W!S�=��s ��� 0��JVZ�:�<h� ���J9�{�UY���6JY�К�h��(0$d\`!�j�=A�&��IŘa.K����&���t~�E�7&m����ȭBlbXȧ�Y��5��M���=���U|���B�ʋ!���Ɋ�^5�ss�B��@`Ҡ�4�1�1Wu�y��t7M��{B�p�J� JW���n��T¤ʯ�g�!>�rto}�t)���j���Ж�� ������Fx�Σ�T��~��k!3������K�+�;�}��r��V/`��:����8���My��o�7.=2�9@����- ���^�ʕ�qW��;�S� �w-�zV��h��� ���pbQ��v^ι���Eu,��.�&�����)�>���|i�(ػ�<�]a|��T�j,O ��p�So��3'[H�L�$A�L�Q��̣�c�}4�ֶ��䇖��n�<j�����'��&2�����N����&ۺr�ψ��L懆���i,mk����6m�jcwU�G�e����w�5�'m%����W�i�:�#%�d����珟���ik�J�h��[�?�ؿΣ���|�%&�S$������p���wX;�Z�c��7r���mtB���F�����l9&#o��%P�,^�KBF��MI�<��������?��m`���(��Rft����Ig�f�غ�j�P�463�m�mU�# �k#5ӯ��g���m��؞��6C�|e�P'd�-�Nanc�f�����S�fdJ�����ʁお� �`�A�~�0�\���<Ԩ���8�l�����ԝ��@1�~���أ�4Bɷچjùc9�\�奥AFnD��A{nA�E(ucF潕+�$������J9`�[h��9�ڷ&�(5��ݣ�&������D�oO�U����T��n�*J�EE�$�%�6�����2�� #�pI=��ɯR���]})Ш�waNdA��V�Dz5j@���M.�����e�z��O�E$��\T}��ܠ���#���UG�en��\49鸔����q��\#$Ⱦ���ND���o�w��vI�����#.ь�� wϽAk���aF뗽��%7W�p�P!�|��Š���!)�QB�� ���h,d� ;��8�q�q�w�\D�r�הu?�\$�y���"gpL6 O��dS�9�2m����ŀtȩN�nG�+0����=DU�(a���5.� Яv`�T��EHg{kO��z�G!!؞S�M�m�]�5�Y��)����l�b⯿�Nˋd�Q�^ f�J��śa?�+a�^+�43����������ߤ���p�Sp�#O&Y||���@Ao�;���9��}����V��Lž���̡į� ^6��b�"t�܀�^v^�e#�e�S����6�|6��Ϟ�z���ʣ�Ͱq��.�Uhh��ՂV���+��$]E-J��VZ!���퉳X����#�Zc�uY`�%�8���=ʾs)6��l�ni-�g=T�<��9��ȥ�;JEVcX����d���@]�9���pwz�w��`/A���RV��h.��V��pA�@��A�����`�*Ѵ�HgȽ�����Ǿ)�1�AɇWd̛�7Y |)�֘�=|�����#;2�[~�L����K�Μ�N��xw��j`1�q��JY 4M5����|>��wB#�P<h�ȏ��dx;���)E�kR�+���>�դ&����VZ'ŵ���^���`n0���BAp�'>hrg�y�l��:�V�Fs���� �{�g�m�Q$�� ��"=Bp_߅r�%�)�2@ g5���n�d�s�l��h�ō\tv�Q���&�̡fX�I��d�܆�����\`��q�7F�&��*��xA#�8�Us\DPA�o2= *��Sg��d}��������c������v�G6��Dxy���#�R�B>XZ�V�����(zf�A�,Tk8��K�nؒOK�Q���� �$�����=m�8M���$��x��9�$�@T` Ǧ�v;!��]���G���X��G�i�@����>�����7\%ݎ۽�@v(�:�l���f!0.�Ŷ �F8'�*Z���?̿tXw��ߑr.� �@P#�^�ꦟѽ,�ne�aM)�kV˝�u�&ZE��a�+��h\��u������<�I����>��cg��a���+M��~ �`H���}Y���QĎ�\�:��y�Xe<&�^^�#Ӝ���|K ��]�� sc��l�pC.S��/�X��3����TSR��n����T������U *�`S�+5�GV4�$������~UZ֘V���Ar������[��[ߨ���{�]E�8(��@!�;�z��Ġ�~v�S��r������)��7��c��Y��y��6��E�J��X����X>M��*o�M���SN�5h���(��m�����9���<�%{�J�����~|�R�rDu$^�ii�D-*?������p����B[������ ������ݱ�[�c��+(�i^^�1�Ϟ���+`��p� Խ��^� �7��hНjX�>�q���_�Q��cβ�ʢ��n[�>q��S�p��Aߙ�$�p-"Z��Xh^b��ɜC`K�=�����,�~;���k�=��[�X"U��s�:S����}�˭B.&!� �z�z�F�����QIܹ��~V��Q�NN�ϝ$|�n-���8%ɔ�#���+d�_5�����xI� ���^�݂����j�+��3N.3�a��n�b0OU�G���s�����*�B�ôօ"^�2��p�<!Դ-��柭7��3�?��J]_ ,4o���q��[F��1��w��k���:��t�q��W1�ۓ���>�2f�~�VɳLB�����b �!�\y�[���h)Ӂ4����3��pML�1����T&a��9l$�^����u�=f��PAաjA֡�[l� 17�7`F�6����~jl�� ��'K*�tJ�)4y�y4�4��(�e��;�Nx?$nu�`�qf�Ly�NP����A*����`v<<�����������K�{���v�
Static task
static1
Behavioral task
behavioral1
Sample
a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024.exe
Resource
win10v2004-20240802-en
General
-
Target
a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024
-
Size
4.9MB
-
MD5
9c4164ba71b7f4a8977aeba1f4576a50
-
SHA1
cc000ad180acd8ea8b5ddf58ffef3cec493e7b1f
-
SHA256
a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024
-
SHA512
0a816872f99fce68ea92a2a551338d3c3494b6a5a394e7475d1b27fac4959956fd6055f607482df49b85d35660a40be1ec7f70f84c96d4a06a6e735fd4dd3936
-
SSDEEP
98304:tNJzzQymTuJRM1/U1kw8kg9tYp6+ZPFSof8ovf3dtbLfqwkoHziTj:tLzzlDJOi1kweYpNwof8ovft5fLR0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024
Files
-
a2983cdfc1541e005af8e364ad0f9416b02cdb22907e2120037c59a89d310024.exe windows:5 windows x86 arch:x86
873edfff01eafb8a04b0f8e283bfa622
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
ws2_32
WSAStartup
shlwapi
PathFileExistsA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ASIUDGYA Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ASIUDGYA Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ