O��e%6z��1�I^�̮8=��n*���x��?虇���:-�B{��b���߯Fh�l"L};z8�~Nig��Ұ���%��?�#�:&Z�D� �3�8��l�iNSb�/`P� %� �\��E'��gٝ�K-��b�]e���/����v���|��T� C��-��O�-����Yʄ �)23af6o�Oh�L��4K8{|$Y���T.�2�f���vC06k����t��$�gG�ȬFs��j�&��W a��R��!�MXO���|`�~zT���:�|�G�Z��e#����� |���D�9� 8��{����vZ,~��r�u��)�L�_}2`�(JHC�m��� �/p�$)@�� {?/���oj�k"R�D�#�j��{ߜ��;+����G�:�>���7W#C�m6"8�/.�Lڼ�^���*3��@e�����V/ KVD�Zf�fe�e��\�,,4�ߨ��הs��q����� ���\��I;I����dW��E�hf�=fB+T����i5�gZ���� �\���|����6�~�����E�Lt���eՌ~���x�������eݲج80|�8���y��53�}/[�Z.�C=��m��`�l��=+.MslVWh�����t�Q�FZ�G�%���J�RK1* �%}��t��u �V���4�uF��>b!�~'�#6��\y�9����� ����1���Ht������H\rS&���IJRV�@��h��ɱ�l*���7�A�;$&ѡ�\Lew���s����X�J���S�1��GGV:>s�W�3��sT��N���7=�j!��|�r���Q1�Ql�G{ܘ�`�)�+b5s�g��}CY�*����M8���-k<>�J!yH��\����5f!�����ӑ+���a2�`�r0ؙ���淰ȷ�`8���s|F�L�%<��b�^��r?j[����+�2���w5�e�\�����$�y���|FOa�ҷ�Ϟv\�9t� P 2���|�Ϋo ����/#���/��i�xg��^�hq��E�l!��Fk~F;W �l����t�>M(� p��&��T�Jp>Ju3,�s ����K;��,?g`^\��^��<� �����5�s�/�[�{]ˤ��&��gdij���no� ���D�e�7g+!�� {p��Ш�m��a��l�\ˀ���c|cI%Rp3b�`ѿ)x<0�>5�K���f(�%+����>���#���?A����g��xpǵ?�q�^�7��}Q�b�'���Js�g����C������e�%¾�Z�ލ�� !]�� pԐ�- ����%zT;�w!�B7�A���.��4����Aa����И��07�voKgk��Al�'� �\=�IQ{n4�)��ނ2�S�u88I4�^�e���<��� � }`��kG=�GdN�62��c�8�G���� ~�>NҝU��<���ҋ�yU0,6Z�1�I�C��Na`�4 ��,���":q7�p �Rg/&�n_#�f�v�P�yW��_,�;���!�b�4bh iR���̵?b����DS<6}�$Ϝ-큈��v>1K�4AQct��#OF;�b�}������=�\y�x�h�P���Բ�p�¨vG)�k���o��,���E��&IN���).g�S���V��>\2J|��㽸�"ʼk�� ���e�K� ϣ�|��/�E��Mx���_��P0$B<E��L\:��v����䛔o� �лYd�Ⱥ��NBN�H�.QYFpO��۞1���-��0c�V��K^Ĥ)�<���i��AfI�0�z®��+r4[�� ��)��K���5�� =P��%�d%�]`�*4�k,8 ��E6�U"��/p���nE»�U}A>��x�jb�}Xk$C��o�[�x�A��#�}�vﰻ� �q�����J�L�����o��+_L{6����}��(���=k@�i7 �#�/'� Ȳ�|�o@��t���1u�0��.���������@�,��Ȥ�sțA�R���Rw��~�5ao��e��.����z��Hu�A���H�Iig�+�bf�o��� ��L�C�6^���~�_�7���7e�J���i��5���3� G��ُ�_�u����L���<�`���.��"s�(1P���~�0���h ����ýG�R[C���|�o_#2��l��M�Yg�� ^��:��۷�O |t����k����<e��}�lNzE6h��ĠW�<\�C��7�a���v���m.��8E�&5���3p �������/�P|���y���i���%n��`�Vij�P5��C\��%���� ��C���N����}6�@�ijUZ .{Q��I�d#��$]5��O�'���'?��N���}���Pk�h�%�N��!����o�iDH�e� /F�p�Os�gZ��N�>�>�5��/�u�f��1���k�3䤵��<D#5A��SML�u�������}h��d��O����@�����U+�'�-��ӳ3̞���1��'bZ��Z�%�XN��cR�a��!" d�T�^�Y*���N�^v2R:�"O�(ՈP}�Ou�`�K#�f�1��PY*�x�� C��E��kɈ���c�@���:�L���[��%�ڵ�G�H��#��`�o��7}�s��Dd�S Jr���1{a��ز��l^%���b��4�髂g�A�·��n�\��<,�V����@2L�5u.̔y���gI�@����3�Q�13;���c��p\kL~Fw�G�f��~j��H�ld�b)1���:E9�fi��� A���a\���`3��M�̚�-F8�Ž�i9���*T�z� (�sgt2�`�r��'I¤�&��' ��e�4O�B��_��<A&�� վ'o�R�������"N�]d#�� �'Ct�Y�+.l�?�$+Ǣ�8`�jp���k2���%�f�M��)�Ԉؿ�1���F�u�8�"��@т:��"�;8�v�A4j����"�����r�P��l���87x(+ャ�m����*?,7�8�O��V��N?�/�Ϭj�C�������tA��0�8���~9\!������W���-��^aNj��'и��i'X�K�&,q�� z���i����Ƣ�͚�Sۡ��af�z�^���0W}`�+��zL��pied#�P��?��a��Y��4:7�,�o��h��44�E����N�=}m]K��K�������Wn�$�#aP(�O��0�@�� \ �|6o�.<,�֚�ZmSà ���'@� G��_�(��^"��``��>5.0�>��(%�ƶ�.�1/?e�X������XP1�P�M�W���x�]�m���r)��:��Ө��E0٠hMC�^˭Ē����8wx�YL�qI��uQ�;B�)\O��$�$�iV�U\��7L�J�����j_w���i-9�����y�[��q�#}�Í�,)Q��m+�q�8�ڗI;o�{ѦDqu�v��| ���5��ŏ/�� �7p6HA�;��uzh���� ��m'*�w��+;編 jT=Xx�6��P�e2�Ġʅg1��_k[����1?ML ��.�IZw.����}M�4���r�T��o٬^2�t��f��)�"��h��)F�4��������}�ۏ%�Ƃ"K��a��$����P���Xۚ9�4�+qXY�.�ŝ�(;�H��p�xwz�\�/nn�l��� �Mi�Hϸ�sI�-r
Static task
static1
Behavioral task
behavioral1
Sample
a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66.exe
Resource
win10v2004-20241007-en
General
-
Target
a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66
-
Size
9.2MB
-
MD5
ef45c5e3e310d8f6869f17d33147a5a2
-
SHA1
fb799cae30b682b12bbde6c5af03853528961de8
-
SHA256
a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66
-
SHA512
c6542438a7f38794e22df79807bc64811755d69788900a3470cc83b1c1596f0de7cc55e2a19b334ae3ce9de15098d5a73aaa541d5879cd30520585601034b747
-
SSDEEP
196608:sYHB2nuRPsrdyLLae7DZ8u/4i3mJztJr4fiMd6Q+4zSKAxlxBw5hYU4mLys4:/HB2uFsr8P8G3mVMfiXhuPAxPBw5h14M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66
Files
-
a0fa2cf31085a772132409417fdcc0acbdaf8e5ca6df7890271f630ab8f74d66.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 255KB - Virtual size: 728KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 158KB - Virtual size: 668KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 44KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 384KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 6.2MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE