ܒl��Ӫ��5�1;�d6X���Id�ze��HU]͵N���<�?ό��v����a2=N#.��0�֛O�J��r����X�W[��q 0z-�5n��Dcj\��yWK�,�~�.���u��!��c�J�ω�gRᓵ�>C�&����w�f�a��7��Ѽ��M 7�!13����z�p ��܆�.MN &�PF쁤�[����i_n+|,:z;��"��kk���&�5l\��!$�-h[(���%Ss'T��Y���%�~���D��u�49��'R��Y+8w3�����xMt�/3Ƞ(.��fe4G�v��V�#'ۍ,uP��l�`S��'��j�hA^]�� ��rWm�,0q�mN˪�?�1+�A�w��]�s�go�|�$� D ��{C����^�B&V��&FJ�Av����х����l�Zu��ݝ�Z��S�L���h�B���ј�@�����2�<L̴�Y���8vq���Zm`%B�����_L��o� #k&] ���)�>�$�������1���]��HK#��̩��'�b�j����� 6C��w@��ޔR�N#�$��<�)n{�Smx���F:���9��A���9⍱7���������ȫ�x�Ӓ���h���V���O�TLUC��ќ=$bk�=u@|����D^S���D����K�e:\�j��%SqtӨ�O/v�o��zU����o�O�R�)�)�q㷻�R"#��bD�F�p� ����z�6�1(Ϋ���]b-zSE_���w�!7-���L�kn!����!u�u�Ԧ�������'�p���w�as>�� D��� �#��r)(t6�%�V���۲`A��㰲�f�Q��֎���T�C��=���Rh�ٮ Xw_����i����B�q����:���t�i��ؓ%�d�LV5�Q�Q� V1�q�t-�\�1���Vw?��"��w��jw�v53�r0� W�G���$�~ȌgR�nG��>��=��Qu��&�<9�S��ܩ���y�UB�W6CI�b�����e�� �����l�S飕-@�哴�rBg/Viݟ�O����Jj���c�|�Y�&=�����:�J:�/尪}�ו��R�!͢@�K�t���`y�ty(M���G�3 ��k�Ģy���+�@ �����t��$)W|Р�Uެ�~X��K}Jj��1OZ��KM �(���^��g��|4b6(��������6ƕ�Y����\?�\�������p��_��`jH�2� [_�������10b|����}յɳJPJ$�=qm���7�#7����b�c���@�������@�ڭG���)�`���%�ɥC[i.�rm��S��\NN�?y����{�l�%����ח��b!�^����"4��S��(4Tl�0� �4��̯�a� 7�YQ�f#H�M�x$t"<�ϥ���Qr�FV*@����,������ �r�|���E��(�ʯg$���<-�?7q�H��5����$}��|1�<��ɐ= ^�j�c��N_��B� �ڞτ�r�T�u�>����bi�j[А�����j�·��!��#躹.��s�G��F2ua������?����Q"��[��G�1ٌ,�j��r��X`���"�307��'t����9G����cQ�s�|��/�Q��s�����`|�C��A1?7^o�"�OI�=h6��|�H�}��:��LiE���Ŏ�T����6�a����4��M��"��o��C��֎R���K��c��Q�x����L,�{�G��q ����A��1�#މt<���ʟ�e7>�(>� &�j�-�+��&�+��"���S��!~�{T����j���mH�J����D�<�����&jf���X�_'����)�qt!�\ �� ��g��O_UV�}�9�9�F<6�i�3�C�����t��+y @�!UшHo��O-Y���>�u��������;������|�b9J'����}�B틯�X��Q<�m�� x><��S����^;I5���d T*m�8��J� ��aqJ�Ϲ>��{c�f��|q}PmH�(+s)��D3�kj��Ɏ�=��͏�A>�@R0f���rf���NO�eHOZ�9ܙ������B��&P���g�Br�Ӫ���Jd��Ոxzj�:�zI�?���l�L� I����L`j17�y����J.�� �DB��A��YКn)�vs���]6:8�}BU>Z�pa��*��1��\XT����ZNR4��;���X<K$��<�1���DC+]h��UԷ1�� 6�B��;�1��Q���}��e���q=��C{����q�O+���$(�3ad]��͓�(��ΙO�S(�fgI����,=���a��Z:�8�U �� ��O ����y���U�B,-�P��}�#��5���}ѣh�[;���ǫ� M�DG|�1�������T��P�[�������:���~H��X���Su����%�:'���v���1���GX�Xz{�GjU��8��N���k!���X�2��dN�����maA[�D����%��U 9��?� 8��A`�ya��߃Q&ko����D� %+�z՝~gE��(����R3ycڞ�.j�b����@(���@��:�)AW���ƾ����g�L�06��q�O?��77�8��0?�r��*)V���\á'.��S��u��8P��$�u-���4�!�o�q���}��J>�7� }6���_R�"hʞ�q�V��Y �L�����T��j��V;��~J:�1@e��mv��AǘD?��ݴQS%l�⟉/�,i4���%az�,��_�g�3�xi��E�)Za�ḳ/��֧W@�^K�b[^�y�RV�Ε����a/�Ŭ��d�+7:6;M���4�vFt��@[�3��˵4ɓ�܄���l�rL�"!���&n�yQ��'C��)B=,fI�'~ƥ����v��X��A����H9~&7�Mo�͋����&�a@Հ�W���d8��4{���3���=�t쩨}��������(e
Behavioral task
behavioral1
Sample
bba559aa96ccb773d6b9a6eda9581f54.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bba559aa96ccb773d6b9a6eda9581f54.exe
Resource
win10v2004-20240226-en
General
-
Target
bba559aa96ccb773d6b9a6eda9581f54
-
Size
205KB
-
MD5
bba559aa96ccb773d6b9a6eda9581f54
-
SHA1
751aa2418a7cb801b42ae762f07a3b50811fc78d
-
SHA256
dc922e97e0c000d6f650de38a30316a4ce02b334d010513db1db9ea829465fb9
-
SHA512
3043d9a41558922912109470f5446f17edf340aaa23f45668101ad3c057702280b3c5d9645a86ee9add8106980439b15bbbf3a1338089f5b504806ed6c6488c7
-
SSDEEP
6144:0IVYE+FC/JtTB1Lsr5F6crmKAfncHyn0oCwmXgFi3E:Lm/CBtT8FapUDdw4gQ3E
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bba559aa96ccb773d6b9a6eda9581f54
Files
-
bba559aa96ccb773d6b9a6eda9581f54.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 24B - Virtual size: 24B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 300B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE