����dɊ�j���0d���Rv��:?װ�q�M�V���P�Ƚ^Z2@4���*�J�F��_�fͮ��)�ݲG���acm�$O�H��p8�V���F�;/g��)���Pْ{����QL���* ��� B�Ӊ���0�@�:%b��{ڊ�`Q���qC)K�-����kg�t���a��~yXQ�]Sq�@����Ӷ����Am]��^kkG���������3�.�W��tK{\$�4'jer���ҥdE.;{5� TW�(�>�]oqv����a4���0�M3G����\��Lh��2��k[�Mԥ���� 2Q���&�a����O�����=Yܓ���ɟ��!�eϚ ��9$o�����_�д8#�nBЖd.�Z��d�� ]c$Z�-�i�MR������ʛ�P^ڭr��Y$������!2�2�!ɑ]V�}� k�ћ�xH�����뷋��PōþwQ�2�oVr�<6i��p� ��L{�w�Ȁ�����hG�����`W�#�D/���ס�u�y=�HW���� 6� ��PS,z̓���ޞ9�(e#9H�nQUB�̻�@� J00�qE:�R�:�Y\��Յ.��F��ܟ���]o~�b�t�K"�b����%�J�����č��7��%xm�aU���ˤ��{�ŷ�U����bV�}��6�C��B+�Ya(�7L��]"��6Q�b��܍]:��s]=�1i1�GHhrL�"�e�ɥq�>�ɕ{G�Ǩ�@f����zɸ�lY� ��.�� ����:�S�W��~��ea N���0<���|������q�|�-�ޱX45�0H;fWm����wP�뚇��F��1|�Yl�W�㨤��~a�=�5盤XYHt�#�8����x��o��;g��t���+G���� 7��[m �g�<A��1�Г�N�0�1Z���뢲� Iblp� �х~[�i'�o���1�������"�X�>݅* KmA�"����b1S|�vޡ�a^��b���^3�+���é*���R��f<,hJ���^��*���/Iw������̉z�;�s�[6%����R:�U0�G���^ʻ� ��9 [.�鱻*1g�l<:1F l:���D8�ue�� ���?������L�7��-MЧRM:��74��Z �Η�6�$�?m +}n��s���t���5-���%���p@u$����A�#&U���p�5x�~㠥���3�`�&�WkAH��.��<��j��.O;���kC��pǡ1�^����ړ,nl7v�p�`069��kwY}� xb��,�M�ۋ5J}/)��z��c�����'{|��/U/�:H�xCd���nk�����}=�%����f�8@ ��րZ�>'boMRH�B.����OV0l�݄�K#��.J�a�^��T����x�,܍=J#שD<���:�T^��T��$�_��lܵ�`�kJD���8��N��ɝ�+P)Z��y�[{kd�Ɛ9Sք.��M�#�+d����h�d��\�2��w����=��<�5��pa2Uz����� �#��b�W���'c�l�K�!�����+Φ�q���nB�#X�>;�nK3���OSgL3�D�@��Ͽ�X(6�I�p�=ʂ����C��(��u+�~���i� �̿�w<~O#$��p��'�T,���3���W�P�`,�C=���i��*z�q�.~���b���n0:��H�%m>� �#w��HbIO���~��қ:3�)��s�&6�A<a���Y/DJ@_��uEt�a�2�2kf����wE��a�-.���O+���~��u[C���7u�(�+=�_��Z�V�"���9�ۑ_�NA@����_Ի�7�h��2}��rˠ��@�Y���3N�k�4���6�x�s7}��Et2�o;)�E����I�-�wk��~�����E�L"�N�!�Q�E�FO� +Y�}Z�10���� ����Z�%��b���-`]Vc���}:,$Ė�k�!Y��T6g��Gf�����K����ۚ���4�=�����n��~ Thv�6�S0R � xv��e�m��R�\���<9Cܠ��Ώ����] E�|��i�v3XK���oZ)�RM`��Տ%_&XY��|tTt��\�˄/i�����V��L��������>��hģ[��ᗎg���}}}p'�f���z5������k��v3����r���pG7�v ��h�Z�I�#>x�����bO'1K̮ዅ2������u��h` � �v��J��%�JԔrpT��J%�(�<�sGN%u��Å�B���F�d��|�D��^�t�c�r+e1AE��Z��\�t!*ֲ�,�l)K|��pb� q�������O���|��bz�� ��س�@; �1���tk�a��t�~%���%]OaF��AФ+'� a0���8|S�v��:��{N���d��G2$:�����e�/��r_�E��X��Mn�,�~P9�E-�1����C�b�1:�� @jϯ@���j%^^�E=۽�T�{� >�ka8f����*��"�5S[��'n &��L���2�EZ�8�8����������d�֠߭xX_�o��Lu晎���K�|(���0���u�՚���Ҵ=��x��?fz�B���c�����G��3Eb�z($�-�������^2�)Z�p}�-l��b=��t�q>�(�´"�\R�en�2�\���ZwyV`!�}"05�m���fu"�������H}"D�S<̼9\�K�m�{.�~�m`�LO�w��Μ�o�W$;�����ۏkk�����+Ή�ٚ�Ҹ�9�|��un걞��%�n���q�OAlw�`E�&�ړ̯�/aX�~���OcSX�$ũ�5���P�Y�x��vͽ~L��1�`��f)l��}��(������� '���US���ڰ����=d��� 6·�3B���������bU�:;�}��T��9�жIN1�`-��BcTl�����I�r��_i1�h?|q�w�S�1;e�f�Ӣm�M��C.�W[}o�����θ�>�I�9��hN&�&�B�M:��0��=a�D
Static task
static1
Behavioral task
behavioral1
Sample
cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae.exe
Resource
win10v2004-20240426-en
General
-
Target
cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae
-
Size
620KB
-
MD5
cec6c80c34bfd738c1d501eeed09dfef
-
SHA1
dd71e665865c8287dd5f5b7f556b525c7fad12e5
-
SHA256
cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae
-
SHA512
98fb010bf7b27fad4d2111988451b88c1b601e6d42e2c66e1e82ca31f9c16ea0b7e721eaad0feb6b952fa49e67eae4241082a1f19c2322ec1996353731f82dd9
-
SSDEEP
12288:gPJO3zCwUjT1e4eblJT9b7KEkSSJu78eN7AaP1EO9gUYeRTXHjYj6G:gUzBU/gbFXKEku78UcaP+0CeRTXDY7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae
Files
-
cd261d127b410d76262a02e66c73dca6fdb9ddbf97e9a43a10f2a1c3c8a207ae.exe windows:5 windows x86 arch:x86
22b25ab2e6f10e44680018a5c239c21b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord631
kernel32
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t345340 Size: - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t345341 Size: 608KB - Virtual size: 604KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ