�C?W�0���W���lϲ2���h���yL�Ľ��4��G��Ő4^�ΉqJ�x��n��'���j��FR�Pj���L2�6v;�0�}��j�����(�N(�҂N����.ݍ�c��ƿ@�VǺGoJ[A�3 =� b?���S̫a�q�=��m^�RSʢCs�'�S7633�r{��)����h����~t�?��I:�RC�1j!2 ��~B_KHj5x���l0����?̂i�D�!a�c�e�q���J_�ֻ��U���~�./����9��P>o��7TS[Y�ML���Fd=VЊp ]���%�9��l�Zs�a=y�e�Se�A�;�(��(~�LA���R`ߠ#}ؘ����n��$��S1Sp�"��4��A7�-�;�,���]���[ Do WZ�ZG!x.a~�g��GجR��Lo� ��Td.dš��rݟ8�ė���/#��Ԝx����9�\��k�c&35�&F�u�e�+P�,��m�_I��`]�`՛Oq3����8�� ��zkQ74��@: ��e_�=̜%�b-�v+��pO<�8�ݍ);nhe"My:���q�h�Z�z��}���ij�jO�z����pudZ�����`L�ޡ��$%��)-�s����n�F���w42�����&��������XH �����8ʋAA6u)�0�s#R�ȍ�4I��\L�����KG��A�P���Qr���d��1��[[��x(�lS*YcY ~����:�E��eo�%��"5���2��-���Z�7��%�� ���\I��xn�-��ZL� �U�.�_Ȩ��]\%��=����>�5p�`��Yq\]Hy�� _�O���sw��^3��i�CM5^��_�̹��@��O��v&�����y��_L��{��-RN��6� �-��N��/]|Y��%3Բ�?����W�c��Ւnf���d=�^#c�ps��s� q�w�+iL�bf0���j��e�ƿ +4ZCn��e��wFU;�C�;��GQT��4��1fogP6 �xξ/3���>�vX�����sc�i8�ߺ���#SX�_!���Nѥ���hRX�iQ��yCr(�A1�-�kD����k�\����Kk�1��`\cw�]�x���8>��V�$s-����g3�p�0B�ݹɤ��+LU&>Z��1`�]��E>�L�3��u,g�5mkԲ�NR�`�~ka��Ʈ=��[��߄����ad���jGFR�_�T���7���mPi눖?{��Oi� �*JOk�!���Jzv?���VE���iAے��F��h=�����u��~u��=�K�k�F���\�5��r�e�W��N����ٺ�ԯ��3�ռ9�s+F�8��ds>W�f���$��>I#FB����i�b�Ub�%ʵ�x�Z���Q��c�'�>���M�rz V/$��6�7�P����I^^v�V�볩v��L](��o\n����i*ƻ�hB$P;��iY����C�����*�SA�y�p�� ������Q�C#���9z�:Q�%����HL���\g���*�,�B�m8J*γ��i��1W�r@^]Y��O9��*�AE��U�1k��ܤ��?d�2���F������DB��圼�(ֹ�iN��@��>I���=���w�k���̽��j�c���J���� Ae�/1 P�����9�@�Sa��5pkWȩ5Vl�% �:tx��L~�z�B�!����S_�<�������:�{`?���orFG�@��eRMg6�P��v��0��t�kĎ�s���\��5�� !���Ì�Ҝ�~7Q�Mo�D"�U@�l^Fܖ����C�x�V�����\K<s2kc��қ��M��ysꯐbw��E ^��3s��8����]�E�9�8�V�U���9�]J��, ;%|������.��/y�D���%Q�� @P��q֯�[<��ԭ3e���ܣU=X1�/j���N�͐��3�q[XM���>�t����.�>���FK��Ys�\5N���[����'�ۥP��)��5Nn�M&�������+w,�R^6������#9��J�K������|a�o�C��kߏ�`c�� �3��F�n���(�Q"s�F��ɕ�B��4��(Չt��'���_x^�pzk ��j�5�]b��S-2i/3%�N�d����VM����_���x���]=��S�1H�)T���i�{R�����X��X)췻�Y�8���xV���9SS�ٗt]��U�MLz \��s۲쳣Ze4�3�Z�/az0�������i���,�I��J]]�����F�'���kǴf4 ���1��6l�T�.���8��SPQt�7�]}�d�&�3xw�Z�c+smEfЂ�L�����| d�p�#M$"�>͂8��BC�%w`nc�UD��y;&:��z��A1�q��u��eQ��J�C���}����/��FO1�'�Z�*n�{ ;�G���(�i���x���_f)������K�``���|� �W"���<,i�p�]4��3�3�7�� ��gl|�,vEWH� C���A�N������)��7~};��X�2vڿ�ԭ7��m��rU'�V�HG*��/3�R��IZ��� 7��1��� ��f�������q�@}� �J�jЏ2ՊЯ+4���S!^z��n����'��̼�.����43 .Z�{s���S'���6Xy5V�v���ͱu�n�nXc3Q�CL����1�g� T���r���C3�}o܄ZW�T�^��Sv#W�����״ ������0����1|��uLF��}�դP��Uێг�{ 7����*�>�Z ��� ������r�ߙ;��^6^�W]ZEU�"�dNBQ� ���e������Y��I��іaSzq�9����Z�g'L���ϊ1S�OI�G�QP�������]��2��O�b3�8�r����3��m�;�� �+c3>D(� �4���kK�{��Ph����ɺ�S�B�b�s4b�H��u"��6�x��vk�)3<"������{��K��������#v���p��_�P
Static task
static1
Behavioral task
behavioral1
Sample
aut.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aut.exe
Resource
win10v2004-20240226-en
General
-
Target
aut.exe
-
Size
7.1MB
-
MD5
e4fd24097c2424fd1905c923a738fb92
-
SHA1
212a784fc9f0032d48a246636325e152086e5107
-
SHA256
e24fd9f7fe77690a7ade8ee5ad7357ce993640385c4c0e3bc7dd710f6061d33c
-
SHA512
f717155bf525b73c421a0cb048e9025dcc3315ba56d5794d113a4f33e2c4ad92df70196e4052916f1b281047bcd4187fb50df91462a7534453be957454e355b0
-
SSDEEP
196608:vqSUA4fBWNmM/4kzQpqu+2p6ktIqZV/3:vq44fBWNR4k92p1txV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aut.exe
Files
-
aut.exe.exe windows:6 windows x64 arch:x64
9694a981463331a54a7961c6a147d6c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtQueryInformationProcess
d3d9
Direct3DCreate9
ole32
CoCreateInstance
kernel32
AreFileApisANSI
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
VkKeyScanW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
CopySid
shell32
ShellExecuteW
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFindFileNameW
userenv
UnloadUserProfile
normaliz
IdnToAscii
wldap32
ord27
crypt32
CertGetCertificateChain
ws2_32
socket
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xzs0 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1337 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xzs1 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xzs2 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ