�Z�re��i���m���Q~������F]��I}�F%X�vh� C�{}0���k����o�]Wx3D�7�����s����,���Z>�z�}� �2�^��AD)�q6��ˢ�N����W�=�-�:�b��W&Z�_��raJ���-�,��E�e_mu�D��/����Ԛ�G�X���hI1�ޡ�O����4w�:��K�o1��d�)2�'��5A�l�(��c~K�>�2J��qx�p��*�t�Y8yl�?����7� d�s�l� 6��Z�Mh$טԪ:�ޱ0 ք�����}��8�Đ���?9V ��o���&���LY���D}'���U�v��*}�JC!%�UUׅ����v�<L�����p��ą�G��_,��h��=��V�1��Η�c\�C���=R�r�S�I#��l�Sf��4�L�2���NO ���@��f���م�ȮH-�d�Q�Z������l]��7��uC�r���.��4�#�u��ŧ��e�� v�=�@�a�>��0�>i���s"Ա�� G��`W��HhS6�?P�=-������������ꙋ�Ҷ�Ƌ��g�wW������rK��њ,;���q"�}����Y��l,��T+(��0e�I��*Qj.G��xĬ1�`������/�R�.us�� 3֤e��E�N�NET�J�X`f������ G��d5��w�>�W�7���B�%���_���E~�7��p��+��-��\��iđ+�2Q�ݏ���s{���unX\�K5P���?I�h�R���k��Z��aܵ���[�WA�1�Ӫ���Z�Fh��Qh.�����k�����ĺ��3�NÖ�<Q֏�p��Z,�L�1�� D=�kC�U�f�L� �j5얚j~��B�Nf���%Q\���TH�\u(�8Q�=�튧�'�����l8n��� ���r����#�)2��/O��5 <ӄ)ą��Y'�r0� T�N��y���߮�Қ��z����|r�?' ���4�!�}���Lo<V_7���x���`�z�����@[@�<!���/���}�&c5d�ْl2��N�@�I�M���V�!ɪl�?|V6+��1��dO��L���7��{.J�;�|�N��pJ��-O��Ӷ�M�T���R<s@нk�Y��'�k��hm=�|k�,l�W��,}�g�b��NT�$`�ҡ�N��zK[NI� B����>�!7�b�u�j~9DS�&����w>��QgH+s��>:u�$�4 �(���Rq#�U���[�XJWBl��֧.����T�(����P̄��gG��ѐ�i 1{��'���d��� >_D�(�G� �P�Z�m���������I�?rjI�ΒY���Hy�L��4TzQ�lI��7�7�'���Hea���p��0� ��#b����f-J�*v���7���Ֆ���$mU�l_�6��G�ÄeՌ��e�ZU#������ٻ�����>�o������������0'�>R�lpU,�O��L�����N!0ᇠ±�%�IBaH�x�G��W�z�p~ږ~�Gj�3�6Z0=��t��]�А]�V�H��kQV�,2���K���$p��{��>s�l��;�@��L0\�U�!��֫��/�2"w�������s��ցp>���7�GchZ�0NZ��ؖv�����o9RJn����;��c6� �;1��_�M>=�$ ��Os���ʕ��WV��v�y��?CW�Y.0�ޠ���lr���@�_s>�8���d�1���QQ���A��0��5Y������@1tv���N�����{��F6!��k�.�^��aY @<@f���%>���LӸz���²/r�if�t(����ƀ&�m��&A�}u���a�:�\�i�~z�#�֑Wz��G��jU������9�#/�YFј�]�,P��jU���.kg�F�gn�������{α!�ę��5�͑[�+��U��1�A8�t�3'=���~>@M_� ��}F��,�# >+�w�-�&� �Itp�v��Y~ ��Ζ~6s/�%�ah�X|B' M'���47 c��H��'���w!x��Se� ����F��G���\�謶A|�,��_ %�ςu����!��$��\'�|a嗖|�i�6>�)���p K��6+Bf�F��(��6G��:Rw�eg&���KM�h�6�kd@(���TnɤN�:r�ك����A��O91O4&� �������W���]�7�|4$�ٸmro8;�������yD�tmPڊ��E��g����0[��� �F_E�:�^>H�w`y��d֔��i:3�?��"�wv��1;#QV,Z�-�R q�#�ȭl�"Kh�xE�0.�/y�<zz^�<6ZT)3��y��(B/��HQ��()8'X���bI[F����T�蒠�� m1nd�+m�(n��D�i,/M��R�k؛`��[vQ'pۓ�n��T���A�Tq/A��7�.����7�uq����!ņuA�k�ZϷf�ش0��p�i��W��~��+�D-�Ѩ��c� -�]����3�����7{����G��xlऋ�}f�Fڵ!�U���]r ��;��-�-Rr������<)|��vt(�D�f_� ���c�it2�&��K3������u�W�t��+�����,�Jp3� ��.e7@;��>�%<V/��X;��۳E�ĕ���!nRqnhe/Ύ��`k��[� �z��660�,�^�hb����Ԥ̐�x��D�K�7}�+d� �J���n�dE�q�� ԣ��G�*� �ۦyȜ̥XӇ�\� �P�d/or�ag�`3;L���;�=�3�6�봾b�F�m]�0����5������sP#Ͽ*�1�Y�0���9,�7�<�w���m��s-{r��n��:�V�p��O�����u՞��=��c�Ё�o[�?EE�جVWPU%S���>�كh{{�������ی��S�`�6�Be|�dž'j��H�{����-��Z�d�x��fnƓrx�W�JR!����+�������b��\K,�����Qv���ʏ�|Q���y��hX�� ��O��
Static task
static1
Behavioral task
behavioral1
Sample
AuraFree.exe
Resource
win10-20240404-en
General
-
Target
AuraFree.exe
-
Size
5.1MB
-
MD5
404346280cd3ad013484c5a28a13379f
-
SHA1
ea85a8d0459dcdd4074b7ae2573598068f8535eb
-
SHA256
15516f24fed852b0d0d018d99272f148b05f9753dc03235f49f70b9726099ce5
-
SHA512
037278b6f7d011bca3f3f5d97389d697d104c8221600341ce31dae6c5e9d199f63d130db503b3c792df72641a1e69284ee44adfd4169dc551fe68d0779913b26
-
SSDEEP
98304:5V14hRkr3M9zTeziJZyAcef/5oHfqTQ70OexyPiF1eXfV:7WhR1yUZyAcef/G/lREy+MX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AuraFree.exe
Files
-
AuraFree.exe.exe windows:6 windows x64 arch:x64
de4d597cf0b6c2f6ca3ee76200822b67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nfiwgii Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nfiwgii Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ