t�̉���,3��j�L��"�7����C%RR$�ܶ0ž��ei��d��?�.2���1�U�҄������/B���T%l�Oެy,�d��B��B)2k�N��GKlNe������6�⇜4_ RIרWGaBDW]��ktA}��U��ի�̺Z�LlIo]HN���Q>}\]��'���������es�����۬����B���kKtU�����f���?A/%�K_�HBTg�w@�!N~;�Bc�]��(@c�q��]���t��=%�����Yub�@O�s(L�"��E���xK�J�p�2̖1.��!�M�@?U����i/5�\@����i�X��1���s����u�7��ǩWT0��嶩E�����M���z�c˜8$�7k���x6�ý����r��~<�m���F�����.;�R^.*���,���Q�3ށ����C� �E��� u�3�yP«`Z���x���70� ��x����.g��^�ݩ�[�e�*�@֠�}���[$���R��[.EF��*��������d4��[�w����a�#�՞�O*<�S\ ��%�wJ�\~���Th ss]�J����S��k�0Q5�; �{p�j�.�5�3��n���"yn�����B%����y>�P�#e�Q��+��c�9?�,}���,�z�@�_Sʸ��������K������Cw������DE^�s�^yHT_ �J.�F���;���<m����,HQ �ޢ��6��S�+Z��p�}������Ɩ�G9B�9X�{Lo�uP.�PK�%��\MI8��?���92���*��h����6�Uw@/ޥ�0�*��IX~����������8ц�����k��Cx� �T�|����9b��p5q�-d��N�ad�v_�(�;z<��e��Vf@�yj`Er���ؽ��E�L�H���^���H%+�k7!����N�����o����N_ ����CKG�a���ŐQ B�����Q{��/Jp�cnh `���[��?�}g��'�4f^]��BaƵ-&s�,���JJ.o�I^al�����lT��{�� 4>s���8�l1��iG{.A^��\|���Z7plo�}���V�ݒ(�]���Z&�g��6�cx}��G�Z'�RWcq1�f�y~����$�8���; �?�|��r������:E�5<pB�78�]�;9ޏ�� ��X�6�a����dѤG�;���Rc?��s���G��_a���O���W=���("�����R�A������[�g�Dz�X��w�C\���yl���#Q�������;���@�N}�����{|�E ��_�N�����o)��U@_��&�� ~���Hr��S��Ѷ�h�s1k�����j}�0Je����k�h�s&�=(�P>�ě?^?�i#9�aRI�$�Rb� �C�[��ƚ���C>۷k�CY��Qaˏ�="���ԛ�l��� �)�j*{��V<���P��Vʧ�;�C���m�������l�>pB!�s[�|����5f)�������j���7��7��(3E����#�u���t]]�� *������6!3V�����H�'��zf &��>�u�żrpA�Or�fZ�9��vD�|KQ>���$+�����#�t�=Æ;y��{�J\E ��>�b�bs����N,��7�w]}��8a5d���6�I�Y�f����p��EF�O(N���Dx#J�bW��@<]y=�|������L�LT�� ��.�.���h�@f��=c�f�B�1�"��lm���ħ��i��%3]�:�\��-���@T?K2s��?��y=��A�MPimٗD�!�>��p�tLq:��?22�yM�zA"uft#��^7s�j�%FU(�Zm����� c�ke���l/|x��n^�QU����2����Ū-�#Nr?��;���&!u�,B��-�Hk�i�3��� '�A�,w��'����,OzG�4�[���\���emC)�]����%�ר���8���m���nţ���41�b�}�;�yV9�u�Z�T���/1�E@��{c6�&8�?=�|[�'|��͟���}���y+(jXz�\�F�o��#]8u��rJ[E�/-�3�\��d�CT�S>�����1U*��9Y���(�h� V�O-�v�H�uT �@S"��e�H����MjÆ�ᅩ�NlC/�L 4d�^iy5iT�~��Hi¸��?������_��N;Qၲ>��7"�����U�`�G�p�����V؇w�K���!t�*��3M����i|�7�Y��#b�t��k���[����^�Ȏ�c�mȳ��� �;�!BSqL��s����G|��*����v���������s��s����=�G&��D�?��+UjϹ�.:·JϮ>y�Z�uyf�4Wn�^�[R����U���������/�����qqVd�P�]IH�{'5$��u�u�[-�>}P�rH8�ˆ�1u3��_� ��1�n9��*)=!�ܸ����Kɺ0��z:d��Ze1/�{т�T�2�����n�Pl ;J��.;)E�J��8E�c�x8���(��.M����^a�mW`+�8x�u��2|�U���%v�S�PDs���ę��ʉ��95�O�\�<�� �H[δ��Z����1_ ���k�#���U���;�t��7������JlKҦP��#\%L*U�VBZ��dC�c�Z�" �S���@����v�. ���m�n9+�c�y.�� a^@� I���`�[�`e>�%K-��xu4��1�����,�;��Io���>�a����e��K�ҙc䷤U�T���iskwV�a��E��:��!Ձ̚��Hyl즤�EY�r�p��D֭n���U8�s��aH�RC���<:J"�f�,I��>-��J�&x���\����,pEH��BV��S���Tq����AL� �8�e��Pi<�6�U�9�M"�I44���h���~���~f����D9�G��m�:j�����:�i�2�)�t2��'#g;W���v&�"3n9����8�����Lgq�K�%[��Y:��v��Z�Y��<T^eգk���*m[�rg���ÿ����Pn5 M�P��!˾5���=����ry�<���Z�Pe���1�����w���"��7��z��s����Z��!��*���pp�l�5[,dkX���`r�2A��܇�x4�����F��M+���?����6bL��lOk��93���m�<I�#�A�<q�)*=(����Wƈf �f4è���=bM�{xF��;&j����e���9��&�
Static task
static1
Behavioral task
behavioral1
Sample
VALOWARE.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
VALOWARE.exe
Resource
win10v2004-20230703-en
General
-
Target
VALOWARE.exe
-
Size
8.1MB
-
MD5
5108c9406a478ff60689a2fe9eb353fb
-
SHA1
d513449715122b7f6eb0c9d6fb19b50fb4aae45f
-
SHA256
0ebe79dd239f902f9ec6a109f03d223866f3f175f7f85f7e059bde4847607d86
-
SHA512
60cac4fa350df8527f4dcd272539968fe4c133adbb76dbf226091e555f87badb809daae2c414aa7c26ac88aa2a02c3913f52160aae5f61cff71d2c64c9bccc56
-
SSDEEP
98304:SAhL00/nqeSsawFAk/cdpVqaE2nIVqeOBBZ9FwYw3L31dd63tiY8L2Nhegy2EmAn:fhLPvAlkEdf/oaHFoF+Py2Eccra9Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VALOWARE.exe
Files
-
VALOWARE.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 575KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 365KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 31.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE