@���x��#�� �^�x,��y-���@K� -��}�[# 0x��v��В������1�W�P��QS,��~�y#Pt���m�10m o��9�@Zu�9?xA����W�o��H�]�H@�[��4��*��S!�c��_l�t���>������m���0>���궚���[&�Z�������o;OKs���V֢?N�F,��{�Zv#�XaӒ<刑���a�p�"�p�^0�hL�S�Vu�Kg�a�ݶ�b6!#:n��%�&�-_(y�̫{g�<5��H�Z�-��Z�7��YZ��+� A���E%xacg���u�G���fzF���� _l�.��+�!��6��ҧ�s?!�4���X�y��<"��!��Qp)�+��H�h��Y����y\g�"d�O\��V4)&vG�����L���U$I,9Hdwl�W�,�â�%�B�ض��4�A�Mhz&g��?����[z.��r���l����Ӣ�Ri7M�?�Ū@�j��8�:D�n�<Ӵ&�<�avpG�)j������y)��.<jy�uS1:��2%e��џ��n �%�k�:����$M���Ug� u�N�8�K��0�Q�Ո��� O�i����$}�Q��N��t�$��!��IU^�����?�l�nF,C��z�I�����[����;�+�H&����xy���'f��P/i��/���&�n�I&l=�Hg�[���+�����4�@c)ާ�k�"�����}��9�����p�l�%p��L��f�0�\n���h�W��� ��$���_�h���R�(��:Y���t�T��Ă7&���PC/W�RR�8�zm3\���4����ɀ"$��S����Aa�/V�:a�X� f<��}�axd/&���� �=�<�T����c��F��8��XN�ajτ,�r>Ԯ��0��ҙ j���Öil>n�S���|�ev�뱒f>Xx��r�F�)-��'s;<E�v �_FAdK�Dpf�o �sqw�e�=u�l��rp�Y�H��Cu������oU�C' Ƒܳ����Kh� 1�?J%�ֵ���|�d�+Ĩ�9+W��ӥy� �[��H�a3�✃+���$������.3�*x7&���s�d��cve�+kj��������s�و��Ǣ�Wf0���k( �A&��`C�/�����m�F��U�u'�Є���Xaz��t�w#҈�fy3Ä9��Ǖ����CqW�$�V(<���iE4.��2<r�w_\wxX���4�q��BgҐM�s�?4�Ŧ2��z�b�/��hH; ˨D'�̆��j|��U� 3vm���.fbF�7�r�q�r�⓼EP�)�2k���'^1���0��<w������Hr���7P�ߘ=���qa`�Bf%������h��54�M{�!�́�% �K�� �ԙ8���O/�ƖtB�WE�7�FX���Y�(\����fg:`ϰ�ª�d�������#�s�Ca&���f�nv\���WdJS�Y1Pe��T�o����L�hhRT5���#?3��i���%�ZX�� -@>��rS�u��+uvR=���v�]��>��i��d����`�$K����*-p������&���9I���J3��lT�Q��Oe,`��������w�왜�h�kb�[�/fJI� Q���7Lr������?{Y�#������i2�N(w�,5�f@AܐB�'�;-����p� �#�:�Ҋ�>Z���Eg������dW��M�̗VGз�=� ���o����v��zr\�����x��� a�Ŷ3wڴ/��VK&�-'g#\�U.��Mī~��>i�]�ݡ\�wTВ��������7�ҟ�����L:B/F$ ������������a*P����(b���d���lK���F��F�mWf�Wk�i�椆q����9���C��xx���V�Xq �Z���A/�Ӻ�?B,�����h:�}W�z=߈|�������R�'Xr�6JI��U��Q�Hy�j�J��He&��bq��o��2�T&�2��t0?[b(��!�� St���(��H�;�V��A���W�.;��,��x���[De;�h�������ˏ��]�=ދ�,�>bYO�?��{��Xj��w.�q�U8�i�p��?� �a���m4��X~�kOٵ�� ʷ�$�7kSY� Ѻ'Dƍ�39��!�2��E3ѨˑƷλu")ϥsd_����L��I֧'~Yn�yf#�32&������wFW�m9����,��+yr�ż����M�fµ�PvA��ڦ���oo�eWO�����[�� A@�D�̨=[�1W�9 �[�zcDrW;i���i.F���w��k+9|/�.��6J5��z�rM�)c��������+�u[�mzcw�,ơS�ϟ *�M��S��@�(Pڢp��F���_�[9���N8 �M+�BP=_ۚ����QzZc�ֿ���w���r�I�Hmppڳ���(��L&�B F4-WK��GYq����83J����H>��l �1$SHY�v:�h���zG�D$n��z�բ�!|9�i�0 �}�z"���gc�£�a��3Ĝ�d��>�۽ L��˛F�k����|���5���\����.~�vUy�=�"l��_,�v���g6'(k` ́�y�?洴�&��Nê��.B{�����c�0rZ�� ͙��6����b�8�����T�ća�%�M�����'U&:X;�=֠�| -E|�B�B�n� 4"C�?�I�lj����q�Ǩʥ��x�,k�+�PC&z!^[�4cx�K¸����A��*�]�-���i;=�2�1Њ�(S��;i����ͧ�Mٯ��F�c|j�~Z��a�D�I w��u6$I1�ԯ��;.����z�'���Wx�~��m��1�O�� �T�Rꖺ?A4�$=�fʺ�vLñ'��}���E�j�p���r٧�#4���]<��g\�Ь#���*z�"z�t�;�c��X�(2��y� fL�M��C���-���4��b�N��Հ-���*dG[d�xͿ,k���Tc�A$2z��G��,Z��4�z�T%��Z�ʗ���L7�{y�~걿�{�� �S�A��O��Lb��������{YÞ, �X����w�4��H `�tO����Y��_FF�l��5G[0釰S����h��>$J�8ϫ-���yΙ�Г��H��#��T�l�PE���4A"�gd�
Static task
static1
Behavioral task
behavioral1
Sample
cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b.exe
Resource
win10v2004-20240802-en
General
-
Target
cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b
-
Size
3.1MB
-
MD5
414dd244982a2a9e63a666a341ab900f
-
SHA1
bcbcf2528feeb1ea43df073a02b8efed7fa23762
-
SHA256
cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b
-
SHA512
e89d3b42a1275e40dfbf6f38866c7f1ccdb6e120e8e092b72722e5771ca856c20ad808e3e31db5f0decc8b44528b7b8c3a85484238215de06b99d63e7a32bcce
-
SSDEEP
98304:FojFzD+wcqaiaQIu90C18qfXCaugOoX7auzp3D6upNCwZU:FhCGFaS/oX7aKeupNCIU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b
Files
-
cb2d1452cfdef76fec423a6374ea558ef445c8e684089d4cb2fb8ed8a0cc8b0b.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 83KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE