i���럋N�I^�OJc� ���&���վA����p3q`y2�^��g:����_#p�<gY��iw���:�|YX�&�A�������F =���b /��9�d������}������m6j��IM�m��9����c��s�����+K�� ���S0�����$��H^K�)��(��Y��yA�t�Iji'-]}{1�gTM�H@�q�`j��2jp�J̤r�&�}QjB�j�@�Om1q���̷nW4K�����OW(Ȗ�O��T��]�Oi�_C&^���T���|N5��O��$)��Eo�IbZ�~�Q8e�I_rʱ �5�f��e��]���d�S���y�/�%����e��d��.����-�E[�1hO����tB���.���rĮ�@����թ���v �;�DgZ� �Y��� �@��G�1ϥh����cMB��0Q��y@��A�f�?1��1�(�wȧKE��I1�F����ƻ �N�M�`���d�������xm����C�A�4':��#Y�*��rq�i��\�8R��*��BhT�nQ��c8�=�Q�Y�)$,�L�xS2�F�]5�,�N��.h���cp(�A�=�*y�%���ś3w+�J�gh����s����|*���y&~���+�O�T��0m$���/})���#��q#0���j]���6)t����lj��(��6�c:1���ܳ@��i��69(�^<��r:�9 hmk�� �U���Q���UN��qO� �A��9��o�4.�Ө8��7�f[)��MTS�cn�ڋ\�g�s����4珨/d�j�!��bl|h��/w��p=����.Dy�C���B%��jVu��n&���h����y{��Yx�����|/4A���4e�*W�#�~�}2G87��^9j)�2K��&w�鸍T�K��߂'�)���[M��k�9��Ǭ�,�EL蚖`f��=a �:>�[�Π}1�jΧ�f$�6hTz��e�� ��grei}�n� 1�Z�a�xy E�E��(�WΥ�0^k*"N��D��Ҹlv�����9 S�`%� �g<R̃t� t��~���V�6a���[Z#R�ӄv��WZ��i�`a��G��n���<�$���Q�70�sZ�(� �šό���{���=?Fp����[/ d�%*��=�H���2��g�7��9�A֤��X���c3r���v�~���q0Xk�d�H�� �HR���q�����iDia?�<ec��������=�|1P�{j!�D��`���kႰSk�,`��{��q@�k���5�o ��u�&0$$��R��R*���LO�v:��OԘU����s}�G���:�����wV%*#P���d?:đ�0 |��q��i�-E�u]��4���Id����Կբ6��>Aw+�� �2���ns@�j�UMg��]��p��Y21P'��g-�ZW|���ג�u�e&�ƌ����f.�����̛:��ix�V ��I��]�7�K�?�����:l����1ԜڴL�@�����T��G�<�WvFI����~a��c���y+�;R�˥%�1lW�ܻ<[ħ�l+��^VcM�ٍ; ��S��������={��=,�2����Sl����{�i!��7��k5���*睊�C���Jh�*h��H�a�g0�+95���媬�v��Iq���Z �G�F�}i�R��4 'py#��e�\ �z@�.��ѯ����E���ݶl�a�FkW#X.��h�]�5Im&�%�6��$�E���)R6$����j��[ BŗN=|l�N���q¤�"N�c�����aU4���s�GU��Š������Pxx$�����"8�T���H5DL[�6����NT���ܠ����n�qY�J_`)F��qX~�T�|�R.��0��zVC�2&���c��x��h�� =*�Q��h��M���yD����C���^h���T[��X=_�Ih��0�y Qcu��%�m�ڨ:Ab_� �bkf�c##�v ��NNyljY�`�2lw#��t��Bt��:�����na*��;��qJ�{�`yR��Į9�9Ը����!"����z"!�_#ltFI�-�NN�j�! �|�n�F��*�~�o �WP��&9z�@z$5<OnD���ǥ���W�8� ���t�г���nw��"V�B*�ֹ��kH����V�{{ ��^,����&!�U"R݄�$1�G��li����� ����B��Z��M�JD5 ��R�聱ի�"�ߊ��`G��;#Rs/�]̝�/��'���:_�Н��b�>e���2��'��� ;~i\LJ^���&��I=e�r��Y1{�$*���:EB+Zά�����/��e{�� �)/x?|ȟ�-�_E[ջ�2i*w�.Vv�a3 ��xA�-Lf;7�&I��$f��ׇvݔ�z�x`�G�[IwJ<��ֹM��-X� ֹ��H��k�J�Ⱥ�^�ʈz ���x��Ս۟�����54FS�������bf�ejݪ��.�_�Vk]n.]�d(�TƄ�^�{���y>z�4�p|ݢ_�`?�����-��{۫�3��yn�{G�Pބ��o2T� �u��z?���W� h<�?� � *�}dH^ի}��d�S@u��cr�E1T߃���{�'J���O��:/�ܡ�X��L����Q��m}�)��TP�?�(���H�{#?��/r�|�C���s�`8s��%�k3�� ��/lD��kL@�1q��b��C��@X`?����(�Ԑ���B�T3zF��a���`���;?G*�t��νԟl��c����|2�-A��!]MU��)!��2�ʛO�|-�asd�D�j�������M����� ��K��C�s�O�\�;N�Q'CY��^htf�)� ������$����#JĦ���%����G*gR@Hfͅ�����E�$����y��&�i�Dh�['��#[�US�ۚÅV�����+�\�����]��it-��z�D^���E�� 9C��}@�ԙ����W������Ly?@э�C��@u�%"�N
Static task
static1
Behavioral task
behavioral1
Sample
0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860.exe
Resource
win10v2004-20240508-en
General
-
Target
0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860
-
Size
7.9MB
-
MD5
5c60f0e42a1e6f4f596e04f9dfbfcb19
-
SHA1
b4168299debc66e2cfdf066ecd831b38c685c019
-
SHA256
0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860
-
SHA512
159aecb21f62b73a802a4154addd366bd09a4e76989a37e731799fa96f3917acdc1e17e49115add3a88ba663b7fb15c2cfc8ea2bdae0a8a5fea5bacda9887c51
-
SSDEEP
196608:9ns434pdSxiwAcoKsEs0WIPD2ZgUDSyNKYiYVVmHIUfIMPi:9nkj3tc/sEssb2ZgUvNnLm9fIMPi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860
Files
-
0a2ea9cdbd6c323c9902cc3513e56cb53e2d5b1c15a639c12b4c14b190e10860.exe windows:5 windows x86 arch:x86
a2da68e6ff15f03bd1967dfe3f829836
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
CloseServiceHandle
user32
GetKeyboardLayoutNameA
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleDC
version
GetFileVersionInfoSizeA
ole32
CoUninitialize
comctl32
ImageList_GetDragImage
urlmon
URLDownloadToFileA
shell32
SHGetMalloc
wsock32
closesocket
winmm
timeGetTime
netapi32
Netbios
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 50KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 80B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ