d�_q���h:�h䦾��*�#����=1"l����|�`kC����7����ypc���&�����BZ�h� !��y�7��[dg�u���?���іf�(����Kָ��()mn��М|�P�R�6%z����A������뫥��#Re��@�3�N����Pn��U�ċ�����㗶+����$w�:�&�ɣ?]�(o���1d��8_���| �F^�����6(���36��!�����N��2�QӚ��Vl����@L3��\ڈ(NS�ʠL .٘�X��f�������2��fV�,R�����l���+;����.��D�DI?ފ � �;����b�l}Ox֯�� �xqJq ���*������w��s�e��;�����~�3��`V��DVh&a9�������6������5�RIG�?:�Z�����m;�C�9���e��Z����ː�٪u5�Ɠ܈�п��`��c9�U4�e��-*�^�&�M#�{W�� �ض>%c�]�"C���P�_��B�X��B��pe�&�V� ݢ'ͷ_�2 샧Sb�KP�´�0������W�P�����%[�v�4`�my���t�����d\m�i�:K �I =�ۈ\_��1��b�����s��B����\|ӿ�Qz�����V�q��r:5AR3&-���_~XL���t*�3CW�������B�Q%��m~X�M^�+іƜ ���h/[Ӎ���a�����e��?��|����0;�A(�� ��`X����I��#c[���FtT@b�l�|L��i� �x�((��4a������\�1�֖��OMZ�v��AeJ`�E0 ވ�עc�YLj(���t�Ͳܰ�#��<�K��E#�$��7:CIR��D�/;AǾjh�N�����l^C�`�_��C�S���Bc�@���ً��ųA"(�u�nڽ!}}��_p��*O^�N���V���p~�����lt@v ������ �$�d�?-����]\+n��y���ڡi��Fం�J���:�$K��wK>U���a����Yxٔv �L%8l�?��p�(c� ŪQ�K�c�f����A��f1��$�_$S%�ڧb ,3љ\l���4���^�'s]��^:94ԡ(}��iXf#��",�e�+2��|�)��sW���Ur����A;�C������Q��u���4���c�j�rp`57�������P0�RD k�C+�G=k��Vk adh�e awR��Lrs��<I�#|�7MR�f�6��!N_(�-r��t47�����UzY#*_��w�?���E(�"��37�(i�'��� s^#�.��A����u^H�3��)�`�4-f�y��� e0�C���a�Ź���Ѯ8a�"#�0��>>���[\�3���t6�&�?B�����B�c}S朷�7���*+!���+��ZUed�1�C?�fm@���{s,Zʑ��n�\P?�p��=�8A����>}?�u�#"�dMdd�_�q|������t��� �UA,2=�%9����y�\Z��Ab��6B����ۺ�Brs|d�J�6��{N�`��`���;����.����<U�:i�А2{Ue�B��m�*-�Z(|4',k�v�����<�?3�m~L�Ei� +zՈ��w�9e����DQ (C��������B�����UJ �R�8ؼ6���8bR�}/��T��Y��������J��1�7�.ʟ�!F,�p)�(Z�מ��n�B��U���mX:�8���%J�� 4��gЎa<�b9��{�Fh����ι1�4�VT�F�_���_s�7f(^�]'�Jоj����9�}�].����K��r`�xT��}P[q�-�尊�R\+PF���ġ(�ڶnR��rAE|KsVO����@L��?�T=�ɮ����*�y���#�-%�̄��k;��u�ͼ9_W�%a���x����5��"��� ���D�5��P��ml���B�Hɣ:���Jeꍻ���}��݃�u ���0��M�!��.����#���R������N�O�o&Q�{�h�Ahe���N�eV�2�Myj�M�����*�k�&�qN�zVT� ���Q�L�0'6��]|ܖˆ��~�G.����joe��쫢�+$fjJ4��6�q����&��YL��4�<w�� �7F�H1���-K�����U���d��F;���S���7�8��\����OP��U �M,� ��C���A�W���奣C�#���Q�s�L�Pz��9��"UJ]����"��+��H�R:�-b_Ü;�pN3����l�aM�%i 㾫���W���x�50�feod=�_ ���6�)c��4s�nu��\��;�c��ߒ,�%�E9Җ��4~������ʮ(\W�-�p58��(3Jy�P�Y��_��ԡa�n]����#U5W��:�X�a��lJ��-���kIJ�&v�xd�����v��d���U�q�ĩ��� |��������fƹ�٩1�L�x��Ȕ5�z���e��kG��U������*E��>߯��nGv� �T��;H�T�+ RvU=�%+�]aʇ b��L��Y��y��|$�^�XL��&L8ʘ��3`{��t�9���H2PLbl&#{�t���,0��J �6z-��7@K~A5����z5�>�l'��&��\����2t ��Q��3�9�Eaq��7���Z�����*ûa>�[#N���<�Qjrk�����N��/��,���T柆�1�����g#���;���+h�̑�)��p?��I��M��R��8*�GB�w���%��lh�8īg�͘��Ҝ���/��;�e�#TN� ������w%`�}�愈T�"�W��T]�j�Q�S�V��D��}(ZZ����"�@v�> ��t7��Κ�d ��p=䩛�ƶ3�����=��mj�a���&�Bx���O� ow�"�� 1!a\����d�*��V]�P#s�)1!0�b曵������a<�.�]���BxQDޢ����k�ѥJ����Agz����g+��_�~U\�,��r��m;��ۢ���6*Vߣ>��������5� >O���n��b��8�e���*��������c�Ӽ�rA�;�����_���j��㥅�Z�8�}u�fi,�T/��1��[V��x]x1)<@H&�a.�o�ʋ�'ue�$����Y�q����R��� n՜��2�U�Zc�(��?'��2X�'���J�P���o��U9���=W�]J�D���9�e�h[*�v�MK���}pVQ%�#C����h�'L�1d���.�20q�����Qɻ,�]�H�����K_�&�`�jJ:��n/L�ʛ��!�V���t�[��k���`�+�7$݇T>o��fV�>��w�ȫ�\7Ἴ�f�k"��Pk_�ZI�Ʌ�r5yv��U[6�E���-r?����O��CϒU ����MXT�Rr�E<�+T�q�т��^�?b��{%o�ۑ^��mzvӐk�����b�.U��4�/c����<O�7�������Ƙ
Static task
static1
Behavioral task
behavioral1
Sample
efd5176ff761d62ffc188f6474e4fc64d491d3ff136e6ebbcfa7ddc76771a525.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
efd5176ff761d62ffc188f6474e4fc64d491d3ff136e6ebbcfa7ddc76771a525.exe
Resource
win10-20220812-en
General
-
Target
efd5176ff761d62ffc188f6474e4fc64d491d3ff136e6ebbcfa7ddc76771a525
-
Size
2.6MB
-
MD5
56ab1ba86fd24bdbea886f872d780c94
-
SHA1
d00201657341c41761120dccf9101848a0a9e730
-
SHA256
efd5176ff761d62ffc188f6474e4fc64d491d3ff136e6ebbcfa7ddc76771a525
-
SHA512
ac669652898de35af6a9697340bdcf52d308294ad9084f371f3f4fd687a68da474733ea6d156464ac216d3b30a9288d86340252e6b539ec20d28265dee6eb8e2
-
SSDEEP
49152:YSjzEpMyKVZdnKMcKz154VB9R6+deDCF9zHmKGwbseSnFBEi+1+j79DaHSjCkyM:FjWsVjce54VB9R6pOF9j3bseSn01+V+X
Malware Config
Signatures
Files
-
efd5176ff761d62ffc188f6474e4fc64d491d3ff136e6ebbcfa7ddc76771a525.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pwkz Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE