�d�a0(�yt�=�o_��f�H��kE%�!0��;Vx�_���Ih�E�7����� ��K�������S���y�Ӭ��������G�*~K±G���l�(��]'����f�̝VE�L`��W1t��i��?t��K�e�B�nlTmYs����Q�s�(��˶��,D������d��W��v�R3�{4�Q8 �����Am�!�$�WkjJ��M�pq�\|����s���H�صB���v����s �0y�6��S��r/E�4����[���&�p&������mi��>'}����'J���)6#�ZH�}����E+W#lc)߬�����c�'�deg/����2b,��7��̲B��K۱w�e�U�ΚNKe��������S�ݑ�w�$�>�Q���k�}��=~.W�g��?��~�[6a�9����V��f\*s4C��*�rգ����]-�>Xz4Go��Nw*<�^�Sr�����)�+�ѬW��SM ����a�( 0R|��������qYؽ���1p�]��ӭm^��hك�,���擽�`���o�������+�߅ �x�����; W�u���6o2cp�����16�IjhM�7��ғ�;j�vUA��l��o�fd���z��ܭ�۠(���E`��eM��·�$�T���L��C!w0f�.�O�L�0�@�y;k3�����sY��Y���[�E��bǽbڴ���e���O���d��wb؋a ԮT�{�Ϣ�#1�1���EF��W��Ѩ﨑�Sj&��va�o�!)�~��C�ʬ!`j��[�T�%��x�I�$0��o�9?��)f�s����]�q ^�ѻ�� ?%x\9��� ����L��5@�&�)2"V��'qf�6�x�����oI��&��\�c\���҄ц�o�{&�+�-Af���i�(���x�#\XG��B�-���� ��m�e;�\��<��T7�Xq��pr�įj����;X���Hs�Am�)�RL�]��(+��Z��=J���λAߊ��kW���/&p�ϡ�β��y�����Ş�zV_;�C?�>�?,��8f�n�_��mի�H����y(ON�����WԮu��!9,D�r�V��Bc�y���Kz�N}�M�5���tg��F��k��V�C"1��q��HҜ^9!��>����)��d������֛��C�Mϫ^�������r!��B�lz�Y�)!;��_TR�����v&_EB��?\��p:� � �B�M�˚��x�4}�ζ^�6|��ه�f���>����p֕��&�UޟT�Eg�I�ׇ֕��H�e�tc���K,��H]�3���U�l,x@>@����ԒsA[��~��Ql��I:��ԭ �9�2���[�\:��>+ߗC��Ί�V��eCK�v��!/��QXs��U�m��.�Q�[/-����A��kD�R��^�,�j�u�ъ�r�emL@^7���Ƅ�%�I�<���q�Ձ���Ia��f��@M��@�����2��'�(����7���@XmM�q�C�M������x��.ٺ��� n)�7NӒg/W��Z���#a��(.���"����%���H,�����!���S�D%^� ���)�[3ҝ�Ύ��%E*Xy~͐5)� |�9u������Rz��'�X�;�t(�z���C��P�CQ"M%}a��mۖN}�o{��͡b����6M����gllǬ�����aC�ԁ1�������A �����l�b�q� �z��.��H��z���X�����H�)/�e�՜�;+�u�ع����bO��pu�*&�D4��<��^pUb��4��Dۏ��J��^լ3�|�=�����-Pkb_�2Ic�� �:�̱�S��c���PH��5%Vhuj�����f�A1�%� ��0�wcK��e��Jb�c�m-� �m����ڜQ�"@���#�U�7A�<Zz���K���+�⦵�l��$C$+X�T�,H��;_)2���z+���pZ*�q����d���U'�f�.K��,�q-si,{�.u I��� E��s�Ǥ�k��i�bMW`�g �t氼���$'Z�������[��+���U�Q��^J6ÞU����z���Y�G�ex���(7v�:�f[�(M�?���?�AQm��h��<Q;�r�Gڟ��/�1��]���u������ӕ��>��).ڽ�z�\���"+�`�⠘��*�(C[#R�g��b�0*���J^428!e=�<j���w���OҽB�`e��vl}���Q$\e\W��>�R��H�Ė0-�,ފl�Û$�9D б2�:�r�1;�2볟Am���v*��#W`o�����11������x� �a^�C&��R�+��I�$$W��V��3��Vh�R u>5ڳ��E5�W%�g'��:�z�!(������b(T�2z`�1�����^��Ğo� �p|mH5�\B��L4�kXY�H�Y"�����5;���KZ�̡���0�'Z\������F[ ��y\���$Y��)���N��i~^�c��P)��Zd��E�\�`�NB O��l���4�ӎ��ي@�:��j��߫����Eګ��Y�������?�g��6U_U�^�m�� _�u�*^h�@��q#��s7I?�����MVs �XK�ٿ�'�TDK��-u}�$�f��o�62u"?W�i�^'�G=>)v8h*�&h���7;8n�%%�S��ϝb���ۖG��$��D2�dо0u�Ao[(E3�ͮ�\�t�6�E�0�ع�y=�7���3�+0��81P�j��ٹ��g�-�4�j�v�;YH��w�Po��M�"���<Y&�V�ǣSʕ`����T���n�a�� �ٽ��`낺<�����q�f\I��cSF�"�ߩ�����Vhk�b�9����p� խu��aX�7m��9LRr� +��O^��x��e�������,�ɹ�+��2zZ&D�\�dž��狳^�ho;]|��6�%��!f�ް��%��MRT�Wm� ����F�Ttؚ��
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.Autorun.ATA_virussign.com_70e268870fc2e024760528180271be94.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Trojan.Autorun.ATA_virussign.com_70e268870fc2e024760528180271be94.exe
Resource
win10v2004-20240802-en
General
-
Target
Trojan.Autorun.ATA_virussign.com_70e268870fc2e024760528180271be94.exe
-
Size
2.3MB
-
MD5
70e268870fc2e024760528180271be94
-
SHA1
0e6e41c14cb9f8128ffcd5bb08e0b32cdbcf0214
-
SHA256
9a82a63687cdccc75eb984b1bcc0c72a2ee869568a30f4f1391cfcec01bd6125
-
SHA512
17fc1b763e8f65b08bb2f95cb0f454aa29b406ef337cbbcee1702755ba81c93c2f62305dbd11ba6cb4fa859107771d27eac2fa084cd10ff4e602a25938801049
-
SSDEEP
49152:LcKVDBe/gOs61xz/b1WkHlerfJgQmy2EWsb4AYj8UFop3pAWXry7:oKpBnOs61p5Ip9Ve8UFEXry7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Trojan.Autorun.ATA_virussign.com_70e268870fc2e024760528180271be94.exe
Files
-
Trojan.Autorun.ATA_virussign.com_70e268870fc2e024760528180271be94.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 32KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE