�>e�+�v�R엽mq�'g�m�eJ��7�Ő�yaW��G��F&j�c��cg��� '���~]��ԛ;Z7mB���Tx�=�����?�u��{K�f�U�L'��)�ԇ6��"m�Ld�v?pW�� �8ւ- k4��t��0|*oAP��rZ�N��9��x9���p��Y:�`w�~Z��3�����h���w�\�D��V����Z6���7*����"7�c���ߗ�����,��nR>����#S�8��KRw+�E����&ZQl0��> �cM�� ��ğV�hO�(��e�w�!F�����7^����Ox� 啃)��4�S'(y�s���N"E0�F]}�p �4�Y>�n��{����4�j�cbn�=?�Q[���Q�����Gq��bZ�n����:#2g�=u��>M��|5H�;���v%�nk��9��}ɰ�:a��LJg��,L��ޛ�B�a9C�7��h�93��� �4����xZ���Gʝ!pG�X��)�;7� �n�Z����If�4�m���B}W����V����Όy�8����j�"a�_l��;Z�Q*�ytL�r��r)O��/�+�H���N���e��e������'z�|UD����(#7������Ҕ�:��^�@3���]Q}�VRS�DZ �8�!`9fq���Lq��FM�t�=B!�����EV�oϖf�c"rR�g�ش&c��hEFӊ/���`�c�I�j&�}ׂH���WESb�Bi�9�UG�ʟ����H��X�:�i@�Šh��k��D[K���/�����՟ =#�����B�ja1���2�oGr'���#�6�D�į��t,����ٶ��hq�;�j�V��=f8S�&��Ee A�� Az'H��{-�q��$���>�yD��ԗ�X�鋴;[w�`dԴ�w�Ď�E)kW�?��i�S� ���F#�D���ÿ�B9�~���\)��9���\�Z6��Pq��b�/P܊ܤ��spaɭ�]#��n,@_�5s�����7T��n<p�)!��zsg]������ f�*���kST���zxo=e��������*'F�[L����pP�ű;�}f�(w|p~��;��������=\�䣾 ���q�/�ۍͨ7 �=x��`�^Մx���Š6���44��� t��X�����R�q�!�i��*���~�G��()m;���&0�� ��u���h��l��� ҧ�JdΞP(*Y��� 0��xE�[��V�d����Bކ@D���l� �m�� `k K���e�I��A��֗PL��$��l�#��hͤO%���� :ڠ@T�R<�� �����$�lQ4�e�Ǔ�@c#�� N�����P\����xgX����Y�+�,S"����<���Ʒ��:��-�G�DS�wB��q-k1 ������e�mi"���J�[�n��������㴗�O�V�����c藟;��a�\�`�u�����qĒ(�W�����Dh=���#��^���Ån���<��0�UUO<�gE�1m�,��٫�߽7&� p^=��I�*�;1�0�re'�Bz��_�0d�eW\P���=������:|Uqԓ���&Q#2�$���0'�xe���>]�.p�PN�Lwd�,H�]~%�oW)�Z��9U�//} �A���|2�@$_����By�R�nR���N��,:�53��p��dAZS`T�W(EDh�hcA,�F����>_<��FD���l0���+9�'㢸I�J�pS��궹ɞP4ɅNq�wAY�� k ��6 |�n�o��:�[��3�\/A{O���E8L����/ ��l�w�>!�� �$i�B5��:�ՍX�xөɴ��S���>ol����!d���d�����~��;T,�� Y������l�8[֨L�M�] �1�˽>_���8��-f�}O�<�Pq��.���pG9W�_�S�k�bO��~b9B��o�Y��������L���rZ��\����&�:�k|z�4i=��/���\��o��U?��؛��������g1ܱ>r�S�v����Ǹ��q�?�:��]������.ҧ�/���C'�X<�K�m�>2Q��w#�̀��ķ�ۮ0<&�t����і̜�Ti�*�ޕ�Q5%���81��KNf3n�d��8=�LV�j���G�Ht�#0��N�|�H�j��[EA���oܲu=`�ꛏ;^������I�h2 I oAv"�iڐ�1��1�D��$v�ѥJ~���f�)>�:�yh�� شo�F��^3�h¹�q%.�J���HʛL ��7e�b;�_�^������d��V���Z1����GR��b����YDNp�$�� � �`����)��s�K;�<�F{���/�@T1Ү+ۄ�F�M��>��,���.g����V~}��*�lT��#�3!��K`D @#����z0�Ӭ�J��+�%�Wt����QIS�.:��m���E�tv~Н͇�Q�1�k�DP��ʹ�Nml0Yfޣ= ��ŰI}������w�UvH����1�F���'Ja�8�#�mms#Z��L������./I�sB9� /��ɀ�[+�u�.������.� ��vMP�&D_$4L�-3�F�Ew�0ۉ�@ш��җo�A� ��X���U�V�dҝ������bL��w��7�U��{@� ������ �<��R�� p�C*�)aC�J��CS��v���3�������10��t]+K1������9�A�o�|����*�����b'��;49��H�^�#�_8>�)n���E-j��mχ �v��!�,5~eZ���3̼�g�R��$�Av)�[��9S7��=����P|�;=9>{�b��k���(^ ��ꚋT;X��}>7N Ȁi͗����va�R3�����Ԓ��,� N˓��!����v5b��/��i��9�Y{#Uz��H'�T��:K��>X;�����EVO���|4A3��t7�j�Q[Y�y���-y�X�jd�&r0��L::�U�i�]
Static task
static1
Behavioral task
behavioral1
Sample
a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352.exe
Resource
win10v2004-20240611-en
General
-
Target
a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352
-
Size
5.5MB
-
MD5
d870cac7abdd1fa3a7dc95c1723963d8
-
SHA1
1ef30497092044babb6c79d42bf42f145ecbb3d1
-
SHA256
a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352
-
SHA512
1c3a68cb25f8895abe0bd75cddcc9c22af88b6df59f6033183bb88ea1068708bbbb1b8b983635fffd648e2dcee5cbcb87e7032c0efb4fd5e311de56f3d926104
-
SSDEEP
98304:XlTAVvwM9VEqkZRlWOxMBZ9uh/rlSbvkgSXrgTojeMMFN4veBs:VT07z6ZRoOyl6okgSMTy0N4+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352
Files
-
a0e76b064b0d19bf16f975477a3727f4b35f29a3fba9a08533f33bba46884352.exe windows:5 windows x86 arch:x86
26d961ce3aa2561a41e9a0fa44898e97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
ConvertSidToStringSidW
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ