͵���A ��E�����}+1��&�:��9n�H��A�� #"�焟�C/�4rhT�������?k�V^�r~����-�v>�#|6�W"Ȕ�l�&�� �ȕ�!� ���S��� ���q)��w,�;`g ]�&6� ,o2w�����3�J$���xT��oN�Ɯ PC'���g"���=�Gq� N�X�����a^��#0���TY�/�y�/�c������S��-P�0�מ��)}����ꏅ)��� %�T���D��0w[=�����4�wtEk�E��P����~�褖�����3?��p�a�����9���<��f�Dt�K�km���cka��nop���^+����^(��2�}V�Jd@�L^� �T,Yi��J|�!��=����q�!���.�M|s�����a��Tt]9�#��KMu����?4�5&Jk�#����R��ZۧD�hj�o�@�+{A|��7����w�E,)6ۖ����۱㵣��#���&�v��U�歡�Q=dF�mb��xnP �����vҙT?��K�-��A�����.|#��-���+s�,I�` ���Wj9L�ie!���}W���V��w��\��q/%�/��2��E"# އV�(%��-����7��:���6���(>4ċ�Sɠ��;�7���N�е���i�q4�^�wYvG�J�`N 4>���������Ņ;���O���,(:�(9���O�*n�纒�x$8�i^h[�M=a����ح4���4��_�qшEo�v�Y�.����K'�4�� ��Ĉ����m�s��c{'���K�D��`l^���Y�1e�����Ȑ�m�/t1� ��O���yA����^1�xc��vkǵ��U �әmŚ3�^F��_?��ZZOZt(��������a=C�3Jz���9����.~6�ˤ��|��0��a���&�Z?-��i.\Q��2?�mY�:\N�ȧԙ�M#rJ|�Q��hW��g]��ab�O�.�P�@��r����2Ԧ#��RAK|�dJ�BI\@���)uf�/��O�'9E�ɤ��'��7�ZL'�e���h�Yl*��o�~SaT~���{��1��2������#5"�/��]�j4�5Q\�O�U5yV��'�zݵ�sf�C[�D��-b�㬕3.�I����}�� ;���V��l��Ӎ����Giy�����&H����U2�%���mE�011ry����1|�$A�ǁ6l�����2�\{� H�!� "�� �3�{6�煴$��U3��Co�j��i���"��7��r�F��Z ^��"��:X�V��o:�C��J:�����>^ʼn�?x�r��F-L|4��K&��f����_Ql��_ k2�B�I^o�er�a���5 ��Ʉ� ���'8�-�x�n���*~ks,��巌D66� �o0�KaP�����6j���W;ey���2��V;7I�Q�V�ʢ���<4@���Y�' ���|ذ���^ѥz�m�h�K�ޫ!������\��BQ��]s:�r�! ���'脳��(��@���v`z;J��m�Y��+U�ُ:L c�/��]�G��M����Y�{ĩ���i�0\�^"KKz1�,��3�����Gb��mc%�V�`�Z�YJ3L ��DF�� �y��aMк�K�c/��1�T��Ìy1F�7�L�d���;_ԭ�]�f�vP�Ջ�%lcW_���s�@�������k�ҹ��H�s��n�ʯ���eO !�8�ۻ�g������E��y�'k���m ے����bv�.���]�����&�2B����] ��nd��-�m³C'�XJ�.���܈^��|ep�5�P1A������,��Z�xq@�q>*�`�gȅ�^�*�~��1���ٞ���zh�HJW�����YVx�� MLRr�7�ZN��b�|${ޟ6��bo"C� ���CG�,�#��t��J~�J��� U3 ���{��v�c"¬��A��]T����� ���G��~-�=/q�%�R9S�]�#�w䏺��} � ������S�Lm����I{��С"�,�FETs��u������v茨K<&���)̐�����*���F� 2�I�k��^P�>�i�na��q������lq�Iu����L�-����D-�~�r�Ov���l� 2v_�42���������� x��-Q��O�o1����O�∃����B�ȓ����N�)��4T�(�ߔ�}̭�9�����Zv�Ě3����[����ӟ�>���& �sGm���<-�9��r/hQzA��.�9 �e���54:j�2!WNn��)�h������q�:��tP� �X��}A������w���~%;����mY]��R��� ����fd������K�O8�v�!̉4(x�����P,�r�DH�5�f4�'�D7@tH�b%�i�\��`Zh��Ah븁��C�MLz��|e8*>�\,s:B���u�zu:-�6��g��9��>���,n4��+��:��_�0�ά��i�F���=�T'J��LU�m�� ���%QdC�&N���3)C�%�0K��.�Va"��O-�L9?i#��R�;�7�Ċ��Ƈ(�UJ[�l�4�g��Psq��� v�>�<�l^�L�i1r"@� ���E�,#$�k����|=�a���*� ��y�"q���<Х��� d����|*�s��p�ނ��}eJ��ؚi6#P��!�+���*�S'����֦�u.� gI@�$�i����8��C��x�TY������:�ei\������|��4�x��7�W�g�-2B���CA6#v�D(Z��l!^��B�;'l��{R H�dV����N��ޯ1���n�P�@�>�������g�#�.wd�n�'S�Ť\�Ugȯ�n�cR�`Fr(���@�v&g#�q�M,��=RH\s�������R!��{n�L�������>�8�sB���x����i��q�:���74���Ԡǃ��2o��;gL�����%�CB�!�ǩv���GuɄ~�օz�.�����rq+V �ݔJ�ޥplE%��=�d�4X�����C���$N�C*\���%�9�2goᢐ9ѐ��hk���^e�!U8:`�` wf?�4:�,��zl_��M���>!�gvuJ��\��4�sB��8�4��V?�����Q̥��i=�ׇ���|��p1E�sL!~m��\%��j����"�e���G��p�r������|l�p���7m��8x���'��``EװV[X�a�8_�<U�y�=gU旵N~���U���Z��DQ��o��YJ\b�������i� ����FĢ&��;Ac ��<Hj�g�����6���n|������\�v�0����KJ��S(�?��� �=�?��'&w�&��TF \˗H��t3g���b�H�4�hB������~oqg���~���R�C���5���0r�=:b�4�G?�k&�#�J��T�2�m̛!��˚ $+]�Y�"C�(�����U��ט� ��HR���5�����fw|��:?q�Z��"� �$���RF"Y�(�3��q��g�t�A.����qw�ss`AI�
Static task
static1
Behavioral task
behavioral1
Sample
aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6.exe
Resource
win10v2004-20240802-en
General
-
Target
aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6.exe
-
Size
3.5MB
-
MD5
45b0d7e39737d84cda9fe98e63c950a9
-
SHA1
2e00d9dca0fb42e29b14141e6e2229f7818bbcf2
-
SHA256
aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6
-
SHA512
59791454b5d45fa3bdf1ec610b9d91ede1da70c7758d36be331954b1af20788b2b4d3ab2db993e6a869aa7bb67f42a6b0499bd411c17cc8654c428bc6d959fc8
-
SSDEEP
49152:bghim7RwVhwZwwXAXKrDLGijjpLHIU7u4s1F1BkVxcDfagZ7PzYvF9xIjteqgJUL:ZqRVwqEyjjNHIZkref1YvrxIjlngwic
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6.exe
Files
-
aa25d7c3077df8436843b7bda71b75a21d26364b433a785b6ef7fee32e685cd6.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 59KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE