ˁ���-��MDR��[_~��O�/�+�N@�<��V�/���= �i^��ϒ���Mh�J�K�e�cy�ʝk�r���� �9kg�?����dţҺl��jJ� c:���1& �A�'p�V�� k�Å��c�d\H��<q�-?���o��2��nwh�Szw�2)����A=���z���w��J g���Mndx�oMɌ��.�[�ٽ�'�����0?�ڎ��K#�w���� P[`H�ØPi���t�i��-�z&I�e.[.�i{��g�(}uB(�D��(U���{�Ƌ�w:;@)�5)�)91�R>�8�Ql4��Ź�� �8���Y�9��0�!u���� ����!�1��K�y ������`u��؞�}Ex����>�`�q 7r8[F��Jz�j-��XA}�j ,�]�*�54��%Ŗ�� ��NAΨ���g�ի���O�a y��g �9iz�[b2F�b�D�?1v�p!�f���I�GI�'g}�j\Vv�ߜ��� z��L�k�x��+b�P�`�t2�gV�_4�<>��S>�f�A�@��[��p9\^��F7�)�K�#����>pח��{��sǬ8�����g���T`�B4��)idCn?���j�{������A8IY+!�`�2H- �q�g��zk�����wn���<@K�wS>��"�����7�s���p9ȔY�P ��;��9�̣:=� �ؓל��{s�1_�M �|������*�F���V��e4��)�o��J�rruve�KEz��|�A�i��%�\���oT�����;�q%`2[�ųbG�+s�������T|G��%�!Ÿ�8䚉�H��GN) Bˀ7�.�TM!e��W�ǣC��F��@ �� �h$��*T���ڮ{�ͷ��J��%B�9����Ʊ�'�H+��>�#�3��L��\v+�̖;�YEA�<J��p��rO���9�ጽ7�E�y����C7�G�Gḱ7�6a+}�dT(�e�My�UG�Nn�mt#y�D���x�.��Ebap%�G��3�>O�^bx)�'���dޏ�5]7�\��n/�5��e]�4��C�N�(�![t%��a�ʟ�S�ߧ=��3�������S�IS����>���<i�̨���c�]~J|��v�E*����o�R�&X������xw�3�7��O@h+�ܞK#���|�������R،"��b�5i�v���R;�a�(*��h�o�_Z^C�r��-��w?���ئ2x�1���2Ye�f�W7'[��Ş�Ӛ�� f�&H��n���I!�r��_[�`������R[��m�&"��>/~���U�b��O],���$9��`f%C�3�Y=����kK�^�Ϧ�9��2h�ɛ(�P�3{�'6b���1f>$aKho�U�*_6��f���s1����#+c��i�,���]��?����[#�%|�2���/�Ͳ��3V<�nۀ,�d�}H�k�I�`���y�f��x��ZZ*N[/Hh�2|Y=�ȑ�,0_b�{�����;R����kO��r�h��.�Miu��o�������O�����4��R��w���aĂ���:�3;p����^r������M�>\İ"/���������k��>Yo�a>uz�[��zA/A�YK�ncΤC ���F� )+���ϲ2�F�B�7^����Zm���C��Q�z �蠧����[E�^k ��\�sn�&�;W[-�u���I�d8<����?u*�J<o7�����KxQ@z��sEA� ����pCP�v%���Z.i�HPI!��S�)�_L�=p��;���5�m�$����6v�kFAu��%��yK=^YD����5��+>�iT�(��^O�<�[���5f_�}h4x�{�VGt�[����rՙ��V��쬇X��V�"FӠ���N��@??�K����E���<I�����aٞ;��/�ۤ�p�h�,�H�Em�|�n�g�Z-qH��{Ez`�J(��Y� ڣ"4I ���m�ǜz�;2�N1�}v\�ۈ����B��e�@ڌ�?���W�f24� ���̹���S�?�����{9�"�lcʧ��b�����T���-�~1�Z!��,�^&z�ӐHi:I�_�o��Ҝ�7��2ڏ�x��ĭ���yƤ���M�`��=s&�4�)N�F���̤�m�T<z���tg��@2̃���搊9AG��G `�T8��>/!�L5���D4YA�\�U�9�����m����c�%�m���S0 ?ִ�x!7'׳F;Y�vA��űE˚YS�~�R��jN\ST��^聰� 9%c�^'`����`�˺'��z�F�}��:���� ��}/�@v��8���؎W�V�ҍ%���k�_q��c�x�A��%6$H |��\\�{Qi���'(�h͋r�tZS�%ཱྀT���q��m������B?�������.����������Fʙ'L�@)�a��s"����n��^��V��.J���Uil���H�Y�?ϵR*�ך�C�G�yZ���o(f�M�E:�1J�����J�9z��8(�ɧ�閻�V�19��0������Js*�Gp���گe��Fh��=���T =�n/����6ɂ��#��&xF[p����5��p�=����:nT���Dhҟ�����wWբ=.����>��@V��Ǽ�� ��L~��»�������H��vɣ#�4$*J��Ԃ���B�ep�:��砝R�hO��8v]�G\���P���a?Ԛ�������?^�NKTΣ�7�o���x\ݷ��g�3"q��1>�@؇��O=3+)kҝ�,�F��ڸ��DE��8\���Yq� 4�C�8����\m�7�({^y�~.����M"x@�v>R)�jfc�%]��8&�����2x���Ԋ/��:0O;s�ȫ���+%u�� ���<~U�|���k�g��C�� �d��3�EZ_H�(�g�Ŵ�@�+'t�J��~E����:2]���*Ň����+�1���?0���'1�M�g��$����J��;+��4P��*%1�����q����w�&^��%�
Static task
static1
Behavioral task
behavioral1
Sample
c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32.exe
Resource
win10v2004-20240508-en
General
-
Target
c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32
-
Size
8.7MB
-
MD5
803218da2c76540e3e7aca90f359a3a1
-
SHA1
c597dc4ab4ac5caadeae08aa9a64174f50425ac3
-
SHA256
c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32
-
SHA512
8341c25704708eeee0a5449662b1c857d54bd80575ae8dc7b089a529149c95ece3dbfdad0aa1f49c7b090ade7e28ba216e5fd97801359b1456deff519ba6685a
-
SSDEEP
196608:/sfsbzK/DA2SywfYcTRlI1eiDKJeJma16:4Gm/UzyaY8y1Bcmd16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32
Files
-
c4c1cf0bac1f6ef7db929e8e81db3625b5c5290fe4124a7e4f2ef32397619a32.exe windows:6 windows x64 arch:x64
b482b9c18b9f8dec64ffd59caf8abe65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenServiceA
wininet
InternetOpenUrlA
kernel32
GetCurrentProcessId
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
AppendMenuA
CharUpperBuffW
shell32
ord680
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
msvcp140_atomic_wait
__std_atomic_wait_direct
comctl32
ord345
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Igb Size: - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|_2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.X3K Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ