ݱ�}غ����U�pݫ!���;��^l�7�Q�&��֠T%X-�s.Ɂ\X1b��!�XT%d� x1iRD�6�m�5�)`�W��#�7D/�L퓜季d���{���V�`& �YA/U��ZB2k(g0<h�d��4���T�)��ÎP��9��p�L���5@-"� �I�䩹|�\m%P����Ij�{S�_=T�*:�`F��U��KB�:̅S���d|��9.u��V�,6m`I^R=�K[���8� �_�b��K�o��������}�df["a��u�u�"|-�#>߯[�Ծc�v㢚���!� �*WpƝ���'{��mƱL)v��d�B�K&C��0N�n�{eeq3D�������/Zb;��⋢��5h �S��M�{&y�P�`�۴��]�nM^ `��i ��N��H5�O��#R�P�D���Lj����_���d��v�>�ɉXO1g-��h���/z�����oL�I�L��_\9۹�%A�bfԤ���R�d�e�+{w�<�e�U� �R� ��6�i�ˌ��ԉyB�,���Г�U�p}�?�k�q8gZ�N-��å?�m⤿�z�������y�#�{��Q3�����~�����ݳM��u��Z��k)��2 �w���i>��[��z��_�qm_��U�ZM{�KQW�2��Y�Y�����\j��!P�N�T��N�X�Ш���H��F��T����z���ф��9��� �;�h���E8?@�-0�����Ltt���p�˔�G���E�-b���#�b君�����{�)-m��j����s���D�tYf�������}�ͬ�Vϳڗ��D��ON�>- R ��'�pQ�j�S-�Y�ӂi������a�[���L���~�[ޕ�)0k`�|��:�t��j�~AS5���Y5����_*�����M��=[Q��4.:L��`T�+�f�.��S� `+� ]uX���i0N�GTV��u��(��� s v��ʬH��~� *x'M� �=��,��S.թ�uK���2^��q��KX�4�R�D��ݘ���h���q�?�m���^�m \4���b�A`�Y5�$oa܊��+��1ٛr5����$C�����t:h�O�g~����QXC���%զ�9��fP�S�+g��/�$�h��m�v�V�גH�/=~��1�0�BX ����+�+�����9s�1��Ru��7<�\��ǙʶJ��`#e���l��1��ޏ�Z�\�LD9�qA=�F�$���5�8ݤ��]|_J�)�?�s`}�N���lH�6 =n�Hh� ��>{]��ptS� ����z%ݣ����=5G�v9�B�A:n��͖��mXS<�9�F~=y��m�3�g�-��L�Z�8xc��/{��d�W�73#����D�햟���o��O��hT_��S�fr7�Ci��L�r ��Y �o�a��h�4>$6�Y��~o����o���Fa� D�J�G়�E�N���Jԉ�jy���8���լ�%Qܝ,�b�%�SECL�2�!�X�I��m��gB ��B�E�f훆� ��`I�qU�˹��r��5�.]�+1�aw �T��x��7kob�IM<"�^��0����|�2��!Z���`�D]���v��(�*L�aK��+��[�L,%�����,+!�$�F����r;���l��k��r�[B�g3��v�_]�Kdk&$(��MT���i�~vv��)�'myWE��t��X�Ej<��?����兿���Ώ��B�;"��^ �Z}ȷ�A43�D.��F������k�\[��0Z��#A���W�v���T��E*UZ���G)A�6Љ��@�@"�"�N������,z��E�-=����`�)ݭN`�!��:.&L[e�a���?A]�-TD�Sv�( ���8LTΩvK���~�l���x|�x<����RA�uG�<�&�\���+�����r<9����J���o�yL�:?I� q*�"���PX]����(��ı9/�cØgjP��-!�$dd+���������n�W�^4�t]�0}��.��U��-�%Ӫ�������W )2ђ��UD]c8A�F��zJB(rvR�f����>�"�f�<�9��˳V�׃Tp���^wa�f��0r]�Y�}��ْ�3�4߁�D����!��(����C�|����Xv}�8U�1�%�թ��;��E����f.��ɛ"A����&ұ��z�-N��Q�5H΅&1�ߨ����2�$h2��ڏ�P+����p����>�� ��USH��?c�Mp.zE@a�*��'qSKS}�V����-�hu~{� ��%t<zpH�MK_��hI�4� 881�����u���Nq�f�%�հ:by��������K��1�29fX���YW��5�<ݒ�&`��\':D�~�2��,�����z�� �v��f=нo!7����g�2A/LkO+��C��1 �p?��4�5�ī�@}T��8Z��j�."S�}��4���L���^w��R(tӗh�]mS�������?���S�q������ �S!=���Ağd���ki�O@'�����kհ���{�'�T^bj���w�Q���T_�;\S ��|OCJ8�$�]v��J����˅1m@������d�%����ѫ�+��q��WSi|�ߨk�&5Fh�H'���q������f������4��?���8����@��1�R?���:�C���}��b�xojM%�k\�8מk��R�y�2*k�!� �N�GCt-w=Z���V �r'Y�T��ܼ+�¸@��y�؉������ol�z� h�*��@�aARE<�e@��� �ʻ� � ;��P ��,�Ɋ�i�.��f�Y�(����]߆3�N/�o�U2���y`q�6Д��+7�S�S;u��̪�����w���3����zVD��t�U�H�h9�즹�"�>��Ǐ�$\���+�{&{V�e��ԉ�fU���*6i&x���+=��Ր\S~xh(�U���3�m =�WF�·AX�Y�}���^�F����_ס�♮�4smrhԃ��&��;�|v�
Static task
static1
Behavioral task
behavioral1
Sample
a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199.exe
Resource
win10v2004-20240426-en
General
-
Target
a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199
-
Size
816KB
-
MD5
13b55cb6496fc371330edd5222ce4a7d
-
SHA1
964f7a4e8559e358c689e218018c3c7dc135eb35
-
SHA256
a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199
-
SHA512
5520e6b100062b3f2cc9bcffeeaf4c6af7fe5c891d211d625a0d1e858e53f04426ae4953e553af18abdc995664d80fb6cf9e5e54287d1a51fb589d342610fe44
-
SSDEEP
24576:aY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9O:T3XZynV4oDabuWbDQOcIxJJ9O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199
Files
-
a2abcef58ca4622cd63b220887be0659e69ff0d517c131205ac426b7f1083199.exe windows:5 windows x86 arch:x86
858aee865f44703f181e0ac78825594b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
SetFilePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenIcon
advapi32
CryptGetHashParam
shlwapi
PathFindExtensionA
Exports
Exports
Sections
ZvI6u Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ZvI6uN Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ZvI6u Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZvI6u Size: - Virtual size: 674KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZvI6 Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZvI6u Size: 804KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZvI6u Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ