%P�2Y\ ��Łԏ��7�_����fnZ�>��m�aWF��X��'�X�n��F�\����?Q���������U�� ��:���#;\{�<!��5(�3S6� Jl�!���I� vf_�?F�0�Cc#Z@װh{B힟���>8�AK6G�H3��QxP�����]����cx�-�}����F0�Q�}M*��&�.��m�l;�y�H8H�9�Έ�����t!��V��W�>�~���Z���gl'�!�]����57c�X���WI� ]�Kæ��T�^�/�����}��o;�tc���w� ��$S.�W���o����B´��Q�6a��sq(`'M�Lί�l�a}������ �${��7��\��kpBz�e������_=�3a�Ъs���C��S'�4.���W!����RP�a�1�e\��r�����%i�9����s䚝���z�R9�������#ڼ�2n"���)ר���P�`��Q@�i@/3��B���A��-��/2��p�3�7��͞w���cA�����9�f%v��O�f[��g�٨d����}�x���4nN�E��O��� �M�X�JB?���zw�B�?�F5�W�l���t�Q��*�ғF͝]��g�!Ng!U�T,b�J$���|��]��Y�b6�T�r���3�p+��� Q�*�L;�L�[X�œ1��`0�ҹ$qc+3�1��h�k����*36�O�*�3]8�"�W�4|饪�sf���H9���j�=��5�qs��H�0H4h������ΡaP��5���j�7ubA2�q�z�*��c����[��}���U-@Ѣ���h��������Q'[��lR�@u�{�|k8��_�c)����ⅫhM#��s-��v����z �.?�R�3t8�`� u ���A1~v�`&���r�b{�����%��1R|Q����� ���%5� �5���F���=�V[˝#u���i���g�\��1����f|��� lY��oBH�]���QM��(Y���|"/��3�:�iTG��jz�%�����V+;�:�%��e.:�Q��sa����e�[p��M�7uU�9��s�c�����Ʊ<v9hM���%�B���x�E�zx=Ũ?�T $,<�$j����]����:GWo��\��e�����N7nc,�7��ylR�f�賎�"ۇ�&�^%���{�%(jS�ʦ~�)�t�#Ʒ�YSC�hk����!fhu:��r��T4$M:����5�ъ����@�c�- �'��7�?�a P3��%�~�R$�������N<K�b�����Jt����㰭���0 �X���g�T�ì̯�� ^��d ��dn���\�칁]F/y��*�R��$��P>�aDd��b�Ԇ�:�N-�]V��>��Mi���*�cA>���[�|�,�C���~�FS�e����dS��0�ż�)��jBƋi�Ɩ� �-l�;k���z���+����s�s�i4�)�&�8���Db�Aui�����/W'��`��cF�ަ=D�-R0 ���� X��E�� ��y�<�b�F�R�MA�'�&(�D��Ҏmq��]�-ػ`�g���p��B{��>����k��*���'�$�"��Z�];� �z�Em{ڃ�D����3.,w:���v��p�+A�k b&h����-Q����"����9ot(�@| �`����}S�����<����m'c�(�Cز@�7|:���S�%�������j��\$�9J2��^��L���?7�$��_O�؟l̚Ԑ�2L���G�!�k�>>ĸ?����a���7���J��H���N&G��LO�ў�ׇ��^}���[�cbB��'~~��tF�(]o��r�v"p�o��7���n��5KR��h+]�N�I-� ���.�å>�� ��Jb}�~dg�>ŋ���N����{��CK/pfV����� \Z�'�K�n�/�~2X��+�ӒT��i�!2�� x^zZ���}$&l~��笪e�'��X8&���H��z7]�ҳ8�����Y#���z�f ��p�ٿ%,����躿>n���6Nρ�_�M�^���m|�1��ce�֎X�8-+�[��l�A�H.�Hڴ/�6o𭅓$���O��}�v�b���~f���3��,���7��뭻�h��#*B>^�.0�qˀ�/B��d����2RJ��c�o�!�=����2����k@�.��}.S1��[�N��]J`ok^�\��c�v��K�l���\��������[����iUVc'�c��}�vI�#Own��;����g��L%��{�P�r�{�.ŭӺ�s��0>!EU5I����}}��IߴN�^�6w@J�b��@�SӇ���J� �ƈ~NQ�x�;k��B��6����G/o���uC�gH[�R�Ly�����i"���R߫��)J����n �ps�Y���^�� �pA�궮�[���7�Hx8{�Z��mv�ɋ���H��"�TC�Пq�B��>�h&6Rz�I �LpF����T1v45.�)<V�Z�o>���|���v[��������K�n�& ����8��iY%ujBˋ;C�PR�vDt�����+@��c�^�ꡫ��%] Bl ί��mj�8̓����O �P�Dh"� b�*j�$���k���t��f��f��;S���~v��nF�t �� "X�zEN� 1�No���:�O���.��'5��� �m ���S�sd9,�]����RS��B���ݬ�M*�78/����=/��إ5����Z C'TY����x~���Q���}JR����B����םͣ�p*V:4�(�S �b������!#��9��a���B�FH�ls$p��ܟq�Q.�<������������۴��������xx���0@J��7Jsʧ1po�)n/��W��s���"��3�����;�����}�鯖S2J��m=ڊ��Z|��]�� }*\�'g��D0�Z���W���).�T��,�<��nP�@%��Q�C1CЪ����W`���UG4��AD\?�UOkh4�?hȺ#ceN[��g�M+Ӊ������ $��_��J%e
Static task
static1
Behavioral task
behavioral1
Sample
CodeFlow.zip
Resource
win10v2004-20240802-en
General
-
Target
CodeFlow.zip
-
Size
7.9MB
-
MD5
3cef3b30a17709ce307d5679dd0d5385
-
SHA1
490eb664b6e4ad4949abc3eb5cacaa73c86aa846
-
SHA256
bf58ecaf7cd42e07df95421ed9184f89acd53008d1aae732151abf50950218d1
-
SHA512
3f7add3babbf5f10028abce79b8272d539b52941bbb1d24572de40bb66ab6c6e0df9064b9a4b1d79cacc40b8a68e704608eabe1841ab5fe5bfd1fedb6276b0f4
-
SSDEEP
196608:gS2klOuSeAw3l07Um3Y7TTltoTHSAfgDBOq6vG/aWaDz6bqPyX8o3tJ:gLx807n3wTht0a+vMa1fIqPAZn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LDR.exe
Files
-
CodeFlow.zip.zip
-
LDR.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 239KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE