uC����}jm�2������(Sxs~�2N�R��I.\;�!ڐ� I�U<gȅe�۰��ؕ�g@K��:[h�1 �q�c��$��3�����yw<e���8ں(���&X� $n���42��cYY�3�h��3gm��m���c9�z��j���['d�k� �C#�l ʈIMWG �N�OܳM�Fbb"���u8����ꡬ��@�MI��.�z5rS�T�,A1 �6%�ao����'����+1���'��0ݘ� yw�X0�3}� }�B�C-�ޫ �&h���`�P�j68�=b�չ�! G�����y��;����}���|2lϋ߂�.�s̺�"��J�a\9#�&J|;�\�:.6A�<�7-U� g���q%$i�a�[1���� �� $�7��]D�N��a/i�����^}�X r�fGg�ֻE'BȆ����` �*�e@Yʜbh8E�h�,�pcE��7���8��C~`�v��e8:���O��ʤe��\���|ُ8��β���桫���R-�i���� �͡��]*i�X2�6��*��-��)m #��`��_/���f�������b� �\a�ZS3��$�?P�2�I��jzhK#�Bӊ3�|����Y�Y�BzD�rU����g�鹏Lz>C0��9 2ae�0n��98��`#��L�-e=}l��a�㾙췙#��i�ct�n]�~=��#�S(�8��F5�%�5YY�RɆ&!��*�fv�M�=��[�B�����R��iEt�����6����5�.W�S�^������;��l���2y�u�, |��� Lw�Q�jթ��K3t�)�}��7C��>o��ܽT�Ų؟�:�E��韐�(Z�𫪂ɨ;�ijvgǃmu�T��^��QT���u�۶ܽv}�Sʱz��6eWs�i�'ӹ���y����Q�����9��:=�}h��H�{=`��*M�1L3�^t;\���c�9�W�o�@�J��-I�% ��/\���c���&Y�^���j����O��=��Ikk'��Xx������罩+�n�@�q�^���]�2m �px��2�`E�����;T����o0:���(}o�� j���Mq�LK�oVgo~t}�#O�:-��}����[G��Zt� ���]pѕ�I�h@� �X�u�������Y���0�߄��i��m�2������'��M�%.(�P�a_D<Am���j�ƻV����:/�n(�juE摶�Ӭ�D�kN� p�-f�B����>?�\���&���@�ý���1l��X� �'U.�Ζ��B��Vm�A�����W����ʤY �i��Y�a�ǡk���DlH�*�Ԏ*�h��f�Dd|��prK)�>�#21(�D\Z%LZ�s���r+:<t�F��`h|}�[m��C�� ��}�jzut�Ӽ�aq�˻����%���� lk�2���L���}��lD����� I�I}BA:�K�d M$[����X1=/���]�%+�����b�'�5���N�7���Gp�#����ܛ�\�\g�:9 .�S6Y����OL������At�"y����/�� ����>M����mΆ}�Ȫ��v�i�����D���<�֢�;�4z���L\YGe,#]: l4�S Ѷ%�w�2��* O ���,�|#`�8U'����-!�0�|�M�=�j�tYʏ�*�z��>"Ir����u�~HLJ��@6� ��x��^��#�[�a3�GRO-�Q-�z�?� �"��cc���W�X8���R��tÛd)�݈���5�^S���w��t0��2�z�����:n����B!��w:�����i�����=�|��p�������n�5n/��"��}z�:H�<Z��tw��^��%���I�����)�[�Շ|�'\�j�@F/$�A^���L�� �-��XȨ��4-�ZT�B(�60L<@�Ls-��%ȊO�[���9J�f�����n~�g�u������D��L[���ƺ� a���*���\B�ģ�h���YD?!��5[E��B�7���X�UaM:��� �q�KR��C3ڵlJ�7YZ��*��Biɫ_�*�#���0�*y K��2���K��6�$��2��ۋ���."F�&y��S%�Nn��g&����ޮ��.p�٪.wN�,D��l��%��;�c��B?�6��-[�i.���u�N�%qưP~�p��|�1� W7Jp� ���$� Z?�o��������%D��6l#��@�P �ٿ(����X���|���7��ɠm���(�{����j�O7� U+ͦ<W%z���F�C�(`z�-���R����UA�[̏ԅ�!)������:8����8+���h-6:\rs�� ��/#��X�ǥ�ү��q�mr4�z�nigĎ��p��P���ZsE��n�}�� d9d]�z��;�Y' �G0��ZA ���f�N��^� ������N."AF*8ɻ?���v��/��TTz_u����$���Å�?X�;{ү��\�º�Zz��b��4hP�H�y��t <Sw�x�yJ������+�%�:N�^�\&Xd�=����_5]�t�Mg��bgy�m�X�EP�@�^A'��Jt�cع���ڠ����YSd��rmhԅ��:���.A����7�s/�1+؇��m�8�����(�#y��{A��$�K�q�q <tm�O��S ^'ϥz?���r���I�]� v�UM����O�[Pd�yv�_����>fǔ�+���F���=�W� yڲ+zg6 \�SK�/^�(�~nI�r�l���9����v�e�a�m�������,!D���+d�~��ӕ��K9�!A��qɄ��b��嫪n���`�m@��r@�(͡��93�����@ �����6�D?I'*�@dH��j�)��|)w��'��W237�[E��{��Z�>N���g?~8����K|$�6�9%a��x�JS ��оL�K�ME \E���oMZ�Qr~`'�O��)��ob�Q��I$���ۇ�X�A�N���>��'!X9�H X���ȡ�ʝ�U�I������W����2M'���(��x��ϊ�66ي�
Static task
static1
Behavioral task
behavioral1
Sample
vosa.exe
Resource
win10v2004-20230915-en
General
-
Target
vosa.exe
-
Size
3.3MB
-
MD5
fefcfb1a80d10fb8299bc8baf6732a44
-
SHA1
722d54dc7dfec6d9459cb9faac9385bfc41792b0
-
SHA256
000a5e8801d26f89c97eda22a326a6e18023ae97b0434e146845fdb9f8dc5a86
-
SHA512
8eda5c197e1bf2f6ec6f8720e543532dcb4e59c11467ddeb2c462e296f5db1f602e24e306ca0edbba39a76ded1407cca87d31dda1dfef2231d5c231f92283b8e
-
SSDEEP
49152:806/n9B3Tv7JbTC3Y9j1oDil5up8CsYAqsfjWKnyDHBXVQiwDTy54L:806P9Bjv7JOIpoSPDyDhXVQ7KOL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vosa.exe
Files
-
vosa.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 252KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 42KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE