�m�����mf��L"x�p ji���C���wi(2w/'�ĉ�UJ4��0@�ci*r����O;0t0�'1g�<��� �x��z1H�L�C��w�m`A�\�7=�m��2b�d��l��2g �QR�q7wn6SC�y��+!�/8�S��P�X����yu�9濱WB\�;�.�#����@�W�b���pA�2���� �-�蓟V������,��o�8)?t�U`�W}��4ay&���t-U��/ u��Un�-N:������b� ��m�����.Y���zA��ݵ��'����F*O���U9�JО�I����{�S������, z��\[��ɞ�ì;!�"5���~W�&J_&\�w�6�/:<���?̽ER�d��Y/���j��^#,�k�-�Odu��+��t9@��$��;��[�ep�ot�������(`�����%-yeä����Y�jO�Xf �YY ��)�<O�<��r��U3X��M��pC��̆�wy�SQ�j����M/9ov�O��e`�^A��Ӕ��O�m<5F�C�kE����[W[�v�`�������:;��7똲a����_���uY��xף6��_��0���w{E��u�^��i��A�{��-5��e$�uX��إ=��@�gR��]�x��9���}�F_������tv�đs������i;�4�1Ԋ~Eʵ¶^�5���S�n�}���I=�͡�X,l^��J(��H�ݢ�?�t�Y��q�v�K��,p�2(���b��u��}Z�\0�)Bp|w|�!+��%��|�: ]��頿��_fJ�# �=����(Ʃ���J�������86��m�vWf� �OM�$?9��x'?�|��N@AO������4��<�܌%MG���fve�,'m�Hx���騄�n8<�����P����ē!�Ga틁|����Q[�wj����w�/ql"Y��V����E�m���Ј'X)�(���>���W/��V?�fgus�{��m�sI**�U���W>�����i��b����#��.)�y�xB[�<8�����=@���tL��&���'�L�����һW�X\t,oj`Ew�E4��CǮ�n�v�2��7;�79K��9�v֙�E�-ϊ�Q��,Ḛ���,�[�=���tPH�M.�2��x� sYr����!��*-k ��_rf*�?~�^B�)3B�u���p0��L'�H��1^Kh�Q`4�E��/�(���_�NN_�K�]��"�=l�vF<b2tS�@���"��&U����`��n��_j��>*�Sc��g'X㸕Msw�eȭ��6���#����3��B�T��UEf�b!�Ҳ�����,>O��`E��hce���]���밓��Ž��yN��R��*��!��y<8����=�Z_������c��DE�����.���]6@�<���B�Ћkb��i���l���� ��f+�۔��eay�l}d��Q\�]��C��~�T�6�$�����w� \��̷Xk�aFVm(��z]78��~NJi�@����Z���R��Q��A +pr����.�{:�g�(Q�㢩V��]�L^�*���YP贄���%5O�r:�ֳ�.ݿ$�Z�(Bn[���X,����{'(a`�tS��l���|�>�nsD��Z"�"�C� �M�l���Z6����8Q"�?������C�������J�DV�s(�`:��l�@1����HU:���y�z�x8 ��_�0��)o����cu>����M�3v8"�)��ZtC0��J������q����0��@�9jcB���,x�U�}�&��.�z ��W�?2B�ڰ�2��v^PouQ�lO4��e� g��K/�Z�Yu�0gCa�r�"�:���~}s�CljM���z�;�qYk�m_y&���ę���7gm��y�H��B����B��-8�5;@�D�FYY�����Cޅ��1r�i"�/_�p?�I�`��#�\_�H��wvs�6���tY��h���Y"��r���z�o�2|���*�v _D��넙%s�����k�$��+OV\��"�쎺�o5�%��'�N%=4�.�$[�͟g��"��JB�:�}5q3om�j���)l���Ef�.&*��̑�O��I���������`�rN�O��+����N>qi����|�n".:��ܱ��0`�g�]�N���<Ӏn��xl�{bj�>>��������_g�%ã�R� i��d!���E�E�7neM��g������v���t��P�10mjՇ�f��)X�!�Puh��za[#��#�8��[䬵���)�D��͚*X��2��C����<�zmto�&q�3��uG�^��籠 ���RH����x�}�l�rPo��[s!q@��%�줠�-��������*���+�f7K"(Yc�%o��+��'�#��Qk��tc#N�_�jߏ��hL�����0�b~ ��fȇ��v�<5]�6.̰�N�̚)��!i�m�����cA\����M����Fg�H��"��KI�U4[~t��a���V 3I-�&�ӛ�7�{���-�[5O�L�ss�bH{~!C1��K�����z�(��S�̜���V�R� n e0�.�z���h���2�� e���]>�V��V�ܔ�h�*ӧ�����Rz�'��w��zf�4���qGC��*h�L�1��|O��w�"�u=Q�[�?����)'�r�c� 5ъjz�A;��#W[�cN�K<��zy�ǙY� �����1�Pz��"�g/̾y���2�=-��$6ܢ��y�g�J�&���A&�>��H�BS2�I>`I�A�-Ɠ{R:=�#�~�fʶǫ����f��� "��/���-�U~zZR+�x��ιjKU(Y�`+���#�_����#�{{��63~��v�S����R��$X���v����[7{ h��V�T�@"�n�������$��2 Y�1��o�'d� 2n��7[e/�e�-@��z#��b_�FW��$����}O��Y�����/Ϧ��p<�R��҅�����NXI�W2��thTO�rr��6��2�i��4��a^9�Q��]��$�"tڋ�`���uI�ì��3�%i�,���Uuu����q���C�� )��e���@lw�::\���e��� Y�g�0"8$!�� ��6�r�E����WK�R8�皸�ˣ/Fcaj�1�q�D�j��y�-��� 1ʍw�b@IN�ϋG�>�6f��Z�;�{�j��gY����ץ��TGn�myCm<B�v11������֣�#��Ο�=X��R$Hy��jyhy���T??��2��S��<����po��=d�q�U�F �@a�:E��e{�5[)3U<�F�Ϳ6��pg�:��tԽ����*��g�Z�%f���I��� �ԋpl;l"K ��Z��Sl�\�����JwO�F�Ԩ�kG�@��mC<�O�W����W��Y*�Oܖ�{R�i07�Cfo˚�Y,��kߏ���� �kr�
Static task
static1
Behavioral task
behavioral1
Sample
Virus.Hijack.ATA_virussign.com_cbe6a99c2f0d656b5588cc2af8b5a5c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Virus.Hijack.ATA_virussign.com_cbe6a99c2f0d656b5588cc2af8b5a5c0.exe
Resource
win10v2004-20240802-en
General
-
Target
Virus.Hijack.ATA_virussign.com_cbe6a99c2f0d656b5588cc2af8b5a5c0.exe
-
Size
3.6MB
-
MD5
cbe6a99c2f0d656b5588cc2af8b5a5c0
-
SHA1
10ba4c226f046ada5bbedf578eae9825d18be498
-
SHA256
c0ded08b56e4ebc91b7af25fcc49a5c871678c4c17d204863cfebf4150ec6756
-
SHA512
aeb3a113a8b802179cf8649a73368d354ef4705269298d7d0a1b0d67f1f759de70e68e38aaa5619335a7703bb86f3190dbb9b867ba022f6d5f4f020be1428efc
-
SSDEEP
49152:cwVJ/qUQ5F5EexZD63Wb5wSSnebipRCoBRI17fMt6v77/lClNiuHL1jGgJ6OdoGr:3/257I6GnaipRT/md77AlDL1XsOdLVJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Virus.Hijack.ATA_virussign.com_cbe6a99c2f0d656b5588cc2af8b5a5c0.exe
Files
-
Virus.Hijack.ATA_virussign.com_cbe6a99c2f0d656b5588cc2af8b5a5c0.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 42KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE