���P4z��݄�P�P$~%���5Ȑ�eM3�ԋ]Dv����Q���2)]��jBnV��:��4��B3�z�3��?�h�a�V9'4��f���a��O��E���%)�J2JO��:2Rl�R��.�3����i�Bd ��ԀӐM>6d ��嫰��>]��e��DN���O�\F\U�?�}���������Y� k�Ӧ���E�T��|�^ĞbJC1���ʙ��>��L�y��͉+_dU��\�羏ۿp��|�8ɦwϓ�? �C9J�Q3�����J�Ņ�0�'jN��bk2�v���a7�2�;���V��xk�6a�����-W�p@��ǻ���.Ķ�_G����u=ȇ]�S17���S�_B9t#{�=܃]�2:�[�y��#~+�s4�����bw���w������6�f������:���r�]@���]Y]�TA�^������5/)��ؤk��&qV��0�t:L�Ӻ� [f.�'�\��l��½l�S��W��������)�6�Og;=N���]�cRy��t��Y�Ւ��)�|�8�@��u����M^� �h��d��|;���'�����e�;�:����@�W�*��J����?��au�[�q�~����@`l���H����Ӯ�l�HF�\�~\��N%�eo'��2���&=,<O{|��ٴ��K�S��1|�F<eddx�ϛ���l'x��OP�����]pZb�!�F,̽�%%w5.��8�����Ai��q+��GN���K[ti�y���nzv��̿Q���HNw�֊d1Ů �;J4�G�%��X��~L��Z���>����AcLu��I�'����Kx����\-~G��r�n�Z�R`����/y������E��&��۳j����; F��OIe���ɑT�Y�_�9�ћ7XǵQ>�*wp���R��L����������E%uR֑G�س��x�k`]ڴ�$NW�i~�(o�^���<�!�N\�a~��dc�d{T+ڸ� %%a��Ǧ�P @��t����;N��E`�L=*:���ݿ�!��a�B������14y�:��Zx�}���X<Cd:?�%�ݸϕ�!���=!�OKUzB6��G������� 3��:�f��>X�,�>#y>]Am�Ǝ����0���;�־qa��ŕ�@l?�V�q�p�bS�TC����9%<�՟�}\7JQ4�.l�o���&��h�u�T����R??��O��<�l�����f�z��N���Ί�e���1?E ;j�ƶ�]���M���`��J������S�`���ϋڰI�N)������1�g��^.�t�L �=��%�\��V\s�j�սs�~���s�Ռ�x�%]kQ�QEd�DG��i���+�ɔ{s�s{��n�}���'���"bd�����"f�k�?��w����.�5{��jo�tX#�?��Mղ� E&�|��,d{t�7%}����X�ߛ�Mp�+J�6՝��|z"�O'$�ߛ�m��++p�G��ǗQ�"k$��!{���k��)����װ/3 ȫ�4k 2���/�N��_�������|�Zc�+&��<^{��7�5Q��4w�X�Y=��0`���+�4ꏭoej�+��4,֫�j��S�\�=d�B��ٳ�`4�OE�.kv9h8�&� ֺ83dA��,J�?��uݭ%+*B��5���j]��g��ݎ��õJUH� ���ZV���*݄�� �<�+gUa$L�A��!��;wk f=��������r:&��V t���ǎݝ����q��ı�sX-+��>�ԅ7�X�/O�z��ܰ|m���D��� (�H��0�_������w�����Ɓ_P�e�X��h��%NG'h�<���ߌ\���Eu��,`��'�ϱ�"�#��|�hU�0$i��P��\�~O�@�\L�� �߸��Rf���ų�PX��3�l�2�k�!�����#�ĠL^���N�����"Ue���E�n��v����/?f��H�U3;�EV���w���`s�=�\������t ��6m�6��ɷ��j��GS����d}*c��^p�ʟ�S�dn�|~+�����%��b��ܾ3��cPq �����1��B��nI5<(�"�c���8��>��iw�G���+b�(4;�$>�&��������K����v�9{�?^[0����o�moU/�t�Wcι������EG9��>�2��1�_�ɳ/4�dis�ߡH���x���%������vz��o�Һ��W",��.Nu��!�KJ�l�\�T�a�E�'`��g�=�;�m�$S���+�pQcN���~jq [kcI�<��6�*R��ҫ0}����=HzuJ������}Yp+4s�1�� G���E��yT�GY.� �ͧ��|DB�[�f���ˊ|��� d�j�ŏ��p7��Lѡ��z$���$�o'p����3qX�}�R�������j˶�mKw�~�y�s��K�z�71=��{o�-d�5�PR$�=t�A��4�h|��r����/��N�������h���}�K�:��C��j8��et�m¥��鈃a��J��ߥ~��@�����X�c�z��-|��5P�*��>0��\\���dr�;:L/�c����țA�1b������U2���uk�)TjV`|L���g(]ݛ��~��glUa.r\��Y�=�Hᖍ�H���&]�:Q{�+jq�-�����S����F��Sn�P�G0���3;��ؒ�@{���d��-y���� �>e��}[f���K�>ُ��eC�GbƯT���tie��� �NP0s��rd��X�{rӎ^^�V\3��A�Bk��H��t?]���:p x��_ݛpADc����z[���9CU-�h�ג }���<��G]��$R�<X��E����L0��=��g�[���ɂI=��~�N����j�қ�4M�~ ��O���3 jG��A&\�i��N,���/�>aVp�� X/�l�����Bs|�-��&�R%a����� ���G��g��(j+���V�0-�q�+���8�� 7#��Rh-ŐCE ����e�� ��ܵ
Static task
static1
Behavioral task
behavioral1
Sample
aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e.exe
Resource
win10v2004-20240709-en
General
-
Target
aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e
-
Size
7.0MB
-
MD5
f9947f4d50e2f7e85854c6c0563bd404
-
SHA1
71f0d572e414a9c9a26a022191d9571829a23a17
-
SHA256
aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e
-
SHA512
e61ba5855d8af65f5197e9a0ca5f38789e1bd020d86a75e1d09a43634a2fd0da2821dca0322f975c26a22623b8b5d339022344c33f63ff514e4ac4d175ddf48d
-
SSDEEP
196608:NgdKH8Qxe4qCxKvngGPICPhnDfoT3TGIQZSA:NgdWxe4xYPQnT3TGIQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e
Files
-
aa46be726d37e6de7c64f200aea22bbfacca92ce15ac6f8d0f3819c73a5b1d4e.exe windows:5 windows x86 arch:x86
e0c38f7f4ba0c8ba712b7187c3272f94
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
ntohl
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
CharUpperBuffW
gdi32
CreateBitmap
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
Exports
Exports
Sections
.text Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3R5 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.6g~ Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Q'{ Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ