�,��w�ZQ[���(���Ϩiۜ �v�)J�<�5�"E���Z����T���[���?ˍ=��U�:=�s����.qgA����j��L���X:���!������uj�O�R�[���/J�C�vO�{��_����{B�|Ũ�w6 (�2��6Г^��Al��f���4�� <�s"�y�1� �HK��^ց:j�m�T=M%$���p`�PIy7oi�n����=l$|���d�A��x�|O+����KG�֊<b.qt%��趻��ec��fj�P>���0��#���І��<&D8���٨��B<|�8帿}㏸W�!�P&�1'bL�Pp�����0JG("��D`�2��J��"f_#F���ۆ$'�ƅ�,�j&�CZN�"����M@�����I|e{���́�����.m�a��0�c{km!|�Ț�K�H8dLo�b�Sdj^uh�oG�\p���E`���=�(�솨�U�^��"�%�,� �2��!s�9@S�;���k�x{ "Ȥ�q%��|]p�W����u@�cY�^!�\���_��Z6�|���������fEŗ���ʷ��x=����_��X=xWO(MlT%�У <1�XV��Ćeu�c�$BF�ā%t��5R���y�^���oE)L�P���|T���lDc�_�?��tJ��@����z0����Kd�b�q�u3�jc�,������?��rˋ�?@(o7Ű w֤N�&��ܨ��WB�PS��̥�����e1t���S|��Z�������`�_/2���5Qd��TRy˅m�P�8v��Xm;���~���r�&�W=����폲�KjY��Fac?]��X����;�H���5�����"��3[�*�[�p�|�����zA�����T���Eu�C"���̟) E�c>ŶQkaة�X�=�a�eB�M߁�[s�g�2Il� 87��d�L�:�7����R�S]�����~Zײ���ӿ�x��a Z(L��'Ei�>\s�*sHsa���{�X�=K.��I䙌n�dռ!nF���I���T�������$m�����"��U�����~j��h�ds��sI+�f$VM�b ڛ}B��$�x���6�C�Uo�<���-������/�}�1�f a&����>5B+Olϲ��(���z(�g���W����h6֞ޤeu��(�<���C�W;��1?�Kmn��x]@?�{�Vu���s��Q��|�w���T�Y����p��P) ��8M�Ear�I����m0�'�1J��9�Y�J�"8/I1D��Xr0���J8�� )[��=��j�si�=�w�I����T��{ؼ�U��Y^�Ieu�ZM1�=/Z�Q&9�5�a��űl��|��H�Ig����)DsJW�Xl+�>Pk��<�sd�g�@�`;_\`� ��Ő%�B0���C��8�շ��;գufM|�G\I3��$ ��~uf8X���V���&�����Z=圵��Ut�1�.t�p�O�x�qLK�N�6���/;>���`�햾0r�� �����~=Y$�+I �p��E[h� �:`�L���\ÆrAw��H��jeE�p�$i�Joq�V�������_Y����v�+�1�2�L(��"�|K� fFc6��8.vI���G��ѐ�9����j1�o @���|ga��偌6:�x����6o�����d�]�s�I���Ei��yTd0Z��YG�������O�1�8��" �ͥ�y'O��ܰ�Z�̝����9��mUds&�s��sP�^�!�0�\���T#�dZ�L�"��Eii�p�"��M0�7���8�����g�����ݮ\�~� �{�kƑ���HpU,�B�f(�a�|t������l�8�4�"�� �M�7~v;|ͭAy��廒 ���HƁ9���\�� o MC��CUdl9��������r�����t4x�3���SG~�C���������M��pA:. ��to��(�_b-��Rc����`�Q H�I��b](� l�C%�����W�="�OQ�C4�"�1�%�:���8�^�;\�XF�ƨ1'$���|st,�ܺA�0^�̯�t��͈!4fJ�3�ݞ�(=�&�t�z���������\F��n ��m���3 (��?����0�bE9��k��t0,���ۜ�D�2��tϨ�XP�x��Fb�7K�����[F #2�ݙ�/C�:�f�(�:�O�/���]Z� V��� �� 0֛f���ȩU�qg�oD���NK����� ����3��V �>Y�� (��~ve�k�ܸ���� 7�ʱ�-�BG(��/9�@h�Ӿ�=��si�~��V�؛�.��CҸ�Qf���e{�I�#��!K���A�O����3T^�?,��A�~��=1�>(7J�{MD��(>y ���אh�C�&�"�`t%�Gw�O��8L~�Yb�<&�8�.u!e_��AG��+���{���Vԃ2��V�q�j;�&=M���w��ТNֲ�JW;�"����'�ñ~(AR'-w�t�B &e�|�\���)���Zڇ3�R�N@ۮ������������q1�������@�/c I���������ƝP\.U6��z�ϩ3��[�-���edlB�"�R1��jv��ns��h��n1h���5��dAx�'�f��X3Mѷ�j�#�ܻ���f'#.�s�����#ܠ�w*�O�R���G.�d6��o��I4^��4�g^Z\ ���d��.�{���./��@]LW����)�XwH�aC�ȥ�Y�g��,�N������6�R�@Kt% o@�}.�>� ����<����z�c�Ô�B����j��Hݛ�z���x_�����",�ǝmr�?�ci%H�Q�hR��p 6�rY��z�%F.~�kl�uj{�*Ո�2��V��(R@���<�S�j�a2C�Qx����/S�~���=m@�Q�rA&��P��ʐɯ.O �ex�co�����ŕ��G��4Q�>�&��� [����j�t�oR�/�o��U��m���K�^�PR� _��۔��wv��[j�6cNs���H�C�Tc^|&&]�7hx.*e� � �3~�퇞�q-uw�S��[��F�|c~���_�{���mŢ�Ӝ�z�}���4Z,�כ���O$�Tx�Wf"���j��s��V��i�φ���ȯ� 2����ve�7��;lߗ{hIs%>K��a\�L�@�/ջ�v�i�X�T��%N�ʁ^�$�o���cf-:�X(��1mޝ�/����{��%��N_R��f�=�+ゎD��5�]��$��\pP����!�ϸR���.SQ%E�H����Q����7��z�[��|O�[�v� ��M��.��u��=*[�M��/o֝Nt1���j�ް�o�ѓ版�)@�\ 8�>��Z��9����斒�GGL���{��<ӗ����yV5�N�)@!�8������3G�Бs$���(Ʒ�0����� ����5E�C�/�^�8��쭫3G!�1w�P�)j5t1��� C�=��8_��Q�~tݓ�:���GS�ѻ�_��������5��[Tsr���#G�s���QLkp���U�3�2��(eQgNnƢ��,�F��f΄���`��F7�U0b�4c��M;�nbh�<XKS� �[<}UPR5얬O�Y��ww�V�N�m�k�k���|,۠�����}_��%���P���p=�*��3-��;�2�<v�p5��_q^�g�8��v
Static task
static1
Behavioral task
behavioral1
Sample
ddfca16b28833155b8e2f6ab26a0fd47334cf55e3f9cdd9230a0c6052b47ba42.exe
Resource
win7-20240508-en
General
-
Target
ddfca16b28833155b8e2f6ab26a0fd47334cf55e3f9cdd9230a0c6052b47ba42
-
Size
3.0MB
-
MD5
9e12a5d99dad57a15173586dcecc22e8
-
SHA1
7838bb947f78e15261e9d806fed15ff815f67e97
-
SHA256
ddfca16b28833155b8e2f6ab26a0fd47334cf55e3f9cdd9230a0c6052b47ba42
-
SHA512
53675f54cfcf12fe34b56f475f23f8bbf75f4d45ee7077b317d2411b4192faed02ef16cc766eb1abc84d663782ccffbc0fb99d31c0188d970e042b93620c739a
-
SSDEEP
98304:oC13DeV5fqtAQ2jCd0ME+stUTjjaRYt/W206cW:/1zcfqtAIE5tIgH2hc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ddfca16b28833155b8e2f6ab26a0fd47334cf55e3f9cdd9230a0c6052b47ba42
Files
-
ddfca16b28833155b8e2f6ab26a0fd47334cf55e3f9cdd9230a0c6052b47ba42.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE