C����m�7��Zɣ����\��nE\3I%3����rJ��z� 7������G5���헙Zl�Ǟ��Ӭ�_��W��3=��6IxU��;�������6L��Qf8�J��KA�?s�X��=���r���"j��#f��d��`Y���#Kgq�{��Ԯ���,YY8�Z~".,���5�o�K�ya<�|��hF�K/�fS����~ ���u�"��5)��-]V[s�>n$n@!��z�Ծ���O��E�ĝ<3���Q��V��_�����4�*���<�q��P*ê���$���ڑ�m�L5�A�i���v�i�6�PQ��2�����U���T���88H���[��"���Oaj�,�ռ��K�3��h�m�D~]T�3�j[R�p.�(���#�9AK)}�PYݮN�P��z���V8�}��� (�&�$��z�K���խ$/´=����c�K�9��Gb;�l�o��]x�0�V2_�I~���r���%�F�Mށ/H�� ��2";Ű���z��ۥ`W���"�*[�x��g_誽�ɮ5p�y:ԅ>=5n����G����^��Nu;m�����ѳ1&���������j�sf�>�vo�A�;)ѳu��ɘkpJV�� YdR���͘ .e�O2����9Q�BX`��V��}�sC�%&⫇�;6�X�U�5!?���2Z�]vg���j���,,�NK�E����@��^@MS�ɹ�H�-B©FP������2M����'�Œ&J@h��!4d@[���ንF� �j`p;�`��*����u;�b�(7���y�r<D�?��[�ErB��k�R�����)��%��鯺�u��zV��m�D x�9���+ x8B�Av�%�U!������� u� Ρ@@�\?��6����$��y������ȓԱ��t���DWA�72��V����ڇ�L�˾4���)YչTgͶb1J���Ξ�o�d�;������p�d@����C���3p�O+�9>�s�U[6�~��@n���n�8�J��CTϖ>���t�F몬�Gכ�g"^��U������c, Ϳ��wRA����J�U���b uo��3��9�$]3�!"i��sa�o�����KxRL�$�O�8\���<�}�DU<�Ll;��:"̤c��Q���$�mAs�0xN�~,eZ�t�<�����$a�։[��H�0ȸo���;m�}�ީ��/���НF���aA���,��(��J��O)6躄J��5U)\���i�<���ou��mmVd��Ѵ�;��/!�偋}g+p\��ئ�j.��h����!*&Q�1�]�| R_�Ʉi�a&���tV�T7J3~�P�7����ŀ���:5���)�Z9D{t�51�/�(I��*<l�亀�>�m,�����<ǔ&dYb���z�M�/L�����T@3 i���9��u'҄�T<��7Lnr�\ �������I���B�0.gs،O��_P�L���Q}�< W'�x�ȥ����U٧�R�S�������� �4yi6L��*�� �=ei���Dx� ���¼N!;f`L54Tv���+���uQ��7�yx�T%Γ#k���ɋ¡VFj�!��5YW��E+3zǠ�I���y�c}U^�I��C��=� � _����N�@�l7�!��w>�"�HZ�d����@9bmd�Y=��\�Ebu�6^5K��7�nR���Lۚ��V*\�9c�g4{Gb@f�(@=o�ɀ\�����J8�BY'��0"��-ݞ~j|3��,�B� ��&"��SM��.j��A��z���5Ly��?��q���m�\�u�`[8�v��L{���'�Cy��L���u{�br�_!z��w�Z3�4��`f���5.�E�$�H��<tg�A�]��\}�>h#��s%����x�7�����?9F{l��M��zD�>\���n+kL�gf��fzV�7�]�fA���u�#ӺRc3m�EY�8��;���U�1�|�S���tU�}����d���nNcғ�gЪ hW��hj���>E���� r��1����Yz(S��[<EHL��u0���2��eX%�V�n���'\x*C�F�D�h 9�i�ʊE|��|7oyT�6��./R�2��:��B���,�dmV�K C��\�L}��r\����ջ�Ƹv��Kn��(S�w"V�h��6�ݕ>־�]ښ�hV/6��MDHx��4^��:)QQ��ܱ�~����J����KuFiLw����"z"t؋��]F̭y����+�%8��_�v+�鑬cg\���,Jot�<�4r՜B,�b�G0�I�,'����XA�eӕF�n ���c����F?|�����rT�&O84��#e�d��M�[QՃ�uO<��]HV�7.�d�%�ÖC�=3����Ѷ�O�MČV�oβ�GILO�Rf&�Z��c`L�w`����$]ԩZ��} �o0��v3� �Z R'kd7t�T�Z}�Di�9��Ka*[��%��](��V��u��=�$P�%P"��d�S&��r�:h�L/Zz=*�)q�_��/5�ο�*� �Ī��c��_���M�4�mGd�l=C��5�*'�X����@�o�۱�[�_�LA�ʬ~s�K�f^�h��+]�9�>?WV?T5J5!�+c��1��rIT�*9h6Pi>/���);�G�RM�d�r�ɞ�?�E7dv#��}�}KF��j�ta��,1��Y[����3����#��+��g<@w�n�WME-��!�ۓ��x�����=�f5FwmO�Ǫ��ﳁ�F0�¡�cu�B"���Z�O*#���k �6�W����F,*^I� W��@� vaAL��[����� �O��u�=S��E��Mol-���"//��Ԝ`눃*�i.�RK2 `Ŕ�h����"<Z�ǒ���Ho�&.�RVрV_�V�������*�鈈�������~�YVS�ҫ`�h+�}菾K�ۆ��,���_�wV���OĢګ���Tg>���5�R�Q�Pg����'���:���a>7�*��G)��Q%�9�[X���J� 6�=�W��V}�r�ˌB����$H ��(ﮔԺ����(��Н�x1r^`�_K�N7z�i�!�A�=�h�ʉpj������X�۬n$��є���C�4o��/K�5���Tqr��~�?�e� .5�����*t�]����Xk������o��J&���[J��a7�LN���|}ObBR��� \��u����sX�}�`�P���Y4-��9�enu��6�Yj*@vm���7�IJ�B����"t��p��a:�mq�B$j:5j����D�}��7m �${��Y�ݕ���S�9=�.����-�X��p�J�� >l´�"�Ut��3��T���1Ss�7AL8���$�l�G ��A�FV=�4[,��d����^�2 3c���A�_ZR�g�m��<~FL�'�Lb,�-ں-n�u����v.��-�i��bzN�V��o�U�+u2SE'�\��L�GDb黬�o9�o(Y�W��Hݜ3Шe;І��RH*P[��kumn%�?���(8��F�02���m32�j]>�5E��WU(�@��b�:�t�r^�+��/}tj���:]��Bo����@�������]p�� #9¬cGF� �'��qC���wg��t4�,�*_�pvyN�x��?U��q��o�l �ލ�U%�w��ۄ���¼����S���@:���L�^-�W���"
Static task
static1
Behavioral task
behavioral1
Sample
aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8.exe
Resource
win11-20240709-en
General
-
Target
aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8
-
Size
3.1MB
-
MD5
26a5431275d0b2aa34b78e1ab9a6c8b8
-
SHA1
8ce2d2733e466763c74f565c2a127ea3f9b33e35
-
SHA256
aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8
-
SHA512
3e6ce681f1a8fd4dc309de3f810dec7b3dd259a4c865d2d28d7051266e08659d4d2b26c12a36cc42eff7e507e3925882ac50c9fc62086d00bd5b123ce05580bd
-
SSDEEP
98304:PhWFvQWeYF+4pG9UCKLuGOL5mdE3qR9xBhX8XpMB:pippYv9UCKLJKmdE3qRJxam
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8
Files
-
aa69329596cb4df132ad23654dcf9a6ae0100358d76664b9c08c174daf8ed3a8.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 320KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 60KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 317KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE