�{���_ \������Ya��* m(�̬��Hdž���Y�����uklTR���?��w�����my� _��l�ѓ�=�����^��+\�$��_!K[( w��l��qf������Z�� �dO��I�C�iyFl�x~��-}p������sܔ/.���nrE��w�[ ��t��EX'�����k<����eQѲҾ�Ҝ"q�������$3j�o����EȻՅԻ�4�-܌�H�~�m�Uh��4��^rxA�"xBH�-Dò� C����?�w����������J�3���t�y+������tZ��K]'��|^��i��`,�H�}ҧ�a~<V����>S����?�)��Y�Ǥ���C#���w���Z����.��j�V��Plۥi���3�����Rh�Bb �.�"~���$�Q&Ƙ�tz��<�D���^�ԩ|̻��>m���6a�S�hU=$�4��~jN�y����VQo�Ł�O�͎�E]w�P��jT�)%�}l&��`b����=����پ���O�T��'{��m��>�??��*��i@o�@��U/��FS�~nv*&��|��s��vs�lS{�N�cqݳz��4O�j��$�\ (D�����u��R�����Y�$���%uw2(ׂ�Tl,6�cj�� ���e�Gp�lbll����Rڎ�o)K͍�G�B鸸���H�Li�D�Ap5�1������B�f �he����:��=�qF���,z,K����g��p�_'�_L�R.��3�eޙ<��xy^I�C�0�Bb��dA7�\�O�"� �L�A5����v،> ��v�L=��ÉuG4��W-�Es>|�#�V!��H�~er�m*�EQ�!��=��?Y e�Tg=�0�����Y�Xs�[mv���1���g�������>i����;%/b�ůl ����ſ�{�v2����L_S�Ij�Z�K4vW��^�d&��j���$��7)����!�y+�8�9�m[m�l�e��F?% P��[��87����r�m����%�����z�F�x� D���rc8�_��Q�b�Z5*_�����EX�O^�|�,��m~Qv�_`���pgE����Dz�k�����w��l�a�ݜY�}�(���͑��n#��DQ��w"�h<P&F�53���`ʔJ���Ժ(���Bn60�����vl�PS�>����~14ҧr�&B�)e|j����Z0ӱ1L�8��!�x��͊K�>��j���>�����'�C����Q��&Aھ/xr��/�r��d̅�'Qצ7ܼ*>���1@��Z����Qx�Tg���<�h&�9V�ski�K&�ݥ>��4v�0W����H-#�����l0@��8����n��y����0RaԼn���u*�0�����\�M+(N�S.���\P�����^)������Y�� -��銜X��d� �V�֗!z��d���6��G�I�����в�����g.M�::���m�N�G�kv�"H��+�-�7���ΐpG����|�����3�?WJl����H�^U!�x^ب��O�|�Sd�����1��� �� H�50r�Y�L��Rz�pv�cK���sY �g�����JU�1/bџ�A��r�^��|(��{CG�s�~Y*�=I������0n���F���+�Ll��f�[�01���o��vw��b�R:��ue�H���p����<��N���E��]1�Q7e�Nt��&Ƨ�-䦘�h���������M7��z*�!�O�S5�������S���ԟ�(���ȸ�d]q'�j��^��%����JN4����딑�^�~���0r%��� Ҁ�/���JK������ϡ�EP�~�E�C�~َ�D��.�U�@��*���� ��e���K�(5��Ƈ�~����0ԍN4����D��Vă�7�8�~Q�v��vZ�g�L�-34��r�J�4�"%��:qo ���l���{xj�U�Gx�SG?!3W��b*1���Vһ[A�����)a����iF#0I��W7���I���5.�2�_�a�� � �!s&i��:pA�FW}�� (HMg��R��ēD�b���[>���'��\�3�x9�������� ����ο}�\Y#�n$�^�ib��* `>19�>ΦK n�O-�oL�`��9x��h��1��S��}��.>�S�O�t@/L ��̝��;���|���ײ�����p��h�S<$|�|��q��ELwS~�)�85 �g�/��>7�7S�'�gTB��3i�9p���� �Φ ��A �RMO<��`,���FzKr¹��Q��c��s�b�߮=rc�L�TȀY��5��e]���50}A���t��g����''p6�YJ�kX��7����V�~T �~W�^�L���r��!�M��m2��+�4�Β�d��Ls�����I=�K� o*$u� ��������Z�pצ����;K$cj�J�B@�y��+��g=Y��fMB6�u+6�����z)�]7(�7��n���F~4Z���J��bF"����W9?_�:�R��w��Ob`N8,��Ţt`���$x�E��=��>���&/b�����v�K�_�E��su ����%:5����o��nQ�W��Y��g='�g�ن��o��u�V�v�bc�@i��� �rh�6� �1 h)�.H�p�ǿc�����_��������~�$=X�Z�k��0�^���3`�4*�]���ӿ� ��L�S\���[�ޥ5f�c��;B��&w�g�")��J���&��n�糃6�,-�%�̣��[�aͯ�i,`ϸ�� B�E�����A��H�7L�`)��|߸�(DпV�~�5|�i8Kfa�+|�/�Wr-50��R���)+Zi�+PP%� :�^�ƽ�)*�Z��1^b^ XC��Ke�u�=1��'{_I]|]�[���e��2=\�ggYתvrFzB*7�Y��#��4�C��; ��O�ʨ{"iZ�x���oa s��z�vN��ؑ�-=^- �p��X�㺴.�
Static task
static1
Behavioral task
behavioral1
Sample
FordAllinOne32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FordAllinOne32.exe
Resource
win10v2004-20240802-en
General
-
Target
FordAllinOne32.exe
-
Size
14.6MB
-
MD5
d59ec546a58ba8242116768f514096be
-
SHA1
6e1dbb7b06de5a0cdc244794aa2fdf2baa62b7ea
-
SHA256
9807e2c038e9bf7d63337b8079e6b2a925cfbec36850d3a817cca43319c1b13d
-
SHA512
efc39e01096a4ee2f6bb3a835281d78c023b8a5a17159f252f49458ac6c7cd6244c0f00212cc4b88dc34acc21890723e24e041a85c0178d70894812f82bfb786
-
SSDEEP
393216:KuO5qp4c3O0gwmYvW4r3AyAD3O/y0hg8RLFtrS/5:J3Osmt4OTOm81FtSB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FordAllinOne32.exe
Files
-
FordAllinOne32.exe.exe windows:5 windows x86 arch:x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Exports
Exports
Sections
Size: 1.1MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 13.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lfpxwdro Size: 13.4MB - Virtual size: 13.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lwimsdtd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE