,3�4���0���] [��:z1�Q_ �*��n�C�"�e�ЈxZ��OqڨsH|�l�|��ܱ��V�n�F���KD��j=����o��װ�hC�S�q艊~���>�ǔ��Cߟ�B/���;w����w��q5��3��Y�&k��P-s|��e4C�X����b�>'|����ߡ�z��h25Q~Z0�nc�����&˘��T�rZ�=Y-G2r�߂N���Y�5}�'�f��{&�����*��q�Cދ:3()�a^°�J\��p#Џq�� ��߮N5(��������]v��@6����" X�m��q �9ᑑ}g���%��L6L·.ӷ�q�C� �H��%f)ō�|cT����A� &�ILF�_UC~�\�dպ��W�d<��_Tο9�=�����z R$ϱ;���H�uK �m�$�S��&&!+��5l�� ������m������9,��b�[���;Є�+��-]E8���e%+����*�΄~&�l<dz����,ֲ7����q�<�P� %RE�,7� ���&Ñz?@��r�[F'H�c� (?u ��V��|9qEh:fAxn>4�_Z`>�f]��f�(?���J�����-�Tw_)!x�sZ�{����,��wjJ!���j�Ffɵ�[9��w�õ�?��yO�G(�Lc���#ww����8�}�� k�l�_x���_2T�A��~qs�u,���˚���6P��"�C�6��. � ��`��������^VDK)����u���75�H���H����Ζ�������ua5M�������IK۔W�&��� �k*�A��@9.�@��x|�%� �u��HQz8s <�rO���E,h&���3Ĝ������3-M`B�h3Tjr�Ev�jkQq'P֫�kqM?�_�z���ìNrU/�28}4rI�L��BA�%�����]ۉ)����/�]~@G^57��\��o�������&��^#�����a�{�0J0yX�$��9�蕪�_�k�y` ��������k Х�RH��"�|��F3̆,���A@���H�KG7��<I= R ��sYT����-�I��K%ED+�C\ �\��{��|��H�f{T|2|���N1`�If��a6ݵ>>Z,հ;��~�<�G�;43s��X���*{>oe⟁�/�;� �혰K�ςr�zy��� q.&�H/,e=�<0�M��2l�DX!�����:�c���v (��x�� �q�������/����PB��B�m$m���xe������$듻Ľ��/`o�E%�/,�bv�/b���Yi�xA��b���̬u�(�3�n���&�i��61�'fy�a��}v*�����'J�4��µg�]���Y���p�ޠ#b�,�O�nk��%[\v� ���e�ez}2�Y~��]��0�w$GY�QC�>��gA_�,�Q�ѝ0&�M�?�G瞬<�Mǻv%��3�~�>�t�$��_��3����6����!�p��&�W�E��!�� �!�C�J�kl�_�.$��u����7O(�]�.���w� -�]a����(��^��owe�灠QQ��ڹ��٢��zB@p�])T)b Y��==��s��B�1x��%<�~����ށwW*�hQ��B�qA��R�FY����];p��� ��,���b���S/���)_����;��H����<y�F��r�K�{ثK��}��F�ރ�#�ū>����b�9u�Y32���l�{��j��ߓoa�]uT�����Z�=I����Ⱥ9TL6�aRi�υq�Ѯ�"$æ������� )�bu�"g �'S!���~ Vܧ��'��Q���H��: !C[�kLp2w$��I�G���Ѕ�|��ƞ�8�9��1 ����L$k���"�w}��˿P�6���e�w�~��/�߉,Z_��6��FQ5�]ѻ.�4�]+So���v�Ȓ}��j�L�LO������j�_�`��.������{��!�E �,�_�\)��Ŧ���6�c�^��B�P��{�W兒u�������q���՚����/E����`c�ou c% 4��ۏ�\������T���H�� ,M�o�ʂ^����<%|��AǓZ�(w� ����]Z,��{g�����#S@�-E"<1��Q��Y�i<\d������XD4���鯵Ӌ�⏅8�?��}�U@�DE��J�(�כ��HSJ��w���&����H7�[��1�h�uܚa�omě�j�J%ɚ��}%�<F9�4<6�u�>){М��==�?�1��6�`���8i���2��-�@��k��*C�P_:e������ �~��>��M!�HjY���Y� �����XBJ�Q�f���+�O������xaF͎��.���,f����w��A9A�^���҇Jd1n$���̕�5���>�q[�_~�?��{a<Q�Z�����=f�Y�>0V�ƣHm�>Y�דTs����P���:4|�����i�B�rp�ƭ<�nNJ_B�ᤘ�Y�O�T�;�#�az��5�b�Y�8�R�J����q}g&p^[K�ɲ`���F2���B�k��C>�Dd�^�����5�Y��@)��d�H�r,�t�ws�h� ��^P4�S�� �3^��[��̩� _���dQ,��&���ŵq~FҭO���x��z�8qB�C#���W&�49Q�;�!����������C��SC��͈�W����N��G��:�F�Փ4��p:��V�oHݘ��O��V��x1��ZrdaP�����=��Vsz_J�tBX���lU�0M�� �xϯ(�����X�RA��5��� g���B�"��5N�&�k��_�p��_'<�P���C����'�X�[E�x;7ZN��� ����4{�k�X�%ٯ�ߟ��I��I�'7�����e�z�X�2����EzM̔��tѷp��L�1��a}�c�;�˅��('n9���Ӧ��r��5�ݖ�hڀ�$�� ����]�����p��6�p�G������و�g�L-�#rn��si��������-`��F�>InL���
Static task
static1
Behavioral task
behavioral1
Sample
aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36.exe
Resource
win10v2004-20230915-en
General
-
Target
aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36
-
Size
11.4MB
-
MD5
b945ef9b00fc1ad0ddf70d251cb9defb
-
SHA1
ea5f610fce077ffca57ac4f992c36948ec85b6fe
-
SHA256
aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36
-
SHA512
32a6e2d5dbe74fbbdef7d5ec634aaa4985d8ab32de1cbc94037ddc2f328385d86be34457b2bc6b362c641e6a695c2515b9578cfa9852bbf19ece337f4f30ee9c
-
SSDEEP
196608:sCiSpOZsyfJRQjU/diX04IYU8qWG6rQn3hBUpOGy/M5UoBL/fAQny6CoefY:szYOZTfJRQkybU8qWGrRdi/fFZ3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36
Files
-
aa030826eaeec12332cb5d0b3d015273732aed5d742d62bff64731f0fb4b2d36.exe windows:6 windows x64
a56827c647271aed5a1e589159558604
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getsockopt
wldap32
ord217
crypt32
CertEnumCertificatesInStore
normaliz
IdnToAscii
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDestroyKey
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
imm32
ImmSetCompositionWindow
ntdll
RtlAdjustPrivilege
urlmon
URLDownloadToFileA
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.asd0 Size: - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.asd1 Size: 11.4MB - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ