n�~����������Q�I�8������k�f��Vy�ZZz�$j�ц|���b��X._H4k�\Y��Q3v~/�=����Vcw�.��l"8Cʘ�1�`_-c.n@��;$@4��8I��F�+>��� x��D%�F#�HL�GM��n�z���z������&�v��}E��f{�=��: �ZWtk�5�սޕm`H����Z��#�m�1:�kg�fPf��ץ�C4{*���p}�g��E:W7����u^���1c]t'�>���(!��c�r�;�//�ml+��XS?e~y���iI�5§a����[���闉U�.�UZCj��*MR�.�zyy]ݓ`*�jdB�q�H5l��y�z����F���Ăٔ �����?h�m�<ⅉs�m5'�$w���ۚ�e����u*�� ���w�/+1~g.%+>���y���o��V�(�<J?�=��e�q����m�yK�d��b�M�̔d�JT�S"�x�H���6�dz��|ĘO��!����v���[�xM��wQ >��x�&z��O�`�����R��vO%R��1�5�)��hk���C�D2����B�ړ�R1C�K��/U3���A ibr�������Q������{NvUd�L����r{bg�sY@}�b[�i0�"�߲��`ΰ-�A6F��������>9���Q;0��Qd�X��~�B�Xj��&�r��^�7�p{DJ���?���+�� �u��$H[%̂&ʼn[@T�\�g�O����-�͘>�,��a�4���!f����f���pPČ�ը�N��{r�*�'��X��9ɚ�K~֦k����nj���D�Jkb9\�����I�(��7�@�W���s�迃�S��XSa9f[ikG�Qиk�Hq��]Ϋ���w{�}j�<c��ca�O�J���F����aC!��MP4жbI�����o+]�#+:)+�����Jw��| �M�R��[����isF5��F�j�E��a�,ˊo"^�BkoEKb��,�)�b:l�~2�P�실 d�I��c��jf�}�e�l�H�0��>L��(?j/����<k���6�&��Iy��2]��D{�|�G������7�0���rF�@.��\��P����=* ��;SЫsQ��2�I<�'���L��gju,���|��n?;03_o)w%�����Ԟ�aTɷ���M?�t��HO�%��Fg�]��x�5�{O?�N�I���۴u����_�;?*[�d�Tx�| ɨ��GD��.���P��$(z���A1��J��/���j:)+�:��&O���DҶ^�!� *�)� )�}`� x?�����������F=�]'w�,Q<��d4Nɲ�c6`'�֫���1S��#�)0�= @�-5+0o��Z�����e��� m�וW�|��^�H"�yz��bh����-}�c��X�~'��n��G��I��S!%D�J�6�V��������-k,�F$8f3+��6��wp^���� ���1j�̉K��F�'��a��ɆR3�U3 �S�(�� �����{]���2װo����k�� cz�qH�c�ӄ�����k]�W��?�Ϫ�U�X ��Ƕ2��P&-i�E�L����*�N##1v���e�����c�~��U<vǮ����ܤ�=��:�`�7(J����Ǐ���MkpA͞pky���p�Z�7��T`b@�P�__~����@��������+UUD��(�(�I3-��P��y�VQ��������Y�� a�1�K�q���,����LᱮA� HKx&K�O���(Lj��,+��u�to�M���|�%�������&��9Gv�1S ����F4X���֔�R�Qp��iU�����E�p�tg�-�y܌��ziX�G!�W����5�\���E��̱; >!.��6v�M�8�O�6F�2�@n��/<s]���13{�k�c�v7"��V}�d�7���Gc�"&��Z��zQͶ���C`ë9�@�腸�b�^9��F}�1L�?c̯��]�@]�l@� o�Nt_���&X�(<H�`Rqf�v&��6�`|����"�����B��Q�jU�N-Q��f5�I����' �:�m*S�vH����0��b���ܱ��9 NU�o����r����2uL�6Az-�U��h�7]���43۱��DRy�A���1A�~.ՇM�����j �DQ�.ȿ�X���O��t�\f_Y���{���i��aA��&k3�bØ�����^�<�ez����`W�Q�/�LaC̫@P�ؖ�vD~�%h����6� Y.[N���*>�"{���)bD$#�5WX�W!�n��~n�5S� �Sfאg�q!*�f^�����{yM�W�ap��A��'�>�����x�G(�(fyo��t\���-����i�����s�4�\��A�P0���%��V�{JiE�ӯ����A"F��/�����[��P�O���_�q7���5���OrsHp�L��S�����a���?<W�����ȩ�9������#\u��� ��Ϙ�T 疒��������W��=cֳ��ИB�����S��H�3�J�:��)�9Z]m�~�E�L��h��,�T��I0/����R���3U^I創K�ᢳ@����xaU7Ϣ�t���9��t�_}_V)s�P�JTVD��Q���N�;R;C��ј]���\}���J���)hQ�~�H����G��y?f��s��%(A������jh��U"�]�AHAA��`G�.�~�ow�� }�8��a��8_t#��N:t���]>�! �-�A(-b����0#I�$�7!�[?���8e�?��P��ސ^-������ZA��r�¢�"����^|:2��=��h���L2֛P�g��K�n��8���cX\��#u�O�2:V�U54���9I�EI�{��`��6M;\n��9kr�bO� �߈�&-�Sw���E�Sy�kM�w�M�l��/�JZ#�U�0v3�_(��ؼ��<�{������1?@S^2�`R��1ǔK�+Ԋ+����j!����bKs�L�m+?���F�i
Static task
static1
Behavioral task
behavioral1
Sample
20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9.exe
Resource
win10v2004-20240508-en
General
-
Target
20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9
-
Size
12.9MB
-
MD5
2187bc39df3943820c786f64c9884514
-
SHA1
a5e12b055b4a36f1aa91ae8565325c064ea38890
-
SHA256
20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9
-
SHA512
23f328630309217f853a2d2c3b336716dfc3f1e8114ba588c24c901a22b1efd213f1bdacaa4aa52bd834403472fefda32cedc94f160311af9347ddfb5014bcce
-
SSDEEP
196608:/Ip7KkK0di4BZH9m+tBJ6WXEF3bHNkl/mjAZyiGxjFu5cD3+dmaiMyNDzncjK/Y3:wDg+bJ6Wm3bHNklfZ6XuaC4a2znce/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9
Files
-
20aa3178de5168d443b7f0992b04cc35915bcf7fa09ac0856e736549a4fa9bc9.exe windows:5 windows x86 arch:x86
05c79a95f5088375cf53e1d5e41d4bf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextA
ValidateRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ControlService
RegQueryValueExA
gdi32
SetViewportExtEx
ExcludeClipRect
winspool.drv
DocumentPropertiesA
ClosePrinter
comctl32
ord17
ImageList_Draw
shlwapi
PathFileExistsA
winmm
waveOutUnprepareHeader
ws2_32
ntohl
rasapi32
RasGetConnectStatusA
msimg32
GradientFill
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
SysStringLen
oledlg
ord8
wininet
InternetConnectA
comdlg32
GetOpenFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256KB - Virtual size: 587KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 256KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ