�V��!0j_յ�����n/�X��Vy¸� �e}�A�;�V�J�����`~��^[l Ɠ���.�c�m(��V#Mc�s�#| ��;��*#A�E���4~a�-�4>�t�?��M���b��(S�W���.�pٵ� 9g��LH�f����)�\�~�A� %��� �i���_+d��@c� �q�t�w��)e����]t5�|���HT}YB��mpe�Z��o,�?t`�<�Ո��ձ�0����q��A�� �֯�K�_�*��1��l@S�ש����..t�Y�O҈N�@x�Pq�`�eKm�/���0�v�b^�19�Y���<[q��B��ܚ���N�Y�t�n�|A���(+h �%N:UL7�Ѓ�+��kw�*�6*�*���igpZ}s��0����x9�?#~����bNp1� �V�k�jL9@f�,'ȯ̙�����l�e�E�� W�I�f#!R�y���Z��d�7�`�i�:��(QR��~�njKr�G`J����u�,�2�0۫)�6����<3�Z���؆�zL�\ 1q��e}����c��!�m��q��_3�0�o�/s�p!˸~ɉ�� 4L_j*pa��Z�����awc_C��gSq�9lƋg*�mZ�~�[���D&�6 �?T���E<��i��.���:F�:������o飖<�~��Dg�v��xI .�.��ڧ���ԌTR(�O���Hg�O���暺[#�?�<�m&0��n����c�n�?�<�J#Ӗj������A������I�_]ݡ'��������4W��P>���:��R�����'��K0�&=7ٜ�$5�l���ʟ�E�9&R�_�����רA����������g0�1h*Y+�B���䴗�ƿM���E�D�ʎ���?��P���o 8|�������=S\�~{�V���3���3|2"V����R������f��D<��).�N�k`��@\�>j;��꧰$��YS2O��ёFۇX�H��{0����q���|��o�D�-�A�+�~hS�[k��GWєrbG�� ��|Ig��Dx��)�:7R4v.�e��/5� �g�Y@��b�����z���Նp�/��X� 5=8>�/����A{�����(�Y�GY��m���NcS��6b�g�P�\=���0��[��8�N�f��89�X ��kmN"���>�m�D��?�n2;#O9��P�G�0�� �/��x����Bc����GF����}�+�8�� =�"J���R$����=eь����lF�b�����xsq�x��o�u[S�U����>��+�9r��0,s��N�u)���@^��x�F�t�u-Ru81|Op�Y}v;�x#_�*��wXs�W"5(vGO�����[#�������k��r !rn2���!�ǝKgL�U���}.�v�����~�}��%�� ~�:7�o�z���q!A�"%� �K1��(�A����������L�"��*A�?�Y��̬���_�%�_�Cm0�uQ���a�cv�1� ��#f�+@t��rՄ \+��\!�}�+�\I<���%̫�Y��=gF�C:Yg�8c��*������t+���W�/ T}Z���R�����2������D��9;bymX+`�6찔�.ׄ�S�$r�&�*h�-���WO4jb�\#�Hڰ�4�L;��a���u=/B:���3�����j��}D9"��`\������z��9Swy+���`�8��ȕ���H��D:uLGL��J��d(Pj��f�d2��,vo%��7��~N�v{^����&�\�����s�%I��]�N}�N-�0��T���EnMN��c=�#S��sj��i�MEL^��v�cg|����e�*��-�4>Y�%�d{�N���Nw�����.(�ӑQ�531����r��S�i��}r��Y�p3�9�1���HcH���P�bQ���C�T����� "i]8��1`E��ܖ�C�u��4P*�i�=}���'�� �&E?���S��Nԝ?DÂJzj���(7���Cbx��0Q�?�L�|��N�];��l>e~!T��!���aAe=��.��ų��m�D��*�4!�qԓ�� [E�p8�ĆU��C � ��Ke�3��N�������7�[�)5�h��o����b��\A�PG,�ހ��~\���h&O��]}%�]��f,X6�z��c�l���A��H[Wɐ������`� �N1���j�l��5�zv�=�3)R"R�M�x����<�NA��7s@>.��6���}����1�����.9�⨃ֹ0�j��6�SxS�Bmq�HHf���n��算`��+<)?��Ꮶ0i3E�<�@�1?�lP���L'�cT�.n�n��"�� �l�jTO0T�>U$(~ =j�1r�1>�$AD���X�1=�x!� #�NsI����L�*�z���+}� �,�XS�c�X2����M *���;��K�IK�0�ހ2B-��v�������t�S��kE��b\'w�I�j���o7� Ɣr���G���y�5�?T�5Y���[@���Ċ>+S���Ё6�T�Qz;C�0�C8���l�v�@��(Н�;6~�!��8Z:? �DW:� �ۥ��n�TJ2iEw�"u�Q�n�Wٸ[B��F�ߡ�`zF����WG�|���5 k�b~��N�SGc�!ķ�2�WO]�~ ��;U�[PK�0u��3��U�7��c ��&5#e[� �P�}��,+�]� }�6�0�,l���͌d�gt�(��ј���(��{/b��G�,.B�$�#�B�E��6[�ʼ5ͨΔ���#P�5"bX �nF"hc3���豻���|^�����!���rSg��XB(A4�f{O6���T���yVin)˙�Q1�2��/��N$��6S�~��4�d�E̓l'#��8�Ýy{�(�����N�u���:�w�P��1a1���n��;@J��*�}���v0>�?qP����4�^����f&������A 3y��b�$�ɫ��ֺ��١[èI�y��\m��H�������m����,��[��X�
Static task
static1
Behavioral task
behavioral1
Sample
91474067ced57c86d9d3b2eec55d56c612f827870cfaa11f42a9c07b301f68d4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
91474067ced57c86d9d3b2eec55d56c612f827870cfaa11f42a9c07b301f68d4.exe
Resource
win10-20220812-en
General
-
Target
91474067ced57c86d9d3b2eec55d56c612f827870cfaa11f42a9c07b301f68d4
-
Size
6.1MB
-
MD5
96ebc53c3a272f85a43cdeafe5cb6005
-
SHA1
6572ce1c8160871d989b2aaa821116fa9dca4b4e
-
SHA256
91474067ced57c86d9d3b2eec55d56c612f827870cfaa11f42a9c07b301f68d4
-
SHA512
fe13e90459f9120e713903634ff831bd34688c7360659567f60020277a11895bb818656d1162393afaea8ce79f799acaaedb1de017ed4231e1d36bd0ae6d3300
-
SSDEEP
196608:+c4/X1ZEpBVBJ87cU7oiKJUx9JMDrxIwARlbO:GPsJg7mUxkLARN
Malware Config
Signatures
Files
-
91474067ced57c86d9d3b2eec55d56c612f827870cfaa11f42a9c07b301f68d4.exe windows x86
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
./8H Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AKG Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?6e Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ