B����lFZ*��Xn�u��yg�>""��%��|-�5�y��w����X�kɤ�>�운�:�_4w/� j�}&-,�2�o*��+.��*r��)��n*_�Ug�-1�!n�=�6�+C��l~��B��lcn�Q��Ӧ�%�3��h�sJV�<NH����@\�,��AjJ�["�Swx�z\b7C�E�R'h�hi�Z�s�Å ���]3b�+���b��������b�i�8;M��r��}0v�<(T�Q���kjb~2�����������+Ք�]P�� t��W� ��Xn�n��.�̄����=N+a8�Wk�}b�/��$4ty�����D~#Օ&>����lF����tq9�V4���j��z������ ��Gh�*�]���N���F)N���qN,���~ա��*툠������{���u���� h�r�܅��V�X��&�q�T�*�C�9�)xm�w|��c���0�h�� >�M��>�t�I虜j+��wKM:�u�?�uC#~x%K���dB� č=@r�BXG�Q��W��V)4*%o���d̗c�G���j�0MvF�����}��JT�vE�jy����x$�b�ua"�I�0H�4��'����^�!��iR�����c�~$Z�>�ۤ���|�(�X�����Ş^��'~��9h�6�}j�f���7ɀ}@@��n�m�R�dj�5��?3��ѷ]�x��?\^F���'�>,��~���Y��y'� �ɻ8��s�s���9���C7����[�g����?��q-��'���B�2�YK��0y*;�?���P{����/ �^�قtM��~��+2���j�/�{��?;���ȳ+B�)��e���|�E�v�_����<����&���/l���$���DZ��s�X%��>vH�ʼn�L�U.p�zq�2̉�8J�U�HI\��|��%��9y��O2��f�@���͋��"�ŎV�����`\� WS�J�2�@"����N��v5������k ��MN�&.qjz :�鈬�aM��xk����$n����j�ԩc��X��m�Q�S����Q&��6�h��ԐAC���[�ը3��>�{5��9�Ji��[�:w�i.�\T����>K�* w����:�}N���7�@Rm��;`DV�E�6�g%&�� ]��cu���#�:A0iK�$�y�d�s��������^�$:�ӎY�T��M�l��(S�������Iv� ,�����p!��䫤�i!!n��"J��@��%�vs��� �Ƕ���%�M���E$�!X�\L|�q�Ac�p:�7-�(W�U2.W��>(.�t���HD�����4�L��>R��w_�#Fo}��Sr�M���4�-��������f槠D礞gy���F���[SĈ�tvA��XK�֯���N�W���:յ� �_��Ƒ��a������4���H��e��B�q�g"9���U�b�h��l#z�eQ*7�*�4x�\�8��K��9.j���C�k��?Dy� ��_*�C�z�ʜ'8���"z�m�<�P =ߩ��X��\��6�/�+u�F䴊��i��KUJ1������f�v����7 �m�O,(�������_&��⛞.�n�=���>��KQ\���cF) D��m�C�]=Rcr@*L���p=頵$�0�.���u���Fk�;U���!W%��^�ˁ�f�:���C��TNY]��y���S@���S�D�..x#�?3�1�p�F9Z3��є�b�w��8��v{_�d"f6I9�'p[�}�Gs(�����9�לV��X5����dRYƆ_TQg�<��[�>� N�A1��̵�3����v�$��%]�*���kz`��'-Bj� C�U!��Ls0����i�"���l�$1�����"���|�,�"�#@rę�X��Gg��ۉ?ހ_g}�d$����ێ�G^sGq�hR�>b*گ��F�W��Odqo�q�)���nr��6�Ъߪ�����9%�E������)ӈĊzV�Gu���b�ɚ�����������5(�ĉr�5r|H�������c}�T�W�ݓ�ɲld���{�����g(A�����Zn#h��ߣ��-�!Y�G/��� ��}k��d�D"�|KT[v�`a�S���2M!|kKl�(���i�sT�u�q6���$>vdc*EW�7{VP+"}��3 ��^��ݲ Ɗȯ�\���v�{�Sa)#�BA9s<Hӯ��H|�Vb�h�Ih<(�楇֯4�im��In��N�Rd���=�}�/䭅2��p�Q8 �c6��g)���k���w��1}R�Pt��F �-9:�;:���(ƀv���+��F�JNy�����]qF�|E,E�!�K�A��lId�UN&��Ny����J�x�B���L�e��)M*����:��fD��1Ԗ�(mi��~:��ǯ� �S"+0��i"d$����_]9��T�d��(���sYr8H�S�I�~4�0���6j�4���7��� ��D������9oV�0�&�u�C�� 2�<�E��g!�}�e�Xj�5dMΤϊ\���NI��B@���G;euo�e�C^���A��B�T'�b�3/sw ���! �����?ԃG����Y�>�uǦ���#�/8/XBc+� ��$;�ZYO?�D�ƱJ�z��+���� 0�2�nCۡPYjo��)bTP�7��¦;��DQ�g¯�K�y:_9\�X=( Z{1�M����d�1&�>�"��y�> ɲ��qN?�� �CFZ!9�`�+��N:��5y��Z��s�¶Ϟ:����o.�0��&:�;�(��NNy[�����4ڸ2Vn�_ߨ�T~U%�V��5�^�D���h�~����u����%S�c��QLΧM��"����>���~'���2�A��L�n���b��O��'���Տsw���z �_g1�� �Lk{�!e��D/66�x��7�a.L�������P�*�e�o��� ��s�l��WxF�Ť��1���?�+S>������/������,u��Ihe
Static task
static1
Behavioral task
behavioral1
Sample
c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb.exe
Resource
win10v2004-20240426-en
General
-
Target
c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb
-
Size
6.9MB
-
MD5
b8df6a1b3c94433ff11467ccd418839e
-
SHA1
2c93a5411fc0217cc33f895d2d86e50efc38bda5
-
SHA256
c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb
-
SHA512
fffd909beee2ed2927d74d435d3c0f5f14b3a54f19a7deb16b40ad26cdac205991e340e606ee311658e3a39469742ba37458528f47ddbc7cf27af6b28d159c3e
-
SSDEEP
196608:v+xuKorjIAmv8HN5UjEZFRqhlkslq4uVZHceEA:WK41vu5Uj2Rep81
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb
Files
-
c0b0f1076c31f140300947241cd6b6bebb8241fd1f0438329d6984fe85a8babb.exe windows:5 windows x86 arch:x86
abef45d47a92a6f6aa5ecc4ecce504ed
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetErrorInfo
advapi32
RegQueryValueExA
user32
GetKeyboardLayoutList
kernel32
FindClose
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
MaskBlt
version
GetFileVersionInfoSizeA
ole32
CoTaskMemFree
comctl32
ImageList_GetImageCount
urlmon
URLDownloadToFileA
shell32
SHGetMalloc
wsock32
setsockopt
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ