ҝ3��PMh|}' 8�u�����C�\���_GB�i����@��(������tŕ�MXJ~֞� /�����1�|�������m|��b,� ��)\�_�$q5J!q��S����[c�G���R՝k��RHu��6k�����yv�P��1*��CaP�6��W���%)�*�&�q�i8�o.���u�:�|������x\b�j,����]�eg{[��1�9�Uӝ��M�����������O����YM.�&�o�+���.b���``η!��2�2"ʛ���i����ͬ�=�S���<�C_��2^K��f�x:.v�1(�:�nRE��N�*�s���S���2ɵ2�)�8�g���O�0_d�6x�w�O����E�^~����g��&�6w�Gm������<�X�1� �g�9���3}�!�� ���ϯ�j�@T8�hM�~�>%�1�%+� >�V��ђ8��.� Z��ߘ�l�����=����,�J��n3]$��� @�"Ìk�A���8ވȇ�Eσ�Nl3�Zr�_�k|��TQE�R����S�xóMA ���حg�;����P�� ��]�����ᮙY��9�j�#w�iҏU��������%��uW~��ԃ4q�mR#��n�n;"mTӂ�ʸ���'�����^���Z�#�����GՍ�&�?r�4�� =���{m��*�s��$Jn2߅oc;M���/�_�$�����}Ϗ�&��ŌN��6}"�{y�uf�4��ti�7��.��P�HI%Mr{{�sj�v���eu#U�38�Gb����#x����+�R KBB�� ��t&�����x�@8�>3@lFfJ�na�N /��_ #}HLj�]Hv��F�@� �s�����&�?�����=���r�n��D�yo<��g�z��8������v���Ү�,+_�Yi��� XJ�f#���{��ߦ���b"9�+)���1}�O��$y��ٝ�Qu��SH��Y�鵉g�b��p��3�Em�!��t�}�������2�{�����Ĩ�>����D�<��\���N�+b�n�-�S�E5��*j&ĂX������a���m�ި�2����B��d��R!�����ۗ�O�J�����6��H��¸�76�(��XS��>)a|qj����!��: ��cSsS$�82i�3���O�+�D�ѨT�������=o��v~����B��^v�����9������h����*i��9h�.\{��@��I`�����~q�Q�C ?k��� ��n�.���אD��x��m�)�����[�� i/�����"���H�-�y)Rv8�>�����9ٵb���w� ��1�$�љآS M+����E �}{��.���L�3��n��-�w ^���4,���/�>��|-�B�T��~�k��^@�~�}O����G�~�/s揘� 1�=�<�Ds��z�!�~<2V���N���u��1��轁�y��5<ZeATۙͅ��ӏ�ڔ�������{��7� �C��ȱ �,��brh��m���S�J���2���z �>��>���#�,�o&'T���r��vØpX���*��3��s�V�S��h=3X�x�}3or�����F��q�_�9�#-AkR�������¥�es�b(+ �wq�q/4d+���8W�����IŜ�� �:+�#.����4[���������Y��ޜ''��~����hv�� ��ꂾV����!��T�H�2����5�Hߣ /2 ����HV��֪�F��g�v���ӞIg��Vgk�%/��;cݐ�3kԍ�?�U+cW.�K�*��bu�o��Pe{Ƈln�Mu ��'�vp�� #��$+�0pj��` ������b��07�/=�ʹ�{I������V#��}��jӺ �$T��ˮМOs��U]��F� �r��xA�Wt��>e���,���/�ȓW���X���0���WB�@��U{L@#A)�f��3 �>M����w��ϼ F��JjL k�tO#��_����xmU�.������y|��+g�X��Nj��<Vp�b7M �[���1����B��EZ���7,A�էĈ5�����s��A��&q��k����K���c�aRv;]��}��f����N����6������>1��c�)c���?F�� ��U���G�G�F�^!�A㓥�Sz�e��^�� ���@�8��z�3��.�>{����+��D�9{�K�O��@�7y�{2�KV�P�^*s-"TL��[�o���T����'��B����F��Tm%*2/M@08nֶB�;��=��5G�� ߌ<�i�o��/.Ĉt5ȑo��JPǓ��#�%����E鹨bG��.!ѷ����v[pw/��L<����H�7�[�o�㼠<�a�F� |���tS=��@{�d���:�zC7�#��l�U+ [�jGNz���6�0�DI]_��+A~g�_1�c�R�X�Y����4�2�ٛ>����,�@���T=�L�)� Y����?��uT����a�28��G����M��h?��r�ne,Z�c����/��8��VhN�?�S��k��g3sg~6Lr�x��C^�2����yp�uki�W%�n�Y�Y��A��_yr�'V���*�$�;��Vp��S&_���� f94B~>����� ���qK��%y���L�_)�����G4��v�mbĒ�8U`�y��������^ =h����{�����J��W[��}�`4P��1�W���@Tah�UmS�K@��a�XpW&Փw%QׄZ�7���⒖M��99)��9 }��'�u�������#�]L��]yUS�V�刢�ն���m�D�!{�U��J�%�͑dp���E�ZY�j=<����Y�߿tۆ_)���(å!�����d�X�eX�;�뜸$ȯ��u�.�3��jd2������%�<����w�y���BA5��J�� ,�UK@�;�����;�������f��l���X���~��s-Ȓ;Fg�>q��fC�]�;��!H
Static task
static1
Behavioral task
behavioral1
Sample
cadadcb6719598366e960f31a319a480N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cadadcb6719598366e960f31a319a480N.exe
Resource
win10v2004-20240802-en
General
-
Target
cadadcb6719598366e960f31a319a480N.exe
-
Size
840KB
-
MD5
cadadcb6719598366e960f31a319a480
-
SHA1
1d375b97d4d49443e71d68b9d65da8f465c36d3f
-
SHA256
2afbf92c4db6bbac81cbb782580a4c654d365ce4b8615aadb1bd17adebdcd5bc
-
SHA512
3c0379fd23d2ea32f1021f36e08517184515ed105c44540c038fd728f125ed7e35d8223fbff020fcb13cb08504874975c631e0fa9cd54bb77eb28ddf8f6edbd9
-
SSDEEP
24576:v1X3HJwXxPGxIR1ac5Irybw0UoBHgyzMZ97QNbHeR:vJ3HGXx+xIR1ac5I2w017MDyDeR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cadadcb6719598366e960f31a319a480N.exe
Files
-
cadadcb6719598366e960f31a319a480N.exe.exe windows:4 windows x86 arch:x86
465d275e8479373f2ec0fd075e9ede56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
TlsSetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
advapi32
OpenServiceA
oleaut32
VariantCopy
version
GetFileVersionInfoSizeA
gdi32
SetPixel
comctl32
ImageList_DragShowNolock
shell32
ShellExecuteA
wininet
InternetOpenA
ws2_32
gethostname
winmm
waveInAddBuffer
msvfw32
DrawDibOpen
wsock32
gethostname
Exports
Exports
Sections
CODE Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lki0 Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lki1 Size: - Virtual size: 375KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.lki2 Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ