O���K��*^�R�d���6!oz����K�L�Be�(3V�D�i�?�Up�8n��I�M<��B�bV��P�jv�X����q<>�+�$���Ny+��N3���cQ�\K"�`D���\�I�P����;�'��k�C| ;�*[SK�o���*��Z=� ���J�D&�h(ykf�\��D��X��lI�C?���? �����&�.��4Z��3p���$��G媦Wn� Щ�^[��W��(�?�S�/��� �2�kQ� ��� ����T��|顳�H�K��7�tt�������Fu{}��F�-����sxd����6I�t��,:=�g�"{�!���M�*P��Kg�=�r�������vq�%b�x}���J������e?xT�+%d>~� `�ލf��rZn����Eac��gK�� ����ɛ�kח��?4YY�,q����ΝT^H�)Op�u����jR�1Oi���¡=R�J%�NU췭:{���j�|5���&٬1���P�|qq)u>�w�)����wR[<N���u��υP���4�ze�{Mm���\_�x{m�Tk{r�G�Q;��y��������2$6�<�U��ycW�~q�����f����W`x^ a�*�SD?#F"\�Tl#Y6�L�(��*�Ҹ%\\ԇG2DXBM���q#S��눖�`�ڟ����"� �P�5OkWg�bX�V�1i'���S�I�ƣ!�����^"��Ďk4�� RQM��ް^���n���A2��Ef+��N�:�����3����m�+�OH��|Pa*�����R�FRr���> ��&S\[�y�Zv���|�I��b1��R�� ��Z�0�X�+ܭy��I��^bb������a&�b���Ά����N��VOT�N��㪢V�����V�a�&�~7�}e���rr�:�ʣ<���8X��t��R���z9��!�����?jB"5t���D5@�<�����w���žUN�\���&C:�����O�.^� "7�l�,|8���p7Op�,ʬw�����g�:C _�����F�{��c��Ȯ�C%��-�����Qe¿�Mh��<ͯ�)�CD�������~��wnQ��D�S�#���٪ů�Pp���Я��:�S��̰Z�Ƌz�md7h��|�4ls���)���X]��>��o~q����ysI��$��SJ���P� �߾ڞ@`��Dk�9����̤���/͓��(��ъˡZ��k���C����A�72("�[K�棾ҏ�/� =��-����x���(�zl��ᙗ5v�k�c`~�c*`�ZU�1_\�l�wNU[�/6#��%�V76ha� s�_K��6����W��#�!��N$1�`hN��+{�x��YwJ�jr+qt�o��3�6���� ����-����SL�8������t���*Q_�{���PV�(���U8ֹ�g�5(K(��Q�>'��nԜ����(4�,� Q�����Sw�sW���&?�o ��.f�M��Gd��g���.� ��&}Ԅ.h~�ު������N˱6*+�o�0�b����}@����[�1�\���b�C)�[�3{���ͯO;`�u#ȋ�T[L/Q�����()��$���:��5�=w�� �~LWY������ꅡC��I��`�h����A�!�S���@mP��x�������z��h%�N�sk��{2@⩴/ɂ��re����C�X,�0���ChhN!3�K�;AF�<���ƼK'؝����k����*�-�J��/���R?+ʄ���ƀԋ��$�C����`���<3?�>'�n�ȣ����ZE�S��m"9_â�:MG��ɰi�e:�����j֧�T�f{c���Ơ�ĕj�致<�k���3�צv6M�[��S�w���=�1̟<�Mv\�8�}np�����?Y�V�j�M*������T���4v�ҀQ#u�=����]�S.��5Ț��Z��$1�]D�5�!���J������)�v��b�0�=��gm�� ��6�3"�2@�ծ�4# щ$��&��?������{ɧlnnt��Bg�2�����3�)beV�9`�$�v��i�톁�����%��ޜ�D3�*"�:�yW�q�+��5AB5��Y�j ~E>��q�8�X% �RQa�t�Iԫ[|�x�T�N�s�[��_���[�_:�sؐYQ�q�V%A?\3\��2K�܆���.�ˮ�\�Y$��ؒ|��5ϽKCPH���%�Q2��)�8�5㋲�l^��'����B.�=^Ѱ�ObY ����Y����j}N��6o,�a?=����q$�*6�5���?�]�v���JՖg"����o�VD�o����ۊlZ��/���w���I$:�X% ts���&������9sHU��b���0p�9I�vU)���Q���s�� Q�0��*�Ps}L ������M=����xJ�=-�P��~���B|����Ȅg��@�f��pz�-Il(� pX�����=�Q��#6�o��O1�o��@i�����|nB%���'����z����L�Q��-�l5�-g��BVC��Gڏ�?F`I�,�:w�L�&�zL�0P�������"ͮ=�cR���s������!t��>���E"0�*�G���.���I�z�&~�e�R��alT�Jy��\ Df1�0LMbh/�Y��1t����:0V[|�s�ʵ�ݽgrٹ�ibm��|-.õΰ 9?P�8ժy�Ǻ��E�I:M��V��p�����T�� ��.1�7��^�Y��-�Pj��J�29�[!���U�;y��%�� �ao�+,['������e��rE�]�e7�_�'%Q���?�7}��mÆ�V}{I�R�����[��՚�W�:�}�Q�OktE��k��]���U"� ���<Ŭ����N�yp����?v��[F�����ih[��D[�{�d�������.�t>��!~J����F�9��Ɍ��1K�T��Y������3'��4������Ri�5ȳ�����Yro�Plj4�ϻ�<dz��������@�9{�H;�5 l9��I�
Static task
static1
Behavioral task
behavioral1
Sample
a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea.exe
Resource
win10v2004-20241007-en
General
-
Target
a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea
-
Size
1.0MB
-
MD5
aa4e6c000005a582a028f3826ff79c8c
-
SHA1
5279963c6eb8c8f5658b5a8d2a6d96f2e4643e2b
-
SHA256
a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea
-
SHA512
b7a4c97adedbe4cc1dc57d17d861646ba90b8aece942723bbe9b70a9fb56bff60a92c84f9ad37f3eeaaab1eea8c304aeba2bff105b920d046caf541b2c65b0f0
-
SSDEEP
24576:BnhJ8c62x72FdOr/75MHqVVeLwK/cRgOnmq9g65vEgavcc5MOhD:lH8J2x72Fd6D5MKVycOU7m65vkp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea
Files
-
a9f42f248054e0bfcc75e7a0ec9a6548d43c055d1f56efe42e3a64bee37807ea.exe windows:5 windows x86 arch:x86
74c855db8095af6cb3ec57e431fbdd8b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CreatePopupMenu
MessageBoxA
gdi32
PtVisible
advapi32
SetThreadToken
shell32
ShellExecuteExA
ole32
OleFlushClipboard
comctl32
_TrackMouseEvent
shlwapi
PathFindFileNameA
oledlg
ord8
urlmon
URLDownloadToFileA
winmm
PlaySoundA
wininet
InternetSetOptionA
ws2_32
WSAGetLastError
oleacc
AccessibleObjectFromWindow
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
oleaut32
VariantChangeType
VariantChangeTypeEx
Exports
Exports
Sections
Size: 236KB - Virtual size: 792KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 54KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 348KB - Virtual size: 1020KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 337KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ