3u2�[�K���]7���=���o>�5�e��cCT�~��!���ʡ�JtJ�.:d~qi5��Oa�d��D�K�z+)����NT���0���w7��X�o�.*��ͷLN^��`S��(7E��,���y.zֶ��<�z&�iu� ��'b��4ȋ�|-rf�RQ����e�"�cd�w�^f�,�g��䴫�N!�ы:�����ݐ�&V����*�o ,�A��N]` �P ��r����:�8�֝���P<E[>�~�E�q�=�B��T �CM?=S�,=�؍l���V�3����W:��wif��\�T����k �\���p���fkַ�����V������@���T4��9bڵ�bYl��6̮ F�l��з/�6���C �4����a���^����%���2�Sz�s����g���u��'�����^מI�r��.�9���Hm��0�.` ��ȭ�Ű22J J��uR�b��T�F�s����ſτn$:1��^, ו�� �6�9E��O!b�3O*vK��>ɤΪ^|���<'�a����(q�f��z+��W�Mx�0�SL�]?�D�J�?�SP���.j*]�oM��SC�~z��p���ٮ>��`�>O����N��`m��)h�H��ǯ��]N��4����v�8�f@�A��͵*��i�Ʈ�{[���3�@���B~�!��@���N�p�_��ҭJE�fZ�l>8�7�U�o��+P�=-�4��q �o�P�'ɟ�#:^��M�Ët��K�3��,�c1|�/��m��!�Kj�8��`���]�j�$�:�Kө+.�=p/�z-�� ��er��7@[x�/��)ԁ�ʝ �Yh��m�����<�fz@=�H͑goWt�9��\��P�7�����2J��h�1_~�m��ٵx�u�c��� &�������B�)�;8mFc�N$�[w �I1N}�dmBNP�dj�� ��D���Hள��+�����DVJ�a�w�� �ē��?�N#t�i�K��F̉��S���d�,�rn7C)#���{8/�����®�}�z�<�G�a���� ����~Κ��3w|��<?�HE��+�ެ�&�Е�!Q|Pа�Gf��V��<~���j�Mwf���忧a�p��;o)~���|���EE���^J���ǰՖpl��oƋ��@>�YV��b9����#��-..J��,�EHX6��a�������-��W�5^�L8+a%F��`bO6�{.�(I��o��Y�]�Fz-5�[1]��e��Z�EvE�d�������QH��?qj&����Q�ڿ����W �� �'zә��<-x�ɡ��2O�A"����8dl|�ˡs�?��O��,�>�W���^�K�R�ڦ�:�d0{%)��k����'���^��Q{{W�TJ.!���5x�)��rѪ���o �衁k,�<4xd�\�.�y؎�lP�KG�7%���N#� vD9D�(]�3KD�պ��B4�-Rc#��l�T+����us����(w0�T��;%�$��������U!Ԑ�k�{�S��1,�6��@b&}:�����X���v���t��� "a��i��w�UX���D)�璒�3�����\Z�����μSw��w���t�6P�"�(�pΝ��`=��6L�j�w�P3A| R6i�<�V��^�Ţ��/�#z7Jq�����g��A���W�[V9��`� � �����㡔"�Tn7����@������ŷBn��fA�#��IE���F+��/j:���e�^����:h�u���&�������W� O�،��b��+��NW"$�,2��2$t�V�N^a!�S~q�h=&���Q��%1E�F?D��ѠH�b��*}����õgN�e�6�RZ~�/̪�Q��c ��}̎�nt7�_7<�n�h����j�8�L�k��y%�X�#�/��\t8��T�,��HRF��F(�7�4ĵ����>�n�m� Z29Y8-��]��)�$�&$��ס�t�%|ɫXu�7�ZH4ҁ���P-zg~6��z��Y�R�� <�X^��uμ��Y��<`�("i�i��ӫ��\�%2�j�h�;�K��� m��\�!E�#ڑ{���ӫNr��p�I�Hٔ,�S<y�N@O �:�6]����� ��S���a)�e{��<GP��}zAB��S)���f<�����^�5n�����E��BRh� D�b� �p�q���T�ʥ���9��H,_ƌ��� ��ӎ(�Z��uC�G�l@���m�ߍ�L~����@�0B!� ѫHZ�5 Ϸ�=���)s3u�p����&O�x��~ZaR���ހ�GM����}�0�h��+}k-�z�X���C�a���|_F����HIӉ_�W�� � �Z����e��D�`�i0��.��)x�ԡ��j�����:c(g����i�܉�R���[B@Q^c=�c:& �;.��[� G\��8�nU��k|��y�n5�>C?6���/�g1��cX0#K�`��w�������?�j�Al+�ESWN��E�0%���@2�W��hc�#��\��m(��l�� ^=���5]�����`�kO�zx1�X'F?��9{����W��x�p�C��O� id���&_�?,���v��d��J�ч�P�1'eN����ᐛ��L��y�����ω��r� �����̃�������/Rv؋_ѯnj\N�١�����1����Z��,��Ph�9t���hWİ��e�T���}���v���R1�AG:���n>ι�����sA���{:�L��(�a��{��i_��2�;�ŕ0_RNĴK�7~6_�������o���F�u� ۠j+�ڋs��aw�~��s0. !KO��N>3L��c�`��^s�J��� 9�X��K���s�:�Q��f�|x�������p��|2��+e!�e�x0���Ў R�f�jFc �x��ОGI��.(��`���!Ȥ[�'�ue��l-� -bE�Z�L'��P�݇rc�/�,�K�M�6#��nV�
Static task
static1
Behavioral task
behavioral1
Sample
activator.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
activator.exe
Resource
win10v2004-20240802-en
General
-
Target
activator.exe
-
Size
823KB
-
MD5
511c9e5c5b80ea56981e42d76453bab3
-
SHA1
2a83df5ebb31daae6aebec1def302193dda18220
-
SHA256
82c54a376d12701453088edf3fddfc341f350dde0233c745c98ddb51c932cc39
-
SHA512
7414cccd0a4b7c37619f1ac4f9129e4925da9e1ffd674cb38df808652150104cbc3007c56a12e129accdd0d1a02d8b793f10e6dfed9b325a979f4b06a11127e0
-
SSDEEP
24576:F7wn7GaQd7Bvxn1JxSnCqwqoKw4tdkcC:pfdxJxNqHJwo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource activator.exe
Files
-
activator.exe.exe windows:6 windows x86 arch:x86
f1f5a0efe9802b2debaec7382503c831
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
vcruntime140
memchr
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
tanh
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
setlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MaCon0 Size: - Virtual size: 594KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MaCon1 Size: 820KB - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ