�M��?�"�"c���X; ^d&a�9c��3���'�qN��]p�P/�J�e�=/B:��;�����@C����O֮�6D�.5��i��Q�١4G��Ȗg��N�T�'�o��fl�Q�l�Dž�!�q=镒����� o�˸�].�.:��R}#�%o�<W��hI���n����F6s#�'�HR.�M���s ��i �_*8�& �B$�"��ۚ�rz��61Qs�ZF�(_��L�`��>4��)�J����%�}��o<�<]�G�7Q3��b�wzl����X_&������BXӉ��J�C��>�R��˞l�n�� x�"��zF�&��Z��.����Cj(D�Q����=r�n_n������U%kҐN�G��_�=�@�n�o7�L���/�"3!���bB�����Y�S����bۃ�J��/�z��:��Zu 8:ߕ7��~_C�]��ܽ#�&�����Kͬ�|0���?h�+D�C�&K������̈́j� G��`7_j��gh9[I��\2J���l;@U�/���3�h����B������p+�I�����IO����m#�"N�f��CKc����Q3�R���N�H�o]��t�Dq�)�|�*�40����ETT��R��W�M��.i�[�$���� ���|dq�����H�<� !�8�}W�Vk֟�-Z����o� 2!��+�.��OIos8U���i-R��iį�w1נ# FRcfp�LA ���E*A1.D���W�ƿ����t��QwrU�%@v(?���M�ND��}�\�����e��A�)!5zݎ�!�v� ���e��'VK` KDƳ�5�q��u��)[}-�$b[���}�&���r���~�j�V0�@�����J��( Ši��LJy�O݅��y�����*�����Q��hYg}�?�G������}��Y�Ne�b�v�By����ʲf',�NTI>Z��W=����L�S�Y��&I-�!���|��������, �W��AJ��K:�FPnsVi ���zj���Gp�;����"x8��'��Ͻ�O'��*owZ��۱��?ai1 {����Z�x���[c̥����y�����;�QmL�[rU��dVk���4��(I+UI$�F���q�8�tT��Z�x%���y��h%�:Bv��ݬ�)�Z�Ϭ�Fi�K�XM�� (�1�|t�F������{v&.��FUTz����Е�1����G��WP��M�r�}2���X��X�6��"{�ѣk����+�\�+jW��4��k\o�:p� ��=�rZ��s?�����b@qߡ6�#`�`�o�=�m̮�V�|Gh��~J��H������;I"��v�T>�N����ɕ�� �2Ϲ�U��}6.8�3P����|99ٕB2��TBb�=�9� �M��R��\3=:�������8����������!��A֥���K�>���GM��d$��]p��ߨ��R��~E�8yǃ���[���pu����ޣX�3V/��5�d��B@{����������{�Af��� D^҅���]��Ȓ����q���.ݮT��Ob��X6�w&T�(��S()� �x���b��( �q��4F�Z�����5�ْ���B�]�v��}8���6�5I��K-��%�mtv�]����ؾ��'8���P����E�$�̿�C�q�;\��c� p��;�@?x����n�.�B�� nV ji w�䗁g�dB}I��U���-�+v;Y��8����g�� I�g~@�iE>�T�_��U#��yء�mjЫ����٭����j�' ���11y"T](s$F�=d�����5�eUa]jOə7��'[iCb�!���}�f���Z�'�/�j���o��� ���n�gT��9]3�)��Է����ce�-�/� `��&ɹ��Su��W�yy����R���Y$�M� )*�cдߊ7�`�@���%A _ e%�W$f��ay<��<T���ٷ!�VO7��]]4��E�sv�.�J�&].�M�(�z����c�-�'�]��U�O��[BD� M�w@�;PU�m�bddž`��x��4#���3�"#�9N��&������ B���R *�3Hʹ$4����Z��T��.,*��2�������tI�8��'�y�\�E��������Z E@M]`��f�C���M�jZ$C�r5� �����ob솩nՆX�^hA9=�!����A�}A��v�>������ȿ�V!]�sg�(P@V<�6�v���� ���e&��#m�>t^4CjER�S�.�O!a ߰k��w�2�w )J�gX� \�]���j1�SIB���� �S��Xj��T��#�~K6�z��M(����naZ,����X�Z�)�&H'xBJ�`��(w=���J�ӌ.�O��u���q����k��%�pp��RF��,�%��vO�8��£��N��blw�3t���s^ ��a�z�[30��X5��}�O��S����<?���U������QV�MZ+]S#+7FbLJ}��$�bF����[mI{�!΅��T�����K*��Q������c����m�y$�/� ��%Ӹ�@M:x/���d���' �'8j��r d�}]$^ ��܄������q�9�p0��"^r�X��~��/�� f�N�;�8�{uQI�=&���NSq'H�4�u'e?x�3�M�U���t䵶~0Fn��cD����_����j�DMC�sS�����#{��O�w[�����3�Ng�ߗ:�GE=B[�(����|V�1�F%j�*�w2;���q^o��.k�-t��bQ.xO�Z�x[�|b�p����ء_$м�2X�]l�S�����RZ����>������U�©�B؍[��.���������-��l��0��PAb���N0a�8Y��^:�)xɴ�7��Jh�7w�}�NO��G�I~&�N�uu \Ȥ@����Z�|�?M�B����9�����/g��>m��+ff6t��� �^��@�EW*��tU�.8D���M�Ҵ?<*�^fϞ�߶{�y�3ʛ
Static task
static1
Behavioral task
behavioral1
Sample
8cf5e3345bf561051e8e.exe
Resource
win10v2004-20240508-en
General
-
Target
8cf5e3345bf561051e8e.exe
-
Size
8.2MB
-
MD5
24bd829270fd34ab9a01b09fc901e9db
-
SHA1
64a250ba6e075c1eaea4b6de6ff0a8ccd26abed7
-
SHA256
f26c1730d301cf3484dc4e3ee832adaacf32ea8595319ad752fa44b8c6f0d4d4
-
SHA512
280b616ee4133b91654d62f0f0683b82bdd0570e0590574e76ee53e9dd5cbbd2444486442257b6ac798f19d1a3b36b16d70ef3e8397f958ebcf5b95f7cbbbda2
-
SSDEEP
196608:oxQ6belzBe/N8BOYkh9hZP9BBT4Q5IMGEygDAQcH+JU5mQalD:oxbexBe/NqO9DBT4RM5lcH+JU5k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cf5e3345bf561051e8e.exe
Files
-
8cf5e3345bf561051e8e.exe.exe windows:6 windows x64 arch:x64
99cb03f4a5e10a0aad5cdf0b469aeb7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtClose
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
LookupAccountSidW
user32
AdjustWindowRectEx
CharUpperBuffW
d3d9
Direct3DCreate9
shell32
ShellExecuteA
secur32
AcquireCredentialsHandleW
ws2_32
WSACleanup
bcrypt
BCryptCloseAlgorithmProvider
gdi32
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
Exports
Exports
Sections
.text Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.limport Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stub Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.\.P Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>x2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?rc Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ