�N��υ%2v��*DJ!���&x9����{�R�Z��d�#�ʊ���Nz�OE�CbŔ��&�����8-��⣊d�$��H�����kUm�n�'T��Qt�w�D��蛦/5^��<xoKᐪ��P�s���:��;��&��8��A��B-����F�r�wBZw�J�G��f�?�x֬�k��� �.~[&�G�_�x��+�p���DE 4@X\�%e�#��4�Z��u����zq[�"3�J �c�;ti��U)�-�%�gS�I?r'7������K��������Ĕ�.O�O�}��LX�m2LF���J�:��@�O 1�F�o�Ȅ� %�8���l���c<��`ћH,b����NbZ}H�Y����_`��t��k���� �3��Ȯ�@/�3Z���2[3�c m�.h�/�z�����"~e��N�����x��|�&s �Q�l�*x�v;:��l�f]�w����J���`���g��*q���� �^�d��%a K��x���60�җ��ʦ��Y} =2c��ø=�+�D���7<f�P��sŦ��6c5�XͶ���4���^cVmzG�Sl/���U��Z.�@�����7�}L�q(���/ƗD�+�+ bcQW� ��ЭK�LP�D������>L�ʇ�`��b[[�q0鹐]ȆB�$�����}��i;���ĆO�n H/�d�~���Z���_d:oi5�Zɺ�7��}��㬢%@�'�<����~��4:-�.h1����$*�l?:�oL�"���33C}9��E�Y����*5V�����h�U#��/��e��s�Ԃv��r�ۋ�P`Ӱ�#���, �p�`G{�S�s���m���ĕ�B}�,�w�����8�����a�#�"������n�ط�_ƨ�v��� i�f��s a�!��p�?e~�;Ͼ\��a�����@���N�"�����1�4��?Nt�0��]�Wd%��� ���A�QJ�;��[J��MŒ#-��B_�-M)O1̮�.�0�����FM;&��hk�z�m�g�$|�H�w��f��4��I���(���z���S�ʿ��m���lY2c�����ۆ��"��|�GռM�r�wask�p���V���<�}*��Es���ĩ@xE��eT�y���(�m �G��Ʋ̿M���u.��M��٫�S��a����=cۍ�i�O��Q��X���\&�f+Gy�H�;�x`�ef:C�;���)N��Q���*LBk��m�� !���5!�[�fC���4t�7���d��3�Sr������X�[��.�p�𱊼��I6-r����>��d8Cl.� SQ�� D�viR;�"�Ίt82VH���Ւ���.o�Y�j��y�G�h;�K�%s���M�f��1O�%���xO�k��Z/0kZh<X>��������}�<S��'�@e�"E���N�{-^m:iOe)v�~�E8���J.Xz>�m�� V�%l���b_��� ��6���H���� 痆Y��wL'�w�K��=?� 29!�K����d�i� F���}�f�.����`�6�P�f��?T"G���g��V� ����������תk�_0���#���'��D���u5}��\�*���B�4�����U�Ö@?���=Og����;�-sP��ڊ�J]�{yF�������`K��̞�8��%��L#�v2��u�z(U��y,�1z��˪{ͪ�?��"��!�n ������x����1��Wև%����#W�*�dD�r#�'�m��J�D��j��o&�_ϟz�ʤB(�-D3DO�ߦ���0;�%|��p���\�1�CT�żҁG�v9�B`���k���z�B�nT�]���5ʏ�h�:f�F:U���1z{���9!훿��䜓�9��#^�u���晜�I����t����D����j�f�v����#11q������^����`�=i[�r��O�Z�����(&�Ǵ��)�I�w�Ĝ.a�W�9�y#.�)zd@t����`�K�!k�M�F����B�$a�����n(��hUI�]�6���>j S�v�t���(%𰂲� v�P��ۗ��e$���=������am�Fڹfgl/����3e�.c:}���G�@�oh� fFV����7��T0�d�9�<�W1a�n�Y����T�@��ݲ/����Gc���2��۠Q-��B��hDid7�yWD�1��v����]Gt�3C�\EAi���>�ԝa��}Yp�a�m���OZ.C�E���3�JΆݘ��W�����ֻ���OY�ϲ�^fG����J+Ʉ����t'���++�N�qw �E�����WJr� nt|��̫O�ɫ�s�5��u�a����rg_�+>[{ 5:�Vlc4��o3�8�ӓqځZq��Q�� $�Q�<U��]lGx�)��Gu�/]ՠ��[��<�/��U���_�%G���D�!2�g�"��˰p&#�0�w��flHvTL���xS���:��A��4�k��+�����U��P(�r��hL�a��iq��T�k3������8�����b�J�Lp7�5������iq�K��F�s<��K�@�-Ԍ�&q���F��$�j'��!pY E�0m��F9O̶�P/ԲD !S��C��hlA����s'��]w��G��{ �żx2�S;��K_z4'�MyЮ���]��p`m$��G�Y�!������6� i�g�&�k�7�8A֢.��Q�����\�v��Ķ�a\� �1`9� ��;����0V(ݗ^���A����% ����PaIpA�o�s��s��I0�N.T�(��RX�+q�q.�S�Y���ł'�d��A�\q bLpZeрt8j����b-��GD���J#Gr�p5��)S�VHу���B��Mԯ�����_�l*��r�@k��l��� �z�-\�6E�|���$9�/6ø��тXD�u�ͳ�k'eQ��n�X�%�!��x�*j"�<j#��&��٭��$���<K�M���4����͙�������[*A�Pf���[g1�0�o�b�C�c��<:2/\�_:{6u�ao
Static task
static1
Behavioral task
behavioral1
Sample
aaa.exe
Resource
win11-20240709-en
General
-
Target
aaa.exe
-
Size
15.6MB
-
MD5
96ed2160da5a5899a938933d81254e61
-
SHA1
ea17be355dc518ada8409d72530f3f6b022e064e
-
SHA256
1523f8d4a130014212eb78c91baf6bd6ff8fa12f3722845c5f573111e1270a38
-
SHA512
d2a5f1fc2f719a889711900c30ed4638e80d1a486596251c4685852f609f2e39b0bd06fd8e5bd7eb678a702018675442248b413c0bf4c3171d60f61f14f52b50
-
SSDEEP
393216:NSEFPSFNNcBMFtS9yxHqfp+YcYVJKClpYkkA/MBzcFRf1/iI:NSEFawMi9yxKfY3uJrpYkfUBzcFRfB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aaa.exe
Files
-
aaa.exe.exe windows:5 windows x64 arch:x64
Password: Lq4kHax5(V.TD-iAg-b6XxN3|p+_M+ebQMTXPV+#
61340760ebe38246e4db5e11ea065b62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
SHFileOperationW
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 71KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 15.5MB - Virtual size: 15.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ