۓ�|pg2˯͏<��+���;����^�� ��t�w�@��0�%��ݹ�w������a�;W�"�j&���f[��X�qjS2��`g!~~��X]9��a@��ٿu��8�J1����U-����W��#��w���vHe����X��伙��3��W|�����-�l- �o��'Q�gkR(���Y����+�W0��>鐀L>7�����OGb ��P2E��P6�T���M�Ͼ��1-<\O�H��"��E�Fe�L��b�:nNP7��@��>�6e���iaӒ|�E�b��]V��� .qR�o��vƖ�������� �<b���x��\���q��P��Ԝ_�^ � Lp���u5R�)[�u�{gD����9��$���}Ik�i�$<YpC00?��hKlHOc%h�?0VP�Kk�?�������4��lZOO5�ӆ�u_oF#���o�������"���^4I�o�<���h��n��(M�}Ey��7��s��i��C���o09j�����?S����d+��,�X{~,Wr <=Oѥ{�k�� � �����.�`^+A�H-���Y�-;��m; 11iQ�3, ���x�H7]������^A��[U�ޡ�jA�S%����O����ms�`� ��i��j�`Wj�D�$������u����l���@PC��䭨��Bo�z�:���>~��x ���ċ�~ 2������T��^�!��6���O��X�%� �2s���G��|,2�z�t.�܉[A`��'���nɄ04��!�R�������EC���բʝ;��3k|Q�:?�b���=Q6�.���T�O�����U@o���+�W��v2|&�t���7��b�x��z��;�~���ȃ��p D�Όn�BL�~��kÇv=#�Dџ�P�8����*�L'NX�6=�(�E��a�b�ݘ�@��6�AK�r C��rT\rX����$%��U)�v�h˕��K���"ð�rb ��|�e��'e�;����|��gG�� ܝ,T�i��Nq��O����V�ԭc�]�e�����`w2�����I�̢m�L����fc��h�x����HP����O�]>���(h�ҁx�A��[]�Qn$Ynp:|�J�W�����y�˾g��>Bi_)�����FB����ua���?Z�7���`x���í�����'=;�u�z�n]i-%���D��\<�j%#���@<o������'���5@�B�%�s^��5�!٬�v~��'��\�7uV��S%�)������SD��r���؋�W�h'�o���� ����'������I����/� X���l</u���_P�-W!��K���tr��d�<�H*���3��]e����q72a�Q��Φ��qY[���Jo�A�ߞ�W�A:G��'����Uh�й��E�g�_���_7h����r�k�8#ïsC� ]��!���y
Static task
static1
Behavioral task
behavioral1
Sample
cd967706d18774fc8f37cc6bfb55250f17b4c15a30e2e576a3c42202a2f68eda.exe
Resource
win10v2004-20240226-en
General
-
Target
cd967706d18774fc8f37cc6bfb55250f17b4c15a30e2e576a3c42202a2f68eda
-
Size
3.0MB
-
MD5
ac8870da560a82f8cfbebd0c0c88edd1
-
SHA1
18133b0a481f70c7126a4cf5a5de518615119b14
-
SHA256
cd967706d18774fc8f37cc6bfb55250f17b4c15a30e2e576a3c42202a2f68eda
-
SHA512
c23f39043ae15cd525dfd761371abae2405e872b8b81a524143ae8152f5cfb73cf2be86d3077a833d4fc946001fb14cc6db275c3e150d2ee4e86aae9dd76ea03
-
SSDEEP
49152:J1l2f/AwYPC9vNoswSNpwhoIZau9cZqsQPbtmhJk8bLYe7JLe5OL:J/gdSsuoIZhcoZBmhhfJLe5O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd967706d18774fc8f37cc6bfb55250f17b4c15a30e2e576a3c42202a2f68eda
Files
-
cd967706d18774fc8f37cc6bfb55250f17b4c15a30e2e576a3c42202a2f68eda.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE