!���/{j;a�}�W��Wm����jF������s�_u�*�u�I�� �2J��v��^T�w�I��6�-w�uz$g� uA]"C�r2����-]%�m����z+[�����0��zϽ�qӲߟ��\l�Ӄ��x�V�Jr�3��G�G��[���qs��;YQe/ {_��$4�[�U%D&��z�:{9H*�����I������R�iO$dp��V��ȫMc�q^Y�J�s؊Xm9�/ʘ����z����hx�JYt�<31@0����g��1�s�g���(i$L��f�d��}���y^82�;����U������=�J����jA4X���vHc��`{�j[��$7<� 0,CG�Ik�C�C?(e�1���d�`��=���57�Q1P����|��-���#k���L{e�IPN�z�Y3�?�}���lJ�w9؆e�ӫA~{9�x=����bDj�������j^�V�k-e�GF��%CW� ����-F_͖v���9�f@�^?�c&A2��������^ U�����x�h]_6�(�|h14�Fũ��G� ���@����%ZЏu|%��h��ʊ�H`��!��W[�4����xv�({���)⢏���.쟚 b��$���k/}R�"P�:�����(��D��Q)���g?��g����(}�v? 1}:}��kS��$ �q����(�!��1]�8?S��y5��8����Q�,�ĨJ�%�Rً�8̍����lH�7��SP���>�;�g�g�w5�]��Z�j� �E���2>v@���1���5����x�y*��f�9I�ҍƩ@0��J���gR���費J��w3�� m�jA���C�tFo����N�D���y�J�RUU�n{0l���̕��R�����A��� i��_���~+$�Y��p'� 1z�}Dm<^P![���C���)�"O<��%چ$��}� �y%�:7���4B�2 ��Iw��va��?1έ��L�<�R����٘AΩ��Ɂ8ɩ�j��w��_?����G| 8���+=m)ºT�((��~W����NY�XA⚽ۄ�<������_�n�����/4"0��r���*�8� ���,���;'���S:��=���v�*@Q������1���)k������y��W -�8Ǟ�G-�<�̆��m>�ܚ�2Y��Cr��7$x����Q���w� !��a����F�X*Ze�<t��I!m��9�7o]�xN��|$<w�eQK&�%�5�@Q_�\J�OPv:�N�\߈�k=��Y*q��ywd��fY\�'"7$��K'ܰ���j)�%���ӷ��sT���v�A-?(�Ͻ�Ϣ���3�g��F�m���p�zp���%��2���d�m�qV�z���PfG�"�&G����k#���)�& ��L�H�t�gZ��ޫ���1̾6\�V,�GJ)���E�#rP�K�r|0O":�9�X��~tM0q���v>������� ��)����B��w��"2�{�3��g̈@��n� ��DN9;[�n�rRI���vW��k�5:n@!���9zޣ�����6}O����3Q�L� L���@^2����xM#.�!Dt*o������{���h��E@���5S΅�*�ͣ&b�W�^D� �v�:y\i�M�T��v��vj������?�V���ᤤ�[�O�3�mW���a˲��Ŀd�� �w �����ŋ�{#��J��L���_Ε*����{5{I<��۟� ]�+7�!����y��e��[g��#�m��x�1��"�*Y�V�쑓���K<*=������|L9�ZQ�� a���x~m�7D6UY�/?�L5o�{��&V��R�ӎ�m����]�T���������߁�k���ˬ ���PUM+�bA�����MB��� luV�d��Zg�r^!J�����^O���>�Ψs������C�����T~��a��9�g_�"qw��2��)��_T��s�0�hz�����������lp"��/X'�M�觗!�67^qT�8v{ 0�2����P�մo�(��e�m;��jjv��m%�:�5���v��$��v{��oiҥ�Hi���dٖ���5:�MVƓG�`��t�s Y�R�$h�ډ���N�;���~-Y��\���8J5bb�z�{�n���~!͔�k�����XA��"���I��'a�4�|4��9j��/���jU��_P���ɍP���L��0�����Z]z<�G�m�"�����沽�l�0��/P6m�V:aZ0}{.?;lt�����d�В@�N��ŀe.��j|�|�w�v�V��M�����L3�2xZ/��T�Ш(>��^���B�Y��h���D�����^wGX<�����0ƕ�N�a}�9 q�ѹ��R�~�3Ru�P��k�za w��A,,$t2�UWP��G&���לI�鬟>�Aa�3�����VMנ��g�;������F<O�$��^t�� �� �r�ow��c�ԠF����[<���\��GPE��� �*���H�I�|�D``u��8ى 4�-�x.�OHA�Z���Y�8�<�ש]Cպ�Ee�.�l�����Sn��_/m���R�y�b�� �-1|ί�Q,,�f��=�<����}��;z\ ����@� G�JGW�M0�H�w�x;�Z�����?71�s�d�L5���e;����@W�2�[�T����R�� ����"Q��4j�������q����Nk�<�a���iT��"r�%�dl.HVv��8�~�=q��QpMX���dIU2ɯ 龀E,�f)f3K61?���� Y�<��P�/?�$�~�X=v�r�+�2��=(��$&�k��U>�l#�o�*�p+i�r�W����[s/��&��D���Yl-XI���8v�wF��J�{6�F�y�-q����F!Z��� �EʆR��;^9��ٕ��ud7��tp�w����.�K�Y\���t�<���Z��圔��\J�����W&Vz �P"�i�^�uMORK�Oiث��K;�?��u��/�D���`�3#�
Static task
static1
Behavioral task
behavioral1
Sample
0661dbb6a0ff7d84c25ae7dd840cefd470279346bd476f1cff5d766f0902a277.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0661dbb6a0ff7d84c25ae7dd840cefd470279346bd476f1cff5d766f0902a277.exe
Resource
win10v2004-20220414-en
General
-
Target
0661dbb6a0ff7d84c25ae7dd840cefd470279346bd476f1cff5d766f0902a277
-
Size
7.6MB
-
MD5
0c0c7081c72000e7912d89567b90b866
-
SHA1
55809cce167d93dc3e98d85d98040bd393be0a66
-
SHA256
0661dbb6a0ff7d84c25ae7dd840cefd470279346bd476f1cff5d766f0902a277
-
SHA512
c6a43e19d126f3449195b40237fa2b9eb3f2750974dfe8738fe9d8eaf9d6c642d70db1f8746b698ee06a7a94cc2e05826a2b4a70b6e86b1cd1066ec78e903f52
-
SSDEEP
196608:A5kIyr9DK/yoUopbYU7CuovOjThR+AAUavRnRWNb:A5klr9D6ycprCQ3bbAUo5R
Malware Config
Signatures
Files
-
0661dbb6a0ff7d84c25ae7dd840cefd470279346bd476f1cff5d766f0902a277.exe windows x86
0c8702090f96587df3ef3cf88157ac42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nCG Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.T[? Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.]id Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ