�H�KݤS�!�k�������ǺI�[�pP�'������7DG�_��Η�LY��ѫ�5Xf��2 ��5 }�:�|�tҏ�o\��=�� 1�y��L��Ð �&����^�� �E�]����`���%�4������ی-/I�RM���F7�ͪZ{�2��qZ�'�T8�Y����� λ1��'��%_į-��q��HCw:���C.���ҏ� .nn��~�� �@�Ҫ�NC���l�.���C�gq5/�� ���{Q�3���hR0�g� X�n��F�B0�2��c�A�.�aďMB���X��� R���������|�=���'�b��3fD{�����Q�������J����qXK=֊T��9O���Յ�i� e�� ���w ^�q��9����ݟY�����fcl�� ��6X���4O�"T��~�>h�s>�(~41�K��a�� �U-���/J�;��@�]���WT$?ڬ�I� �KW��걧bvg���?� p%[��C��� �B��38e�&O�w"5�^<7��P���ch���E7r�c�*M�%���o뙳\��!�2w�ZM}Ug�0�;�#�3I�|���g{���*����}��D(�Y|���#�mU����y^�2T#���v��(1;�c�~x�h���,����gۗ�_��? �/}+ ���*Q�����3d`���>�K���:G�ZMb��O/�Q���M<>�E�y�]y��6�����\���?��}�vJ�i�S�a��-����f�7�US�u(il����ж�� 'ebLa��1���o���[�T}�d����5;T�m+�N�/%��Lԏ�؉ӪJW�9g�IĐ�r_�;�m��(C��$�3�U'�J�o_�ٝa"M�Q������Pid�.�'�D�ռڞU������̝�`�_#n��FW��%���Qw���lq%%*f������)lp�˝�g��C�C���{��-�L?%�o\��?�^e� }�Q�)�|�����hs��;dM����E� 3���*������#�#Q����E{��F�=���h}�R�}��ш�S2 v����o��u�s�|�ѫ���jx�?� ���7Oa�Ir�Lu�Ŀ_&㻎=VP�B�B��'��'_���K��=��%c�E��Ú�|Wi�K��w��z>�� �����ύ�z�5�̖��(x�Q��~��c�ډ�o� яS�\�+6e<�$E�ɅN�6Q��%�(��^��lq}3r� S1�ă��z�}�Y�Pk�O��������P���Π��_'�ѐ���`?c����K"���6�Y�G�&�� L$5�4Ǯ�&�����t_�ީ.�Ћ(�l�e1@�\�T�<! k���/����ZW�ȶ��shb�?�-��?�=Qk�0�'aE*V�&������b\.����)��U,^%��s�Z�B:ݭ����I�s���,Z3B(Ci =�0.��~ a�X_�k)+�����t���Q���%(��^�?u���rK<E��T!���}4�V���b/��+n�l��#�\��X��9u1� ;��>��q�Ϩ�!~�h��*J~�_��l,�o�� ����r�AH�a���q�b��j��K>_��o��w`� �$n-��|�c�ǿ��-��j��&��R��N��_i~�Pk�='ob\�Չ���KnS܈�$�$��~2�ܓV)�/���!Ț4h2e����Y�� �V 9���h`�6O�}=Ͼ��bv�,�j�,V>+w��Up�4����\�4��ԗ��M:}�j�9ډ�o$pҵ��g���l�L���a�W&�N��P����p������s���Co�r�x���y���H��8�q �Z���*Oբ�T�˱�~�M*v������V�^Ս��� ��娹�9�/����4S�Fn/�G���du��B%>��d��~�@V)�TU3�����ie�*�-"�0^X1-���Z7ļ�y�=j'W#8܌ֽ%��˃��v4D*ϴH��Q���B�9���W�3 r��X����I��j�O 5��P�8��2+OՐ�Q�6͓���Q4��#���ğ5�`�yf����F�cB��?��0�#���\:Κ�Ll��8���i3��0sj��DnZ�i�D?#~��%1�RJ�����.�O���������9��F�v��3=�E�U렚������C*��M�퐓p2��C�9<<�����������w�,����u4"?B�ݲTaM�:d�y�/j��Z�KG���)Y^��/�����f1 3C������^����GR��:�;�ł)��\-�����6�"\0�V7�v�6����)hx����' q�NlZ�4���2���2n�����us��O�G���:X �?����O�>��e؇x��`|4�,��El.�{S���sp-��xy;� >����g)�%�&��r�T7MG2��;�� ��^�@8�]����(iƸ;ؐ�3n�ƣ��N>{�b=�& �+��m�� ��G��vE������������>k�����ZB� 쳓M���'��Aոy�B���g� �嫶SX�n-�K+��_i�0,(t@�oש���XDl���9���,�d�ƁYF�Wr ��*�S���mLH.t��R��l����k�����%��s��iJ�i� f��<�ҩ5���ZKJ7Eq���t�m��v�\� �I�����6As�ia�� �ޜ���"�k����mF���ʒƾ�N?䌮�<ؒ' K�}-�T��?i� �s�&ªs+�7[���n���|*�졼�۰C�>�� �5�m�����4���%��%�k]d���<[!�A_��V1�cC�r�lܐ�:���r]�|`�E���Y���S�v��'D/�߾�)�ְ%��^�r�v ϶��}���,��y��Т>B����o�N�4vٻ����l���dJ͑�Nĝ�t��&��u���d�g��;IC��6�E�"���1-ʱ���r��AP7e�-���T��C�Ί��h{no���m�ችV��? _
Static task
static1
Behavioral task
behavioral1
Sample
2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99.exe
Resource
win10v2004-20240226-en
General
-
Target
2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99
-
Size
796KB
-
MD5
87d79fc4fca499fe897f66da46b00e5b
-
SHA1
a1615b7cf6fbe1041db729c654b15a7a5797e940
-
SHA256
2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99
-
SHA512
825c88f71aeca5c8289ac0d94accfb5876a29ab3301e0d2d7ffa2d870a53f6998f0f2ca67bed46e7794d85c704a517437399a436d47dc32c592af892eb9e40f9
-
SSDEEP
12288:HJz0eysF3ikNgyhk+YC4DqEfFX4UWRfR50kFiGcSroPX/h4j3depPu1P4Jxf+:HJz0Q32wktqgHWvGNpPXZ4j3depPuYk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99
Files
-
2aa3936c09cf67cb6b4ddb068509ecba7b590ab8a70baca4b613b871a08d9d99.exe windows:5 windows x86 arch:x86
4712c1cff07cd671477e333c5e6ecd54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
CryptDestroyHash
shlwapi
PathFindExtensionA
Exports
Exports
Sections
6Pi7a Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
6Pi7ax Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
6Pi7a Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6Pi7a Size: - Virtual size: 659KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6Pi7 Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6Pi7a Size: 784KB - Virtual size: 783KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6Pi7a Size: 4KB - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ