C���T&&n�&G�jl��qu�,q���2�B o��T7���Ch?_G�˨kk�.E�)�m�U͝�lQ�?kMل�rUO�G#��Ґa�rN�d�\�=Iv��iPl����ٕE1������bUe��`�����w�� G.3x�0ˑ �0��/�������i�J���rmi+{��x_Tz�O��.WS-�^����Q �����ۅ|����xb�mךo���"$�㭴v� �ޟ6{�.2zâ(�B<sݪAJ�~�2B�*�����8k��/�ަ!"��:�R��ҍ�p�>�"��@&����bK�|��͜�~\�xqQ.bmc��B4=�i�%�-ܪ����`íG ���\dxއ'V���z�ʉ�m�o�Ҧ�(8��6hN�E�|��C�6�����/�ߏ�L�Fa���}���}oP��zw�Ρ�����N�;N��?���H���PC;+zJwP�7�n��:ƅ*- �B%Ցo�ZGe�L:$���|�)��aU�;�q3_@~NKh���Q�� �v(\I���� ��7B����=����5�����r�#�<k�yWNTh�9؟=����{��f��r��P��{��ώ�"2o_��,xJ3%����ΨM��CJ��i`�&TAP�Y>��g���虔�0`��|/�o�d�b���)%D1]�{�m8�;���Ӑ����7;ԹT�yޫ3ۍD?��p%�������ɇ�|�iJ�\G ?���E�����dnٔ��߹K���<�Kj��3����>��V�����)|���k�L$��@�n��b�]d��5�|7-y����x�\�P�j�py3��*�`�l1N2��WT1�y1��R���w�Ġ�̲�ۄ6�p����!�5��DG�e'��p�î�!ڇ�?ìo���T.ug>_��&^Lʤ8�ՠq��u}�~+͝�x�@�Z��%�3c���P����o����aZG���H����$2*!�E{��8Πy���s�� +����s����/�����s�C���c>�=5�O��&����T�*�/���]!�fo���hu �Rddx�ޱ���b�/� I����W�p�:W�j����0�V�v�i�5��!k�_=P3Ѹ��+�2�����>�6��O.]�"��>�aG�h���������a��%�%��*�/|'%�7�`�?�H�`\۔8H�6!����e�ϋdv����g�-LPF��p�)/Cרuޘ����E��>�a�0'���cݿBsB��u]u�+%JXz6�g�-������M��1�V�ءO=jEj��Gd�#�� ��)��ܷ��@�@���M�!�>ԕ�W�vY<�RPvݕT�$P�+>gJ�r4��#,�g�O��tO�B�����s��L{Z\p������%�[���|1T����O%�����1�蟎?H��ʂ���^�Eh#�3zNZ�=�Νc�O�(�+�)�s ���y�����v�����v5R0����{�X۽@&��f�]�J,^�|��#���@�L�_>t������D���7��a�,F�V|�l����Z�����轗?&�>�Y��_h�����1������,��Y���o��1�t�nC�������%�V5��i�}��C�g�ޟb�F�78}i���O���:�S]XM�g[��P��i���o��mn�!<o�>��� �&�E���礨��8$�s�iwËt�1sSm?^��m�U�8���O��^)/�U*w�Ma�����# ����C|U�,��/�X� ����[���[��SCi��k$��iz��:F{n�}2�"A�@�[ʃGc58ս�<}봸ݦ+�Л��\��ˋ�l���7p��U������o� ��|k�C�����SIP%[yˆu��ބ/T�;vs��h,D#���;��g�� �6V'4��R���D�����>�O|r�����x'����A��;_y�� ���'XeSk)O)]�Fnx��WR/˜+��1 ��ԑ�����r����(o3���������2Z�B���J�PGC��v��8�'2���Rg�����x<8(𣥜b$�����? �w*Jt�i�� ]Z/�68�a&e��j/j�z`�� Q eo�w4��Å�cXuc�.���[=��b_�����-��G�/�܄;۷|x�b� �4^f��3T����a���`��a�ȷTg& ��W�Þ�+2�>C�c-��TV-�HH��k �=e�k���|I3c���.�z�Bm���m�6zr�V�0�����ޡ$R�?r����3���:)��u��*�etG"lDH�&�z!f�H��e�T��ȅ/�<G���Y�T�2�)&���1���s����hh�=䎍�z�-�o}��_˵L��ȁ��m]���!�,��1��7�j���e�v閔 �N)5�v������:�����m��oc��{;I���!�b���-����<���ˬ O��Ǝr��!}���3�p!8�����N��Dn� "Bn���;���B���7�x[bl���]���l��"��*���t!�D�>R;�/f�����'fnv5�A*\r�V̷�������a7t.����������G�=�`A*קfh=?�`���K��ɗ0���J?�\��p�����z�V��%����y��(�� )]�V�*��|�J�l(N�F8W�줜��!���,QIBqU2�θK����c��( � 4�6 MiP�LY ���`�i)K�#C�~f�Z��w�y�m^;��P��>�r���i�@(S�6����5u�^����Z��j;eE/8%`iF��j���Fa���Ο� V�L� ӱ�DF�&��x����0ƊeD1ೊ��b.�P&�@RQ���qO�15������&�_-��K:� ���8Lvا<�Ovԓ�ruZ���ꉓf�P�+R��²ؼ���I���i��=cCx7O�j嫅#.L����w�7�y���ނ63�)��ǓA �$�-�����m��18*V�"�'ʓ|����D�.+��=Z�ل7 �?oږ5�M1�9s�o�������Y�u�M4�,�
Static task
static1
Behavioral task
behavioral1
Sample
ada3fbf14bfaeea2e4d1c2bad9e3bc6f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ada3fbf14bfaeea2e4d1c2bad9e3bc6f.exe
Resource
win10v2004-20240226-en
General
-
Target
ada3fbf14bfaeea2e4d1c2bad9e3bc6f
-
Size
348KB
-
MD5
ada3fbf14bfaeea2e4d1c2bad9e3bc6f
-
SHA1
0b9846117d3e17ccca2b327954c94eda3b79d7cc
-
SHA256
f01ce526f4c095f20605c219810bb7a5f58c92ee0eacd47a9d60a4c8884c3ad9
-
SHA512
fe9128c0284114f6936ac6113ff7dcdb4bca85d2624925a6bc40561d7c2f41a74dfb56e67edfd28ede3cbd47afe8a93409138514ed4fdbb5baea46c5878b2d71
-
SSDEEP
6144:MoAEw5LCgcoRlUYyy3FkSlmND+0COeG+MTBfkGpZewsOdfWqewaZ1G2ACe:hAE++g3lUrQFkS8NhCE1fkGpQGRaZUCe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ada3fbf14bfaeea2e4d1c2bad9e3bc6f
Files
-
ada3fbf14bfaeea2e4d1c2bad9e3bc6f.exe windows:4 windows x86 arch:x86
97cf7d88fe56240995e75437309aad43
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord3596
msvcr80
_lock
kernel32
Process32Next
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
gdi32
CreateFontA
advapi32
OpenSCManagerA
comctl32
InitCommonControlsEx
ole32
OleRun
oleaut32
SysStringByteLen
skinh
SkinH_SetAero
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
winmm
timeGetTime
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.N/A0 Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N/A1 Size: 316KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ