�]̉eLT��6c�u�^�k��2��;� @ ��$`���!�)ngvh�U����eJQm�nq�� �chj�� ��[�����D���6�$+��+u�9,�i�����j��e��Eqq��#Z�U :�r_�̋���B�Eq�m�Ü���R�0<�#�/�y�v�:'��r�zo����:fwVI�+w��r��� 5V����Zr�;����"�L����7EWE>H^b��l5y�TV�!��e���X���D!� �K��U6�%�IXS�$Y(�"0x�g���n�x�JE_�"����@�[Sf0-Al���_��|�t����5�$�B��Ҭ+̎ PA� V�Գ�N���A��^%�q�*��7|K֒��ُD0spR�j&2{��Y���Of&�|Ym�5��T�l�U{�a�#U[���\�=��Sm�t��Pg������؎�(��-'����l�G]F��@�i�}q�aV��#/@ ���)NTj�q͓�{�A�~'�Z��z��hb�t���t �0nt��M�\�v���d:��c�v��&.��@����l����:u7���#�D���|a���!@J�[c��^O��[W�ӆ���].�l� ��kJ���O�ov' ���n������Wj7r��|�i] ����]��8a��9�M�d�k{k)CT(�{n_�d�.����X�7�T��Ap���>ø��̴т����A��P�g; �g3�H @^mKj��&Po��B��`�W^:���Z�j=��<��8�V����N���` �K' �({� |�A�4}����O�0D�F��'V�/e�&�_�m~pj�]n���R�<��Ϧ!"E�^�7 ePl���Km��� %��8�0����?�8����j���7���^�Z���"�}Ef��\��$�J����ܺ����+��:��灡�0��E�%l�~B5G%[��S�,��(�>t��P�G�J�bv�����PUU�,�*�B����A�q���ZtU�^�Mz��0�` ���f�R1;�fk �8M�����N�S�g%%'�Da����O?ݷ�;VC8_�;u���0�d`�Rgڷ�7mN�#�)�j��@�5aG+��Z���m:E^:�S�@0h2x�W%$@�) W��艔�ZY~[ 씟�h�W�����Zc��.��f�3�Kmc:r&��E�ا��q�v�6�X�:���ՂhRW�[�Uw*����E�;'���� a_zu����@3��3ŵc>���`͖S�!��\Ek#ϣ�Bg��VD�� �S��J�D�ݥ?�����o<<R���S�aM�K����ЪL��|��ۄ+D�O�}=��<���B���d~$�0�8e� ��@Ro��Mq��5�Y����@�ΐ�X�¬�^\��~��\4 � � Bç��+��Kt�:���\zt��l{�v�'r�� ��7c�?�p;v}^�._�z ��z*H��{��S�/�S��(����ua�/��7����`#G��?�*J�`�����¶ _�}�4PB*ĝ~�x��r`Wy���ϑ�4��1�NFgT�<4�0��`����ޗ/F�����������w=ԋ��U��B��wF�ґ�@��.�.5��k�L����k�P��g�g;��y0|C;JL1�P�HL�}�S�� /����U��T�۟6��Ơ�qf/_���3�8��j���B�d8�hOY�N����mhᛀH��ۮ�>C�b�j�� Ĥ_%�/���[ۇ��B/������6�vjP�E0##�JdoyF;)�P5;Nm.�T����[-�G�����|��.@F�1mR`����{�p�T�C�ev�غ%��Y�$Fux��;@'�ʤ�_h����6b�Vp���`��L���V+O�'��rX�;!Ч��� =���~���=7#M'!/Hn)`u_��H��M�����>�;�\FC��c�,�)���#����Cf}ι��!0m�� �Ƞ���v�o�)<��mb���@-@n���tsw�##������$���{c�^'>�JA� �K��:==�?�,��5�8�����k�R'��T���^fu�ֱ�����"(f�~�? H�F�`���TR)=�-[���coۏK���'���¶�,|�ּ1w0I�O��·���_B�h*��t��t0b�+.�+�l��Q중tt�QVݘ�X ���7R���(����n���r���Ұ4Y���'�z��B� S�����F�+�-��fb/�_������8-ՆxZ�4/��&H\!�� ��&�fm3o�=gt�~=�;�.��h�������AAE�a���\�EC �]����7�+_���X�y��NWR��a���ǽ-d�$P���0�I����R6�B���g�������P������yQ�H?A�G�l��>��0U��%�P�h�fF�i��>uʺ�i۟Å�3����T�`�)Ѡ���2�������J)����,�U����o"��Z�0L�8��Kϲ�S���诓|���7�齶�- �EإSH+?�=��^ ���J�~��ޖ�e�~�������������-�ye�V~��^�rK�d ߉��-ł��� ��w���� G]TpS���Ã6�B�<�Q�u���\�E�0�b w#�:B��[W�;I��xo��h[�7_��$���a v��%�;W��C{\r��v�oUO�ilZS��\U�a�W>d�ti�٬�-=A���=1���t�dH.�w��c? B�& ��Y6�(I�;s&@ֽ4�C�.m�q�������n������Gf���}��<��_b���=��F"f���=�Zpc���~3^*,O���G�p$ N��0�l"�z�1}�4�ǟ&1'���VShbᗴ؍�� ���ur��r'v4S�ѥ�d������&U��� �+����8~�lx��`�Wu��u�P6K3�_z��7pĒ���m���ǐ�l���E��=�c@$�i�o�����8��s��)1�ɚvI�&`�WrZ�G>�ߖ[f2���V��I]�wA�Pn!�s�oqP
Static task
static1
Behavioral task
behavioral1
Sample
325b636c441ba00adae199f307b02cfa3e13fb8f60cd75260e2af3b2876cf03d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
325b636c441ba00adae199f307b02cfa3e13fb8f60cd75260e2af3b2876cf03d.exe
Resource
win10v2004-20220414-en
General
-
Target
325b636c441ba00adae199f307b02cfa3e13fb8f60cd75260e2af3b2876cf03d
-
Size
7.5MB
-
MD5
63095df1fdd014bbcc8ee4563d215f2f
-
SHA1
0ba65b6581ac11faef4bab7bad6d392b52939bbf
-
SHA256
325b636c441ba00adae199f307b02cfa3e13fb8f60cd75260e2af3b2876cf03d
-
SHA512
3a018b7f1f29350487d7ad03b40f6c509b476838423fab5200a932a938da28bb32ded62ecfd9348c357c8e37d735c5d4c804626c7ba315951a3d7520ac27c5c7
-
SSDEEP
196608:mE2GARQcM6u1aG8ST8UOSIEh9kvrkDu4ChGXwF:m+aQclXGT8UkE8rk+G
Malware Config
Signatures
Files
-
325b636c441ba00adae199f307b02cfa3e13fb8f60cd75260e2af3b2876cf03d.exe windows x86
0c8702090f96587df3ef3cf88157ac42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.#Gw Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.awZ Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mw? Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ