�A�me�`��ޝ��9A$*ڦ=���y/�3�e �VF�'��,?�����4-~C�S�=|�P(o/{:&ij<d����=��G�}�Q�2��:�)!�}܈k�+��})��?��^��P7��|���%����{]�`�h�\��d�;�7#.J�p�c��h�; ��n(y��oQ)��tvG}�*8�$�E��]9��O����� ��d�1�B�Y���}� p �->rvZЦ*��*��+��!T }}��-��/S��� +�� ?[����+`�Q�#��6v���dSP�J����w'��au�X�9����S�S�����T�j�Tޞ��)�Rd�_?]F%�ivE2X���ڿZ� /�a�tG%�*�Fc�]�u+� �����߭,\�m�.���ϯ��P�\v���$>y�b���������XP�$Y%�l�mU��:���c�(�����>��Ї�.�T��A��F�*+�fj�Xi�;dI���B-T��G�I�-�W���;��@��@��"�6:�J+�)��G���U�A���ijʹ[�����7������r(~��=��t��f+;e�J��[�Y�i6�T��U��$i߁&���Vg��QC?Y5���]�"s �(�v��������(��#�'��!6�*��k�ki) P5����:7͢���������_�� ��";������>J?JqH�45��;�)s��b[Ϟ��ci�u;����L�����㥥�p"a����} ����Ѡw��8m�&3z��=�OX���pxtN2~�J7����w'�c��؋�X�L{�N���1�͂�9TL�D\���b@� �w�Yй����¿�[��O}�u@���\�������!8���`�F1&�V�]}۾ږtd�Z}a�M����q#�l�`}|Fո#eI��+����o��n�%��,]��s:����ڃfSp�pL#�j��^�j�=�_���2L:[�о���We�,_Xz�h@������R�����o#��B����+-�@T�^H�*'?#�T�!+(��=��4�ٺ�e�q�r�E�����;�-�i͐��f�cz8����ٺ�[=Hbk��̭�Wvd�0{@B����v�a;@��������έ���_Ni�B��qJ��r�21�*xēF���G�(#�vEG���Ɔ�i����xc�Ă ql%N/.Q�$R�@aP����@]#���coA�D`��حw�h�K�6ӛ3�_k�T(UA.-r1�il/Y* Ԃ`'��k�{"%iz�r�Ŭ����I�d�%���YK8c1jӾ8@�,y2�79��iQ���*?AD�b�q�#S�5+?�tr[�ûڮwhx�y8a������)�(ĘomHj�i�-�>��w�v�S�.e�q2�S�x�+�VN�Ō��H�����nV`���č�>-i�:�,������������/t�-\���^���o��L�1���p�q��7�r�c�IkQ��w��h$��O/>"��!��v�s$��1CR�݊,Q����跔�%�� Q�˙ ��i7�#�͗��V�\�~+?@OjEf��^j��*���0��z����W�O�H����������抁Qg"���5�{b.H��DM?��p~�+�]3���g�-+H`Ӯ�̘p�'jx`��i�Y��8uʿ�4�͍"y���p� n|Z�21I6���y�M��5�L�tVz��2F#0#(�FO�wؑ?D���-&�z$I��j����~�C4�kH8����[������ �ڬ=[�� ;�Id�rX���64)_a�9����t�S�-}"dOP)�7Z,M��7�/>h�xr��#�ix�pڹ�7��揠�xi�&{��X�-�`��h���U�7�ut���-��f�n�| _r�\���0e6�Q�g�����U�x܄�S�f��Wi�p���q�͋]��w��gJ�Z�7?ؗKP�rtP��i"�k[@5��f$UH.���|�&c�Æ6e�����������y{�5��$��!�`~~{�'7S�����<N.��x���=Xî�u=v� �ٕ��-����u� ��WuE�`�<j�եH�5H, m�����<���L� W��oa�x�K���t��m������QT���6OM$��@���>�UM�fʘ�J��(��X���+�� ẃ<�i꣤6�f�_s��֡.�-((OI��f�s��@��KL,��X�ʶ���l���x���oT_.z|�Ov�4�βSYI�wB�ue}�=Db.'���ȥh����Hs��(����� ������H#�X��OcLon�M�1*�#.q�� �)1*6^[-�uDF�ўj/`Aphdxg����W��)�~J`.��NnU7v*�������u8���oڪD�a��JN_���{���ӂ����� �i-���l���P\@G��t��%$Ն��c9��i*zY�<�����+��@�\���2Y�^ǝ���G�1V���jAv�"x �'�a���c=J6R�awK/��Q��lOE�_�ND�P�L1|���{���F�3��G�����C��5���$�R�?�?jE�â�BX�13��G�B2���ƸGR���IZH��"�-��H�pa.#+ <�����O�J@�~T �ve��@+h�X0�H��������CՙU|-)1ި�O�C5��IE�<T��2Y�r���ή�)�2-v�ߣc�� ��p������F�k>�ށ�yp�9���ә�Yޒ�W2�\J�UY��9q��7���2�lV�hf�W��"81��:N/z���_1� ���:g����b,;˞��2��i#�*� E�#f�v���(LmQ]���x�2����!� �� "�7��Ѥ b��������" f�Z�.�?]�ML�O?���4���ˢ������z���A��?.��R��Fuw�bZ<��ݷ�![��hslw����ta��_]'|�dk�`�-�u�l}�������O��v��Q��`�������o��%����*��p��j\!
Static task
static1
Behavioral task
behavioral1
Sample
cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5.exe
Resource
win10v2004-20240426-en
General
-
Target
cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5
-
Size
2.8MB
-
MD5
0b2cb7adb4e2a1447222681c9d422420
-
SHA1
7e074d5d76ccec6bf8136adf4f845015e1243cb7
-
SHA256
cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5
-
SHA512
3e0cb454fd8e306995a3cf6d69139f810687dd75443eb74909e0d8a60e7babeed05fc3deb9d65d63ed839079dc9cbc36fa71872ed0ba2d2b11ea8fcb2d204512
-
SSDEEP
49152:/k5YEGaeoIFUxP5RUrF/PQfJ51N73dTN3COW0OP98gC:vEGasFW5RUrFQfr7tTQLM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5
Files
-
cdedbf3f958fdd3575ed4cdfc46d602a8e2aee5d8ff33754db271e8cb81b86b5.exe windows:5 windows x86 arch:x86
36d0fc9729af329b4834091bac80a4d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2124
msvcrt
strcpy
kernel32
GetVersionExA
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
advapi32
SetSecurityDescriptorDacl
shell32
ShellExecuteA
ws2_32
recv
msvcp60
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tmd0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tmd1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ