.QM��1֥���t�p�z?/��_������~�# 0D-O ��~�|��9��'��6����w��"�i��Y5���?i6,%�n$,0��r����W�b��ܚ#��ZIE��Xd���� )њ� X\UO�O����)��� �7����ö}��<3�?@OE6'v�L�z������,y}=W��u����* TE�j��L�l��Y����=�`��= ύ�-���Е|��t\1�g1����xQ�ZS 0�ywD ����}#S0nGaC���_��sMD�0�:�oE8���|(c���4�����ė��!����Ė�?B:��}�����PK��&�����NJ0*��FDN�Z�0�cuJ���1�����w�t�vC���M�JP{1�6bWV����¹���E�/^h�8d�67��E� z�q��������� m��N�Jܘ�.�:$�_%��i���G��%����pD�!*��UӁ�V���7�X/y�t��*��S��*L�vFÉ�^�Ԡ�=.4@蚲u:�dz2{��=O\Q�� �`��R׆X���`�]�dΛ�f��\��� ��_'/�[ɼl�aVwS�Ƥ]�"L!���kr��s�!�m��du���*:T*624��<>��L����'x�WI�9�� ���U��^ء�I�L_���<�d�1���i�H�R����A�����Je���a��t�GƤ=�n��_SF�q�R!�svp<���r�����f����P)��Y�4�9��� ��^��U����}��K/c���Գy����3���*�V�*��C��@�!;W2]>��ן�Tn�s���<\�PJ���pP�\�o�nL6�&���k���b�t2=�E�\r��I��v��d�C"�J�����a���^��@��������S�e����|^��1�X���L����5�oyu�'���l�(C����.댁����I%�K�oV�-�B�d��2�D���� x�_ \��ޱ��]�o89 =˾�{9� �/����v6#N��v�B�a@)ٚ�T�ڛ���?}�� �C-�\а/���I%K�u�X3�g�Ⱥq�؟O�O�^UZIG;�� ����t/��0��M$d;�%q���DQ�:a���+���������L�]s�����[9�Ė[&:IojH� ��'jMXr�P�����ٵ����e�����jNw9�T�ؙ>��n�Y*���AF]Uno���-��:ɋ�s�a���~���Xm�^�j�˃�zC�g��#��RN����2����N��P�� 6X�l}��oO�;�i����H�"�h{���UBA����Z���<���0"�%:N��6���3�U!��+`%.�r&�c�8F`�� ��p�� ������L��X���gf A7L�h�m��g�s��5���s~�*���?Y���#���@"���k��n�-(xÅ�����]smRä�g�{ �����1Y���L"Q�=@s�,�%4/P�g����Ί�]g��e�����ޅ�}Bk-����� ғ����7$�L��������L48�ŧ����<:��^�~9\�24�,C���q@R�����I��x��fބ.n�Xf~�`C�ߛ-٘��`�!t@�[B��VZ^���I��� ���i�d�[�8�$=����8V"�������Tv�z��>8���{�σ��.�9<�� R�{tq�v!rYl2��%9�g��x�'�[Ț�[�OiN~`L��� pqm�8�S�1L�e�T�3:�����q���C}O�H��8�|S~��6�NJ���>1yE� iI��E�d��EF5��DG�s�N�t�m ���C�r���۸I�k���Ryy�>$�����FW��ӝ�O,p�t�wna�Q��ݳ���*� zc�+����v�-}����wO��T�J��� [/�m��iz�vR����Nֈ+n_�*Q�.t�~��-e�}����-��9�a�&������SuO����C4��e�%!���b�v�B��&�S0 `�Y}J�h�d r�os�1bqWik��B�:�����Q��� ɫ��Yׇƹ��m���ꐼlz/+<�(/��fE��V����*W��㹖��@&�L)����P�6�~�\�1�����1�n���:���K���@���h>3�.�Ͻ��]�Z�!W��A����g�] 7��K�zA�9�8�&P�Z���Q��9.�x�5�����)2�7,�[5J���A+ba>������c�oPH:(��ؔ ��{h�r�=y`_=�����^S%沤��mԶ��� $h���_9������T=�h.3ܿ��*�`�p*�>3� ��Z���O �0C�p��%���u�a���ݺ�ދ���i���L�D� �m�6C� D|Y�#�c����4�tLfb�}E�tuIS����P��g���]&���QO�ڻ��1�v�FR�o�GA��"Ёg�Hu� Mf����X�M����@R �$�{�/5�?��8V��1��7���3S��K�m���<���U���M^�̂���8E�߭熽�S�K]��#���xN.�ȝ�R������i'�j1��ZR��& �mA�x�E�"�KP [#hC��u�sva���,N���Y���E���ر��$��^�4� �ΠŔ�i&as�����M�b�s�Zn�_\�^~}4��i�1�S������F���|�v���@���Kt����m�Q���D�����EL��<�~P#6�$C5D/�W���·r��7����h���9�J����?��ژ�[@HH����U��c-���^�5�2 u��;U)���e�Pl��)y��t���)�+����o����u[l8%����(0anu�C qN3��Vͱ�+)���M�'qP��"��OLJ�f���($ �{1����L�";$�ޙ�n�5��K;֘�Z%��2���6��X���d����ٺkJl�GN DmFΣ,�8������/�9�<T�qj� rYK#J[ F��B1
Behavioral task
behavioral1
Sample
cedce240ad68a3844d4691cca62c3360N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cedce240ad68a3844d4691cca62c3360N.exe
Resource
win10v2004-20240802-en
General
-
Target
cedce240ad68a3844d4691cca62c3360N.exe
-
Size
4.8MB
-
MD5
cedce240ad68a3844d4691cca62c3360
-
SHA1
c071f14b1d59c370351a2a95b1781d0431183749
-
SHA256
539a22672d03e41a455f99d3bbcddb4f0f8174323aea595e445ca0f94240d546
-
SHA512
2639866d400052a9014426207a762d15f611671ec8cff36ff961557b2d789dd82a58d566f3b5c88c274658d0fb8022e439282643eabe296026329a422c75384b
-
SSDEEP
98304:MBxLDLXY2958jx+fsP3aHbK0cc4E+ib+WA4WWG7+42Y2rU80Q9ZeNgNuv:S3Y2958gECW0hbb+W7Fl4SA8DK7
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cedce240ad68a3844d4691cca62c3360N.exe
Files
-
cedce240ad68a3844d4691cca62c3360N.exe.exe windows:4 windows x86 arch:x86
200a4b21e5908d784fcce06399b45a54
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDiskFreeSpaceA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetTimer
MessageBoxA
advapi32
RegCloseKey
oleaut32
VariantCopy
version
GetFileVersionInfoA
gdi32
CreatePalette
ole32
CoGetClassObject
comctl32
ImageList_ReplaceIcon
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ