[��ޖ,�gn&o%�P�)a,�P-��<� �P�C�cT�f���GI�����%�;�ښ<=�>[q��7J��g�������aS��ЅQ��:J>!�v�'�q1�@����� ���/�5UD�(�iS�̊���=[�����օ�aȍ ��' �݄w�㒺��{��e�ˇ�H)���!e��8t'��Ó�?w�cu���<�W�X��������v��Iɥ�����6@8{Ҍ��J\�=I���u~)�?N��sG�J�@+X�:��j��z�GC< D��&)��M�\�N�C������^Ϩ+��C�MKB�E�՚!�G�T�7 ���%��m������#��;��I��v1�����dɿ�]����3�N��1OCv�����%?0'�;��A�������~���A9�X�&dS^��:�⪺ %�W�$2��%�������>�+[C��P��c��Pֶ���%�>K�uC#w���s�W�n�Qz�%��K`�ݻw%UH��������"FZv�����Cj�]���E�$oI�^�B<��(����=�.�P�F�l^@"L��S�#&8:�a����NZbG���FQl����B���[b�g����eq��E�G,�4�~�;)��n�$|-7����N��)�A������~e����(�Ў� �0Ao�����,g��J�2H����rAj�~���A��e� ����]~.TD ��"�J�K`:'��<im���a��+9(̦V�1<jވ��3)K�k{0F ;�U�w�(�bK���Q�}��\�����t�R�s�� #��l�N�*�UU*�Y��㏂�E�u7�.�]��'V䑒��[��,&�5��r�z����XfFq�w/��sx�w~�GC�u�3D�o� 6�j�G�+�o�C1T}y8}�)�b��K���5jM~�G �n������o�7L3Uth�����)���e����@�X�l�[*��ñN}֤�P��6=�76�D?�|�*�l�>tA�@���eNd�{�~"�)�����������K��0p�Rٚ�C��>�w�Ȼ�J!HS~~B51<~��T�,��K����X�E�&"P���,�Z_��c�,��"�7��OB��M �n/��3nL����l��<�&MG�DTG�� !l����{ V-=��I�)��*~��m(�y�Y��1��;��Q)��k�\K��n� t�C��zոZjG�0�f;�@��d��(�T����c�z(�B�gkO�*�.����$iwP=t� ��n�Q��f��±P$�a���y��(3����*��$�7�2��LFB���jz��$�Lt���[Ș�3���mv��e�HǕ���|/�?�[ �щP���L�b^�&�/� ���#�;W���`��z�Y���^�˪kC9�t�i���!P4��y�������m��v���Z�8��]К�c�8���m����V0,��Pgά��� >G-N)|��`����lU8&�Bh5;;n{�K�G�?� �.�=�ŢU�cH�E���[����n�!��{F~�䯐����"�'H��QTܯ����@R�,A��x��yNp���~̡����o�������=���W�����l��>���O~!w_W�<�)���\�v�4|����sd�+���HRu�TO'~p����l���,y+��K����OT�V\ |��Oa���C9�z=ZSj��Hc/F��C�l���cwjo!��/qkof���:��+Q�j�v=�!,��$FR��~Ɇ�pHIV�u����lJ��ߩ�s�P�9��V"�o��ʄ[!���yr���tW��=�a�i��?rŦ5�8QC��Bp���[:(��?���E�\c�z���S��ޭ���7o��Y�/�+`�-t�3�!�l�I�r��c(h�H�°��0R}��6�0��$��|=P席]he<Ko���>�ߓDC�w+L�"Mv��25`?,D!ĺ}8�+n_���Ry����5Z���7��ǦĤ���9$Z�FUy��tG�1��{��[hd�uI����W��Lw��~I����6s�{h�������WH����R���[ϣQ?K��L���9�;�8ҿ���Uo�I'��g!�j�'6 �Xڇ��I� ?[�3t���Β�jh�8�W�1g*u���[0ZS�i�ɈP�6�x}�,��h,��}��xuY�Wx:�\1����-�M�� +5Hd� Z�@e�n�k���NX��յI@Oj�ˎ��VҨ��$�=Ցyא� (ij������H^��Z���������N�$�<�7 �4�ܡ���ݎ$3gQ} 0ʷ�B��J�!�(��ޱ&�q�(�HM;�kn�'��{k��;#�����)�X�e,�#j����k� |�GE �ד�R�����-Ki�o��~��ᯋy�@SP) W�Kf��|y0�z9�9� �f�4JK������*�w�Y��RK�Bw�;��ױ`��@�]�)H�S�K�J����?(Y��5^�V������s�b�*DFuI�҈�L���roRYH�)� �Q��I��2eH �G �"�0(�ь`L�"�h���u��VH%�P��ۧV-� 6� ^����Z�� ȅ�X�$p��<�}K7xf6r���j,@��̈�Rr+;df�<ɕGJS$Ѝ�}(%V7>ԱPI���!Ev�$,AZ��Y���Z�z!��� L���R���(W��؟'�EB�ao�����x��v�������3��&x�(�`�X���m'�/�G�D�kI�� �9k�>���f�g}���3��]Q�"�=�JX5t��*WBZY�� ����;��ˣ���zH2��e���p�!���O��&Z�H5�ָۿ_�~� 鐷O�gȷS)�ս*��DGG�C���ա /F�����d�`�Q�����=g[�EU#��Y��d���,��,/O��?����� �;I��|P4t>b �g����9o�mP �I&� ��7 �X�&������v�_��=/���-�Ng* >�|�`�g�h�,̛��W���(ܟ��\�P�<�q�H�vX3�T���kV,�V��o�dO*T�{R�s!=+�8WN���+�`�Âؐ.a�4AZ�fׇ�7��������^�p�D�$�DX���d[3�[T�6���Zx<���,��S����W{��7�I���u���ܒI`Yo���B��~�:����R3UlP��j(� u� 5߷�>>�p��i O������2�9/[���a��L [!�џ�/��[�^f+�k�-.��;�p�@P7l2E��D����g>d��ѭo'�:w�u���?���.F{5 ��K*�=ѣs��+a�*ΏKN�3���^c势�����7bs�gw�)��𔐬B�+�>�Y2o��L���Cì�T�vA���pA�w}d��#�?9$v%������K���UUw*F�Y��bȈI�g"�� rNz��YȎω�:A� ��%2G�-V�:\d@b$<�� {� ������4���Qz�4,%������^"��m��f�����`v+F�G�[O� {Pz� u&ra��iw��-˓ު��@ˊ�B�j�Jm�ͥ��lY��=�BHW��Fv�$랁��U���������A���m �`���&0�0 |'�zr�aL�p}h�N\���~N�
Static task
static1
Behavioral task
behavioral1
Sample
cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700.exe
Resource
win10v2004-20240508-en
General
-
Target
cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700
-
Size
3.1MB
-
MD5
ba389418d7541ce645d8c7d379bb557f
-
SHA1
83d0d899d4f13e0830737092295e8f8a7046d538
-
SHA256
cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700
-
SHA512
6c5235a967752a5e2240e195267be4ec047ae43a97f15b516c5eac5d5f459f4e70f628751f91d7681e3ab03b6174280610431533b6553ac13f94281503d22691
-
SSDEEP
98304:VQIvYS2pioBtLE1WNNdIYORONzqbM3BZq:VciYt41qDIYuONWbYn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700
Files
-
cf55c18c4da6b679cb00517682afdb380ec308fc53bd7643945c8ea772d9c700.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 648KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 112KB - Virtual size: 480KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 212KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE