?�B|��l�~�!,�.���1�N6���M�%L����~��RE�\��Hw\���a��jU��k�%����F;Ѫ�COeRq,����TJML�Y���Q�z[M�)� �)$�"����¬��z����y� i�!�^<��(��~F*�&f�`>�87r7wy�F �41X�$�Ό#m�jf�i�~#d�&���<����.����}!�=����9��g,��^]E�52�k��-�7C1��WR�¯����ϭHtx��T�òX)Ԅx �(+� ����'œ��p�X��%�I��~Uf�c E��M%�U�l���$��Q�G�)�6��/��2$�� 7��G�W���X�d 0��EI��v�o���l�A��P]�|]����*��i|�ʑ��b�ƀ0���nq�m�m�m�L�&w%>��`�vc�;��6\: �xj�K��]�tH'/H�A��V,���x�{���Ӽ=�l�l�0�w<���]p���1u���[�!2�N�+�<�$��(�y;��f������E��[�̓�'�J����^���@�Iy���;��x�=������i-V�־�+獼��03qM��Ŋ��̥[[(��5!��ޘ ��oG�� �i1Î��?5ʫ+����+&�}����m&�� &$V[�:�ξx�!z�у�+t��t�F�����3 �6.6���y��_:��s��ݕw�����7 0c~x��L����x����,�/��&���q�ӯ�ǔ���� ��������l����� x/��0Qn=�K����@��1�%���2ݯZt4�e؊��d4��z�n��Bї�!�B�_�u��@�+�����&]o��������uG����gy��(-1�Vú7�s�Q�/�U�w���!v\���}�i.-m�`��d̦���ȭ�B������d˦[G��j�p�Ƴ�ᥨ��6��C L.^[(��� k��+��C��c��[���s9�7T���"�y�������#KJ�j�?�5��s�c|���^�I���%X`e: �\���p���ALsv�.fQ7O��:"<���$�s�a<0���=9~B�!��R�n=��<<�8� �ң��o@� nݾ7L�(k+w,Eq� t��p��|� �<�vx����������xt`��M��"�U��?�����5Vv�䵃�w(�� D����b�iIo����)z�j *ۤ��1kD��./<蔯�]�H? �_&p 9M>OP>����"�u}�e��R�f�W��ɉ?���[��sЌ�)W�qw32DD���=��&�߬�&,���:�t���dY3�1W������e�r�"gR`�2I���^fDZR!D�루$)�+�����i��F�_d�`�c�(�0��g+:�����ޛQ�����n����z/|Pa�?��ސQ�*�"��4\�Cx�֧�8E_(�PQGe�e�5�4�l���&a<�|�\��<�ƚ'��� ���WO,o����;[�> #N�ft��x��'4а�՛�3?�t$��I��^V�Ĩ�0���>�U�A*�������L�@?��w����@�KT��J2$w���p���J��[�L��v����g���H�1H3g$�P�C�rB9�}0��2�5��F�k��x5����x� �@}��25��p�w:d��&Cӡ�� d�. R]f����Y!�|��6g��ئ��8ɷ9X�ϒ���H��1����<��h>��#���������#,�>��|�o� Z`��ر�3�!^���g� �%5�D���qn��t'9�u�6��+|���'��Xs �.�컟�q�&):YT���g��¢,T�~y���ܼj(�I1NVP��,;���墛!~�\2ر6@��~Ƶ����PX:�X �稐��m$:fpK&7�E���N@Ie3�T��L���p ��۵��zl�f�B�3���9�*��T�ǿ!͇9��*��^���<�+b���al;H��ߏa(��`PA ͬ�CÚض�~\<Ly�x�z wFū)o���@�_աk �W�s�a$i��Ԙ3�]�FdJ�8iլ@�q,):IS$��4vq�(���|GU/_������9��~��ՙd�9��Q������5��cO�M���C5$ xxS+���ˢq"�}}*�N��ݮT�=K|r[��������5V���q�I6[[D���07BV�5" 1 �P��ˬ��@�g��$v���i+w���X��?�i��� Ē���_3�\��+��$�e�<��ͪ�W�8z�y�E_���`��3iz��N����G�͜�� ��J��ab�β�<��y���*<���t� �e��"Zө+ �oE<�j7[z���ELu�����m�� �<��>H�,�!m9zW~A70-P�җ\Rf����Rt���j"/�. m-ǿ�1��a՝@Ʒ�n8�_�#�c>]k7�|��Ow�~�����=*"a;9�IU����K5��>Hq��n��k��aと����&����I_�4�^T2/6�Fm1+S#�������ˇ�����C����^��Qf3����2C1U�h��%IL����4� �Ę0�N���E%m�*e$���Y��#��)���&����(�+r����N��г� ����- �y�2tU�=�y�@�@�5X��a i�����S]:.ge_� 4tS�g:�w�%_K3E�r��^�%��V�x�����W�� ��� �t0-]���5D�K���Ar�r��RAw:K6ϒ���%4Bv ت���?C�P��~>;k��X�T�r�wJsL˯=�c2T������5H����"X�6x��^��~��ېz�? F�E�L-�+��M �x����7�3_�ա�?_ڢsN�n��E5��B��-�?ݡ�]MT��p<"�5u�`����&��Jjճ\��ӂy�:)(��ݒ��Cz��,�9�l�+x����\T��noM�[i6�;&֟c��l��8�-�ɂ��5��pLY��߽����j� ��5cb+��@�&������z"P��B�S���_��E���y;٤� �
Static task
static1
Behavioral task
behavioral1
Sample
a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b.exe
Resource
win10v2004-20230915-en
General
-
Target
a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b
-
Size
9.3MB
-
MD5
9daf59af3350e847e156cedf1c0456de
-
SHA1
d786dd6c495ea8a46ae08494b29444509e2e3438
-
SHA256
a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b
-
SHA512
dd85679eeeab8ab736d6792562714105814615cd7aa84567f96788a03c59afa0efbf326553756578a45e67d1c7fece0608b425b92119d5c364c82a5d6b6bf3d1
-
SSDEEP
196608:W6pOUYEHAtjDO1Y0N7xf5rWnw0pNoLoYyvjsEnfi4lKU:WAek1Y2rrOwAGkVw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b
Files
-
a2e06966550eb2a4c1f1f9b6f560041e4a555e08def29bfb21a4a77ce44ab23b.exe windows:6 windows x64
e5f07c86041f1716d837ed7d960cc8e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetModuleHandleA
SetEndOfFile
CreateFileW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapQueryInformation
HeapReAlloc
ReadConsoleW
FlushFileBuffers
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteConsoleW
OutputDebugStringW
GetFileType
WritePrivateProfileStringA
GetPrivateProfileStringA
OpenMutexA
GetModuleFileNameA
CreateThread
CreateMutexA
WinExec
GetCurrentProcessId
Sleep
DeviceIoControl
WriteFile
GetStdHandle
GetSystemInfo
HeapValidate
HeapSize
ReadFile
ExitProcess
GetModuleHandleExW
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
LoadLibraryExW
GetModuleFileNameW
RtlUnwindEx
RtlPcToFileHeader
FreeLibrary
GetProcessHeap
HeapFree
VirtualAlloc
GetLastError
CloseHandle
GlobalAlloc
CreateFileA
HeapAlloc
RaiseException
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
user32
GetClipboardData
EmptyClipboard
CloseClipboard
GetCapture
SetCapture
ReleaseCapture
GetDC
ReleaseDC
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
OpenClipboard
MessageBoxA
ShowWindow
SetClipboardData
GetKeyState
ClientToScreen
LoadIconA
SetWindowLongA
GetWindowLongA
UpdateWindow
GetSystemMetrics
SetLayeredWindowAttributes
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
gdi32
GetDeviceCaps
advapi32
AllocateAndInitializeSid
OpenServiceA
CloseServiceHandle
CreateServiceA
StartServiceA
FreeSid
CheckTokenMembership
OpenSCManagerA
shell32
SHGetSpecialFolderPathA
oleaut32
SysAllocString
SysFreeString
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_43
D3DCompile
xinput1_3
ord2
ord4
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 768KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pmsv0 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pmsv1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 648B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE