?�`��!�?7|g�ҵ=�)�(��%/6 yq[N�"���D�ꂎ�Sv�o��`In1$s�z0������ p��z���kp��&�X�6����іR�H�|�j��q3W��Z�ɝ+���0F@y�{���¨���l���NL��$x�W ;�¹�&垧�'h�"I5���_�9����[���IJ��RuR}F���P,��c��)��B�Y�n>|m,�v��k����,�V��4B��c��i�l�����Bj�6W�yi�h�W�_�G�i�$#Qg�����e%�������J�;G5�醸��ȀU�2�ӥh�\�/�c[�p띙.���e0�����S���CM���!$$�9 �(Pp踈oȣcf:x���K KhF�O�a���b�5-QH,�P��̖��B�t�)ā�?;$�͊��o�8�Y�F@m?����.{���O����W)����o��Y�x}�̬���}�d���827cM����(�pц|�$�Fx�V�y�,�* ���k������v?�}��=��Ь�N�tM����|o�R �?��=.��['�SQ��L�� z�����_�|�55��n[�i0�W#��K�M�{߬U�q�ڦ�צ�m�Nnj�7M=��kA��&V����@J���z=���TG���2�i���(�#.�# z��-{"� ��v~�K��VD���B߾����k���t�6�wJ�TZ[cG��y?k�r�;��������(��u�(����8�3��}.x��0�lF���N �}&'�@y ����HA������9��U�u?��/��� �M%7 xCy���oQ��l~Vi�i\FC��n^:���:��°���d��+&!��WP�[��x�p,�i��X�R�Gm���P~�k����~F����O��u�:�C }�����4�) ȡ+sN/���]~���p��1��o�B�������P@���,�(��Bu":��������߂p�,�k�$��ӱ�����yN�fگ<F�O3�t�O�����65���ק�~ *w��.ҡoD�v"���!k�D���{n6���n�i�g�4n�6W���֊"DY?�f��YE�Н����{L����k�������i��w�6�����Fq�^�eߡ�R�N�E���|����]ch����}&�4,�1͋�Ze��ƅ��oO�jEt)�AzEU������+>rڝr3�F=����,�Z�e�����.�m�eht?�Q|���s����lҞ��G�#����C��Z�x�O���R��M� ۇ#��սA��Đ��s�xy%����c\ֳ������Rg����Ė�x�w��1���/�����!�{��&D[���OiA2z��z�~�h�E-h�3����?��۹&���J^Խ1�Oٔ���>�1�>+�Fl�K����l�'%?y�?� �{P*X�UB�a~��Ŏ�N�g�)�y��Aej��L��-�L%��["2�;��a�}�2$az��-��|��O鸝��'i��i�"z*>e��@F<�J���9��!ҹ��/Nł�{��ԃ�R��/��0 x����.�|���'p�����0��\SĂ0YB���`��$��Ŏ_�͍tG���L���]"�aU�}�҃������Cَž]� �f�|��d����Uڬ���!K���)�=SFv��]�6 ���=R�2sT*�o�ع,iqM�>�kЂJ�k��L��<��|�J�T�hS�[�N�PQWǾ�����X)�q���ʁoF!p�L:^������eD���{x��~�4m�ILGvD`�������3?�6-A���+O��k��AJ���Q�����tY��I�=�V�y��#�9�s0!�Z��fM�[/�1���3'f wtsR1�vI�.��$X���ݻ���C)��v�Y�I�n�����d-ǩlD�Dn؍�z����\��f ���p�E,�G.m��Ц��r\��Y��l�ջE�s����#Ḳ���j�j�Ŧ�\�P��ajg.�-~�թ;�f��n��|����d;I�� ��餲q:��l!Rp��6�`�%~iF�Q� ��G�]`;&��e 2w'��yf��x��Q�!GMw,��W���+p�C�C�y�#���,���D�b���V��������V� C^�6y슟diwچ������? %�����'[й��>a�m0�0�{��,�,��ǟ�zR^����W�5��{Г>|�f쿿�E�K��ri-1�n��2b2���縌nK�'��)��ӟ>�Y3zd��H�.���������U��1t )i�0vJJ;9���kM�-�p�C@W �|�����:J }��a4���}�-K�����?��3@a��̊�Ϯ�m�b�6����Y��eZ;�F�C+vAh�.�(�Z�k�5�tkO�X��3�7�N�����2cGqp�U�"��L�,��P�>H#��_S|N(J<je��!V'��sz3�Q�ƨ�tj�5¨���G<�ċt���7���:5��,p?�|���l�.�E����/��F��Ь��/[�SR�uG���N�,z4m�aP܃�-��un����+����[�vM�O3ʩ�5�� w,MPl�x��W����;���u�5e{�)�L-Ԃ5�Pߨ��5Ҧ�f� �y�T�A�GQ@v������݄�M�f"#[��Uѩf�68���q4��"}z�;���T�E�h\�Ln��������k��fP�"!O�7��AKMr#9��b PJ#q6��� �R>����ל��*�n�B��Ԝ���x�\�D���#�����ǀ� ܫN>�Es���rs�J�A\)0�ޙL��7!� &�b������l���آ�#ּ[�c�3@ ��LGtH�~��*�@2�M����q;�`�� \� ���+q��D����@W b��9��[[�YG�~�܅�iUD����f�b���Cs�S ?�ti�t����s��-�y-�z�B�ǬX�z��4BJ�͙ͭ�O� �TK�J�!���� h! g��8^;@���\����y�Ok�O�@���<3��
Static task
static1
Behavioral task
behavioral1
Sample
a087697ac30c2fb647ca8bb7ca6c344b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a087697ac30c2fb647ca8bb7ca6c344b.exe
Resource
win10v2004-20240221-en
General
-
Target
a087697ac30c2fb647ca8bb7ca6c344b
-
Size
20.7MB
-
MD5
a087697ac30c2fb647ca8bb7ca6c344b
-
SHA1
1c3b5612b87538c7e9a04f23a0132eaee6498dce
-
SHA256
7ca9a9f531393a1d76231bec196f2695f72c2c49524e5729443f4a383c4b613d
-
SHA512
ae2a3a434d1e0269275a79d8a8bb74539cfb5c776cbbecf6d49371fc4b0235907558dc1643c01d942ad89b3c08ef387e945deba67f0494d0e4f1bd58641dac6f
-
SSDEEP
393216:UeM5DXTRe4C+VWEMD5SPR49cPJh1sBodIZIgq1FnKtucP7d9/19:URt1Fqfd0RhBu2yFq/nKtued51
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a087697ac30c2fb647ca8bb7ca6c344b
Files
-
a087697ac30c2fb647ca8bb7ca6c344b.exe windows:6 windows x64 arch:x64
afde7026f2b00839fa6b442f38f2598a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
shell32
ShellExecuteExA
ole32
CoInitialize
steam_api64
SteamAPI_GetHSteamUser
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
iphlpapi
GetAdaptersInfo
rpcrt4
UuidToStringW
vcruntime140
__std_exception_copy
api-ms-win-crt-convert-l1-1-0
mbtowc
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf_s
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.protect Size: - Virtual size: 21.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.protect Size: 20.7MB - Virtual size: 20.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ