W��34��f�wt'�>~� �|/�R�J�:7W��SJ��|3�/ӓ� Ai��BWNJ�h�)���I�4B<��" n?��i�Q�՟Ȧ�ĥ �Q���u�0���2I<Դ]t)��6K��a�u�Ax�I�+"F%e#�@+H�ԑQ��o�!W�ە[V��s=�?f��m�ٚ�;�O*��eБ����MC��>h֯�� \�/�l�'e�/�����ӸF?a��b�2�/�Q�I:���e����b6�-��G����,aQZ�E^� ]�G �|��3�67�]2�ėo���E��˜Q��Π(����9�\pNݏ��H����f8���o?����T��MG�ƍU,j�x��Dn&�7���m��k�P/�b�Ϛ�����z��[���� ��N�By��U��Ki���ݿ��9����(�k#�u�OV^�hv�A&~���l��PB�7�0 �H�I�]�l�N����*b���Y�(>o��c��?M�ұ���oMr�IJa�4�����3e�M�l���n��$n6|�\�'*����㮬xjZ��T'RM��ǃ"���y�03��B}�L-��u�H;��� ��[�1���n�]!U�;�|��Cs���W� X�s��Ȕ��B����aՒc�.���b��-3�P�7�:Bԯ��"�DQ�M �?����v�H�-ig����?��e��߄ߎ!�nS/�S�}���F4�=�����a�vړKy��05���L ^t��C�3Gw�0�T�8Һ ���[��7�����ɣ x�9���5g)��s�G/�O9P���it�Aąt� �`m�W|����)Q ��r�F�0���0p��cW���!Mh)����ӃG��x�u�q+���.(��U��+B����� ���NP7��Z�9��AF�Dh�Xy>7o(/R��f;��Nӥ�@��O��O�i-�4V��ɹ�����^�R�]cS�ȑb���Q �d�)���8bHj<���\� {�n�1����̩�\ߦ�)+�g^��\���e�\�z�iT $��" �L?��S�MsE��瓀ho��C����xnh��b�vɄ~��,�.:-�ټL6���;"��>��w��y��S��Z�e�,��KL���P�M�|��)g�BZ/`_b�1��뤁@����~ܵۋ�j[,D�����銻�d��|;������Mn�������>Z��-Y3�Ӆ2C���d¿ɋ��=���3�܈j�'ܩ�09�ng0�2���Ӑ4!�!�+ ҧ����滛���n�W�d�|�CV�d��WJ��!�^̢{���[Q��U�P쯯�\�_�+����v_;��:�4�* ��3��v����dl�"r�oj�bA��V��w��:E���C��z�0^ϯ7�Vm��٘L9����p3?�k�� ���2��C������L�;��Iy�=�_�d-`8��p�cw��ؖ'�*��á�j@�S�T>�*�Rc.xl�k|��MiP��?��H��s2�����|����25�h�F1Un9K�Dȟ�c�c��s���l��(�mC� f�����C�a3�1:���"�U�� ��(i����07����!�-�y�HخN3+Wi����'ז����Zl�'BX�< @��6�CØE��(�ؔ�����^��d��Et�d �ś]j!.g �P^ Y��y\����Ј���ږ�fN�����:b�8�ڡ��eO���*�����g�̈́k:ݹ�������z�����zEݶs��E�G� �K1�Y/{����WKsW������D4w7�L^;8Y������$e�x�R�i�萇��0��h���"z������X)����{[ CM=�ܨ``?F�R{���!����"���aO=�ɯ���-H-�8����5�L��z���7��&L� *ʽ�_�3�m��� ����v�4������1�fT#���i!��!M{�R ��@n�k��t�6�]r��İ?.�Ӓ$����r{��n&�D)'�0:b����t�'n�E����2�Cw�t�9k���g/�F���J��ylC�%6v��zv~�lMzܚ5Z��������Gں��x�~ֽ�c\d�O4'�����Iw'T���S�Nkv�CW:a9Y����ghY�=��QR:����-7�1�3"�61t2��x$ �D�c��V��w۳;���1qW7��*�/�B�JRa>��_*w�$͇r��t�'��G���"���S۔��tl:�Թ!6Qh��W$�csp#��G���]��������l����C+��Xe7e|��}� ��:��Q�c�!MlD{5Z��T�o���Z������u���������2�ֆ����יK3�g�����Չ&#��"6r����KGl.��.����/-�i>2��y~ٟ�Ry|58�G�.83�Ɣ�t�[�����;$������-�xH�Pf�����Jʰ�vd��H�������|M����W6�����Y(Z���������u[�+Z��?��-i�}�q\$��Fb�C����4bi��'�����n��v�Q�ٲeway�.^��˜<���`B�6lr1�!�˟�A���d�#E�V��\]����z6}�l?^�?DžUf�4���m(� ������,gp<���'�������!���2G���C���t�o"m_��{���Z�E��k�Hd(�AŴ�~sN�}�C�t�X�����������܂ ���K��{����o_���Y�D���uc�p��L�0L�����s��;�5�ҁ���3��"*���c� ͕�I-�37S�n]jT̤�r�F �9w�f���$���І/������!i%��/;�>�>:>�sn�*Lf"�d�L�Ry�4�XA�Zw|�I~�V`�&d� DvF_M�tj^��A-Ɂ���}�]ޭ���{��e� �l@�y�&\p'B���Ť�h�?�f�gY�6���BtǴ�]h����H��(c�lk:�Ξ�Vq�,~f�������n ����T��*af!�Q����2�����7��%����,�֏TҲ���?` �
Static task
static1
Behavioral task
behavioral1
Sample
autorun.exe
Resource
win10v2004-20230220-en
General
-
Target
autorun.exe
-
Size
76.0MB
-
MD5
f2deeaaf4ecd6e5cee078f5c69acede1
-
SHA1
d20d9180d6b13ab7097eb563c3f0b9f165baf8f8
-
SHA256
2b4a2214630e7122a0f06815c5f32f9f15d31c89b7f2a54fb6e6d41c204f270e
-
SHA512
98d7260dacb927121e87e6e3b32db8d2222f3f1ffa64991de63c7dfbee2ab90134ebef2f292cd5fca45f62ca7701056add2d017700bfa0968aa8b5b6d5e7bb18
-
SSDEEP
1572864:5qYbrm28QlTmPG4L2nFGnnDLRqBda2cuKXSX2de43NWYkjRZPvToKW7zGTnzPq:pHlDp4nn/RqBdXnSG2JdWlFZXTox2v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource autorun.exe
Files
-
autorun.exe.exe windows x86
3998c3a5ee7bad0dd6349ff661d58cfe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
mixerOpen
wsock32
socket
version
GetFileVersionInfoA
msacm32
acmStreamOpen
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefMDIChildProcA
CharUpperBuffW
gdi32
AddFontResourceA
msimg32
TransparentBlt
comdlg32
GetSaveFileNameA
winspool.drv
ClosePrinter
advapi32
AdjustTokenPrivileges
shell32
ShellExecuteExA
comctl32
ImageList_GetImageInfo
shlwapi
PathFindFileNameA
oledlg
ord1
ole32
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
urlmon
URLDownloadToFileA
gdiplus
GdipCloneImage
netapi32
Netbios
imm32
ImmGetOpenStatus
imagehlp
ImageDirectoryEntryToData
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 853KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+6= Size: - Virtual size: 71.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tQS Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.G)v Size: 75.8MB - Virtual size: 75.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ