ԭ�/XA%Z�;���kN���6�!��#|_;x�,vyZF��{�d��ft&�G����r�Tҩ�ej}{spW�%X��T��l��7���Vu����Q����o%he��xD��-H��A�έ}8[`������M�wz�?n֬������ȟ x$a>�Y�MaQ5�!kr�.���5�#�I��DY�tRꈷ��3�'��;����t�����{�i5i�6B�NȊɞ��m,[�J�li�JU�����;��Xw��E>F��T��C+l���jD5&���w�[j� E&ѝ �!Hə��/�A[�&��quV���F22�9�l���Ν�%��B` ��C~����H�̩yxᶤi�S�� ��:lQ��O1�s6������>�����\���%8��h��VtI��U~�bw�B����'���eYfݤڧ�-� ����U���aMQH8pDg4. ��jY��x�^E@uKf�q����Xz��e����?�Ը`�I���s����x>�mҟl��}����ʊKHbA�[��������q�����BKu��F����t�����{���+y�`�Ԑ87����*��䚴�U�5�a=��U�JY��O�YϛX5w�\�sz�,���J�ϴ=�-�`�����B�`Ȏ�V�`�w���}�c�`���|qzx�C������3w#�-�����"Q�ו�AA�מЉ&-O�����O���,&ߨD:�d��Q�u�d�`D�g��AN�{L��d;�0*��Ѹ��p�>�I^���8g �h�Cf7�g��K�ѓ7yg��geT�� �f�1إ���"<��~-��$H>�)+�t��.qv�%N6ϬSr���cO9F� �x���$��x���vO2U6x4W]��N�dM��ǟ�BZ�u߿��%�n��z��B�H}��ki?p� k%�9�� ^�0��%y<K�껱�FM�1{��=�̷��y�͘�I���:�ꟹ���05��m6<�x�])F^^���3�o�Z$���FȿH�e��$@�$�!�)NsX;�����cUz��&�-sah��dY��Ks>ıc�����sg� _�I$N<��{�n��S���h�+ܔ�H�D�@�0�3b��Z�����Z������|Հ�`s��G� � 5)+��q8?6s,����G/�$�8��@f��S�G��ҩ=�~,]x�H����hd�������XI`��I�N��W�ϰ�OS��W�y�Ío� �G������7I��:q���!ܹ��a�P-fA��;e`Vm����3�@j��bvC��8|�|� ��,o^��M�x��*4�1-W���jV���Ey�"�w��g}�S�V�)p�,��Otv&sq ��ό_�/$ �^>N�c�N�����&�ʔ��D�%���7 �ǚg�>��4/�:V��$6wc߄�Y���xo[�E����H�����Xj% ����$���ǰ 7�c]o��:�jWa��������x#Y �r�d���E�J?�:����ؼ�pɱ��ȕCr�Z�Ea�+���Z�wDw�}�6/I&%�-�L�`̿�����n7��%�y��G�-v@�Ac��m�̪��z9��*V �����j� +��X�vQ�~)/���������P�S��`��YW%�¦�՚�{���]���V��_�xq}UKs.��{5���؈ ���N���6��������� ��ɯ�;v��:�m>�(���<���R1u��0�#^�U4&Θ��)P�~���Y�#�ap��̪��>�'jOa$�翎�"���g�Ȃ��6`��_���^+�c������#��@'a�y��e��E�'h�۫�ЦkhUg�,�Ф��Z����w�ho�>dϨ�+>�Vk��ĎO�����ԣ�\5D�Pp���a�U�_:����m�r�+b_`������U��?���Vz�,T�5B<�sK~�����?:h4���hV1��X�Y=��A5����"��~K!�U+��{����!SS��r�g�eyǡ-;�;�*Z�k�:|&��u �?�/�Bm��:0���}Vj#%��u}$TӚ��:�U9U�����ꍀy<֣�SB������i����g���Gu�L[��u��e?U����>����X95������YQ*-`��a~I���N!2��z$�}(c$��A]�_5^" z�e�_{Z`�¬��F��/+�oB6al���w�J�$�m�t}��u�1�g��wH)z|ݵ1���G�\����Ǥ�_�_b��5�@ӑ����*0�|X�����jʸ�#V���v���X�� ��}��Aao'���b���0�O2�c�ˋ���2��m �.�-��[>�dž �'o��8�u)�8s����N��uPdt 5�+�b������4|�N��feW�21�������1VMH�� 0WF7�g���_�µS�P��C�>ͨ��jx��/�S�s�&G�:Y~�9�&�Ik���X|i�#��q�@�2�y��4�|%�L������>���(��� p����Mͤ�����Q�:�.�J �`n���C��d�?)�&˩ˌ��M��B`H�����3��D¤A��}���0�U����5��(&2�_@l��Q8#Ib���{@B2�J�Ōgj�n)G��4��ؔ~tlDP��h�,�[G�o��.�9�9y��kէT���^�\&����X]�(�|�߯]+DJ6� ���|Č���ת]e?~����ww� �j橝[��F�4��:#��e<G�Sw�S�H�3MN�5����`�s�<��%��>�i3��j�We>h����p���k7���40�]�F۹�Bm�������q,���.����z�E�БHQ1�<T�{=��y}Cf�^Cл�Mvi��ē:�2��n��c~����*�j-I oJ�Z�@*H�۠ˢ4�jOΰ����p�)�O̾� �3�oۈM�S���f�?<�p�_�ˌT+�.�WKm�ᥜ��&�hC�]��s�,j�"1-Y�q�6�D2���Lذ�"��|�����V�uRLg(��=Fߛ�^a�1+��
Static task
static1
General
-
Target
avgmma.exe
-
Size
1.6MB
-
MD5
181a4190380b0fea5cb669b42765b6c5
-
SHA1
02a477d98a5c4cf70a26f4e6ae7dd2102a9200e4
-
SHA256
d7eff9e070b5ba3e01a3d2aa498a62af0daf7fb9c73e81b1e1b07d92f9182be7
-
SHA512
0e74cdd144df18bac904797da9449af56ca7037907e03cb76a50ceedbf41766b49b078c8cf76099be0094ac3b76e522422281d77a68ccb8708b0e68d06c3fe43
-
SSDEEP
24576:8avb7wvFOyvOAgxKIHRETE7Gi2ZSY6JOqG0gr3gU+YLUz5OjtFlOs4jp/YEvIm6G:/ocqIxX726JE9sogs4jtfR1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource avgmma.exe
Files
-
avgmma.exe.exe windows:6 windows x86
945e77e90047908b555600f416b1ff3b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
advapi32
RegEnumKeyExW
gdi32
BitBlt
winhttp
WinHttpOpen
iphlpapi
GetAdaptersInfo
wininet
InternetReadFile
crypt32
CryptStringToBinaryA
Exports
Exports
Sections
.text Size: - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BcA* Size: - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
u<Uu Size: 917KB - Virtual size: 916KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
+hV Size: 602KB - Virtual size: 601KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
<T* Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ