#%���$`�%�G���z0����E��meS�/S~�ʙ�]p�C[E��F������eUXDh.�پ�z�`�:7t��io}N�y�����o��#��c�f�O�x~�c�i�/�H���E��4Z��U����}�7����'��u`�����I4*�Q�X֔��o�QҍP����`I�Љrǃ��oQ�&��i_tC'.*�Ɔ�L�2&A�i_����Z�˒�&�~f���J�[��,�������Y� �1RL(D��~⩹����?nN��2Xl9��Cq�YNH���䩽!��6Sjc�O(���+υ��Q����6��u�H�R��:8sz�X�_@�A����N���l���X���ە��C�� DH��*�W�]!:2i^3~0��kN�K�n�@��d�a`"⎑�1�9� �Tn)�̏�F�����^�N�^(Q�xV���������$�n�$�m@��,ޕ����d�<օ��Z�Gq��+�C�TJM�lc�EgW̞��}6���������r�nz�L� � �`2NmF9��d�d��C�4�O��r6{O\�;�"��h �q�� o���r-��2��džC?0�"UC�����l�-�f&�/��1}o����H���@ؘ�-�u��4�P�eI9���R���:���ES�>77��M���ڔҥ����d%*} ��u[�r��&�f���4J�:�7�-l(�:*�r�7�άH�or�YbӀ�U��k$�I��S��Y ���}ڽ70��J]�^I��K�5SL?�T��<��!�I�����91�`�=�ϿD*άpw6H�eD<1�V�ڡ��$d�����1_<��7dZ����3�����t��%kd��iG}�%�V��jX��xy�x�~�^'��o�8U�ll���2禟&��}�������2�l`�*�9�`��/5�ݜ�cM�%��-"��$q��ӌ�k���PV9��n���0�o��*}��x�M�ڟO{��ط����e��H�}5�Y=����3� ���?!��q;lb^��+`F� �F�c�+8��Kד\ż�����*9����4�{�lY��p�&��z~Jk.�U�2�%k�*@ÇQ���Y�x j� ��k��`��8|<�l�5�P?�Zɐ[KƘi<��n�<��La:�%x�Z�����8�Z�+͒D>����dd�v�я�cx�u��P���^!�'���d5b��tgw7�Hч��q��!w����I_�����K������y��N63�� �Ho�ҹ�oT\i�U��('�����xG���� ��I�,@M�C����6K���<V��K�ߧ%�Xͺ�Ek��#O����"Re����]A26�o�j(��=�r�um;���O�����c��D���H���J/�\��Ɓ��(J�6~q\��#G�))Z�"䮴�Tz���a���l����4Y�%fe.��+R�L�����|�����Hٿ�����Wʸ�J�b�эl�d�.{%�=�2,KԵo�N�*�NL�z�Sd:q�_6P��������n������@fװb��Y��M�oM���/��9y��? ��x�L0`����2k�&�&�~B-f> '<�ɓ�rIS'�`�W�}�pS�*�2"�2���f滽w�FU�'o����"��W�@��� ��7���Dx8��T��(3ڀg̶�?d��p,[~M���e�����S7�ȧ��I&9�Xb�[��d7�A��zB��{:j���W�ӕ���H����h�ާ���5��TpPre��y��o��W�ڧ�F�U"+��a���S`*���Ç�w�mc� �"�T, Y$��;f��ks����(f�B��VC�q�� �Ѩt����Y �}R��6��Pf��QR&��)�G~�.�r�;��"af<���mQ@��8�V��-�@��D�m��+� ������Q��!����0�i#s%�J�x��Aɨ$�L���7�G%|���x��$c�W�R���a��"L/��f����@J�&�(���ξ��:�Q:�5l�%=sXӕ5���n����.�־,z�� �{���E��~ب�k�c;4��h� KѶ���Q?G���*�g;�W~=���w��spϚ5���H%[W�Ύ�\�B��٪�j��@$�^#�ɖ�\ݦ���7��o���]�Zu�1ɠ��}jN��J�98S�m% ��]�?y(����*U(�f�(�x%��QP���M�;���{J8��E�2J[P̪����@���E�8�%�e+뫐�A'�+�5�V��Ot�݀!��Q3C�=�J���k0��������4�2Y\8H3��dsn�͜�e�����]@�j<��:�NSU<��a��% :Q�*��RY�J��d�ĪS�c �鲬yF�pŔ����z�d=]�#��-\W9��{�j� Lɩ�u���,Qz�@���w�E����o��s�s�qjTC���fб,;ᴓq=��fkQf ����k�c�~C� ���s���E�4:�]g���^���u�v��2�l��c����"���QB�{���i���nϛ�'&�w�~a�+�vߢ�X���n�|?� ��y���^�#$������<��f������={��ZP��h��s�G>�7��� ��H��@�K��u���̟Nn]�qiWF���^���#~ �0�%�P��4~nYZe½���'�3k���������eo�f']�@H��U����k(S�IA�+<�����_A�����ĭ����Y2Mez�di��Q�p��rt��JS�rB�)90ҹ�Z oJ��ٽ��n�7�B� � ii}���?�b�7� �-�H�����q@�V���[���bO~�E���S]ԉPs�� MB�t;�A}��.�?��ק������6�G�a��*'�����U�~7����@��n5*F��F�������LG�璯TJw�$��y��~�A�9*���o����p=�����슝��_�f��e��0*DN����~�I�op��s�ݺ)(�?�ag0�$��q��4?�����Ƕ��J�����:UfG"t-Q��f�Ԃ���:2(�,/��XS�,�[���^͠�f?-�}ߒ�GB��;m!��h� �z���=�}At��I� ��k��i���:���������*A*I�(��E��������J��@D��8I�!C�*:.B�C:�-�"k#o��rLo����؇�*�!�)1��@��j>`B�Ф9B� {X����% K��#8{_��TgfX�������$=�c��F��$�.�mQ_Q����#`�-U�ǣMA�<[aM�iG�����_�H.�
Static task
static1
Behavioral task
behavioral1
Sample
OnlyAim.exe
Resource
win7-20240704-en
General
-
Target
OnlyAim.exe
-
Size
3.4MB
-
MD5
8ddecdb6fe5e3a3349477497df9a26a7
-
SHA1
70ee4b2600ef82fd1438f3ae5ad3388d77038f62
-
SHA256
43b41331eeebebc27885afd786c20dcfcd8dc1d1211fa14445f6bd18161cc00c
-
SHA512
d7932b8c660e9e593c35d23ae09e0a46cd10406c52cfe7e3536bb1feb88323f3a0f24d6caef1182ddb5cc4193a4a086bfed6090f9a4af78b61672fccea28f26e
-
SSDEEP
98304:CCx5Cajje6nw9Lu6Vryr++JQJPlKMJtiY6N92:CkpjBCy6+2JPX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OnlyAim.exe
Files
-
OnlyAim.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 218KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 69KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE