b����@i�eG�byxMє�'c��i�%MO��ѩ����ѥ��</�;�;�Tn��:���[�=��� S�Ь�_��H(�[��q�� ����͖�%��5I�C�����kJ��Z��}`�`���R�Z)Lg40��~�:|�@��?ȥ�s�^,�����M!� *�ʁ^,�j���9��w[�yi�UX�w�j{l�&�MɩVH5��ymh0}�H&7�"�����[���a��턦�����H}��2z��.��a9��� Pwԡʫ ��I4ճ�ik���.�݆i6Bx�ʅ�t��v�Cu�+��B�r��{,���@!jM�v����fBEMJk������CtJ��dS�%G����{�UK�$�Ӳ��o�X���+���6{���6j8'<L�������<��$��ާ�cj�K���,;Yv�+��\�MK�����Tr�$�a6�S�g�ϝ�_l� #�������nI�k�r�� �j7����fۦ�t���+�u���m�bd3�q�E�g�h%'$k���d����m���f$ò�� ��$�^����L�0*�/P�W���xͰ����lV�\QN�/ ��|�:t/z������Hgnқ�����+S�1(��m���v��Yf�� |�����2]�g4�k�S����#H����Ԓ<y��pq�V�~�cT��]ηi�4@)��)��w���Ht�Ø<����9F�Bk��+��:��'�V;���F�;�!Gv�4����w����*R�XѴ{��W=Č�~=�s��7i9އt����Z���{�q�d�Gk|�aFK`�:"�W�e��ُ��a�eڠߜ�����O�� �/����X�+�ҟ�};沕��w��h>��*:�������E&� Z�˘�� V�O<U5~|x�JZ��W�|`9k�;p���� ��������n8#�'��/�[��ӵT��\�������ЙM ���h�X#xw�g�i��q�� <Ukޒ�P�e@�(���0Zv/���4D�j����ڻ��UkK��%���Km�sD Vʣ?lR�7���W,=6{B������3w�V(��4�1��Ar��K�S��2��POyB����S���j�Q&a�]x0�a3��cbS��87��'��r1}ٺ�W {f��D����l�Q�D�/jO� �¦<��ID�c���P�g �(����<��4�M)�h�y�;>��6_w�(��m�[�b��Nu���d?�����a�u s|���j��ο�����7�~!���|8����a@�4:�c{��j�"�UrP�M5�?L��%��ׯ�����ĭ�gR=�쁁� A�`�IB<�gŵ��9�AkL]XJɆ$��$��DTo>��`�UUL\`W�4�~�4�`�G����GKY6����E��/���Yqm�l.GM�#a�������>����$l���e�ȯ��,�)�{��JdF�a�_���±�zw7e �yq��ke�B�X�:�n[p~�o�\�9��r�Ƞ�3w�njof�Iw?�����_c�L����-�)��a�h�&���q�f@��M����,DM3����I ��p���-�n���*Y�G�-�}��W������S�>����1�T�4��PT1���uI�T�3�w$7���E��ZJw��u��z8�1��`� �/�qo�:�ޠ;���\��� �'��.Y��x�w��_��i�d� �r���|%Z���� {��YH���k�2�P�B���~�(�V���Jn��A��cA�jf�Ԉ�L.�����'��]9��C��2��}���Ӯ�HC�ML� �FI��sjhvp�uE*��@8;�< �([��@��.Fp�{+��_��|ʙU��ԟx�� �`��ڱ��}Wt,�m7���@V}��2�W@�,�<Ih5,��;M���jA��&+6I����Y}���c�)�n���U�&��2�f%|ŨtN����֑ޠI��_9H�{�k�}�����M�������ݩI��<�f4�E#Nn$�zM-�l�� w��t���v�t<�*�_�[W�ŚD45����bR���j�8�������W�o�-��o��qn���_KL��lV�W�;�n�0���j�_�m��9�٩�������Z!*���J�CP��E��<.��{�3����~�K(l�DV9{~C���bw·-���#|TE�NC�� s1���(8��`���*֔�t5t/<��%&�wu��%�44�����" �ߢ� n�e߶;M���h66aқ�;����@�s�:O^��i�߭=�u��`����>�կF*�i㰘����R���D��%�<o���ʡ�0`�#�yx�����@c�g3TvOذs�L���؞Dw7�#`��6�4*wi{��(˅����"�W�ǡ?>O��z;`ة����`�z4�k���[�Iw S;�PI��L �ҫs�&��пinw��f��1��A�=oX*��\���(6?arS;���;�`)�S�Od�qH��Mx�Bu���K>��(I�� L0��E@��2�cM��1N���g�%��E��O��n���Q��R��Y����؞xiY��Xeݥ�2��І�nN��ؑ�t��~fR�"���[,����r3ѳr�]������e��ckڤ�`}�����ݦ��"[T[�a�w�f��L! ��ρ>j�d!�1��˕��B\|�l�n�4��8�p �C�ؘ�9��lV��f���$b� =2>Ls}/��8�>�o���8��~O��&���,'��@��N(���(wg����~fKR5���Zpq+l2�NHC ^�DsR�kΖ�Q���l����d��I�b�ڪ �M��M^ЊY��Ld�5P���U���ԭ��a�4Q����_�.��:(�������h6I��:t6�N�tV��}�S�2�=W�9�P�=&1����b�<لŮ弄��R��0Z�Gn�Bxr��4ң� 6e�r����Hx�������&%8V�>!��|Y� ͠L�rn�Q��".bW����|,1�G@��{�$��
Static task
static1
Behavioral task
behavioral1
Sample
aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783.exe
Resource
win10v2004-20240802-en
General
-
Target
aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783
-
Size
13.8MB
-
MD5
c8db335a50905a6345f4d275701ef825
-
SHA1
9a996635ad91b69a75d032df4f9330f29c62a0b0
-
SHA256
aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783
-
SHA512
e277029e4c0d857b198d537f9e4509c88063a7869a2a276c4a9551671654c12ef35bd75e6cf60119c55cb9e0aa4ab9b186d6045a5309e06f81794cbdcaf0c926
-
SSDEEP
393216:NhVf7+OIhbBREGHdrtFetvnFBUP6RXc+Ckj:jd+OI7LHJCBPd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783
Files
-
aa2bc4502ffd250313149a4ce98cf60ced76beef0f60d3817a3c63346b329783.exe windows:5 windows x86 arch:x86
e6cd2df74265066a9e96d92cdf226d00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CreateWindowExA
GetSubMenu
CharUpperBuffW
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
SelectObject
LineTo
gdiplus
GdipCreateSolidFill
ole32
CreateStreamOnHGlobal
imm32
ImmAssociateContext
shell32
SHAppBarMessage
Shell_NotifyIconA
shlwapi
PathFileExistsA
winmm
PlaySoundA
waveOutPause
ws2_32
recvfrom
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
oleaut32
VariantCopy
comctl32
ImageList_Destroy
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}l/ Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.:,O Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Bkw Size: 13.6MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ