��=쫏Z�3��L�<>>�F(���TMKL��d��*�����~�yLu����q�0�]��n?�m�����0����E���QF���������!��l��5ǀt��uA�T+ڽ����o �Ӟ��,d�������z/$��ϡZ����q����L��r�º���i���-�Tr�Y�*��H7��Jf�ӏ�7Y��(Q����V�V4��,��?o�/�`�O)Ԗ����Ҳ'�C͏�-`}�_�vz6K�� @�M��%����#�"�b�[��BP/�Z��>��i��� uW}|�<C�I��#�c^ .�#��}65=_Y�M��[�7F��V�kq�?�Z>]Bg������Z�q(��70Cɍ'*���ᬙ`��P4�8K�b�R�����5��mW�>S�|�) ���^�G�<��ݢ;fͨn�%�}-��4�2�(K�z�GT,Z�Ƒ%�?i�c��lm'���mQ��HgoD��;0t�{�(�1u(�k��{ iT�Ϭ�����d�ƛؤ���!�á'>�*!��0^��U��[�Ht���M�&�[�6Oީ}�>���,l� �y��|T;(��*cF����Vć�%;�Y����'X2`0�V&��o�*z��9u�l�Gd"���y���m�I�r}L�7�e�S�!��4��� wZ'e�tE�P ���[�v�zD+�|��Of�mH b7���ҫcN;A@)qX�#%\w��e��O]�� E�qk��,^�_xGBs�jF[M��߄�pmq�Jww�?CT3� ����)$��y�������rM�����Ec���[�__Q9R�����Chh�0W��CAN�!8<7?<���8MEL�P_�x T�����Uݏɚ*֒� ���ޝ;���̩8 �;-�k�P�OQ�:�gc�y�\�Di�ݐhW�Yӗ���AT��_�2^�t�íҿs�V��qR��HzoXT��o;�t��rO�ߧ�_a��3�7�@_F���1H��nO+a��$����Ԕ�,�>������ڹ��y�3�~�z0v����?��Ԟl�b��G8p%|؎S��J��= �G=�[�n�ӥP��{�20�B�����z���a�.��<%��RD�s@A���T7�@!�YL�!U��HZ��X���!u��&$�O#:2�W�:�h��H�`k�k)*��2]�h�S`an���f��@"��b�GW�{'M�T�Cu(ݬHyi>y �kR>�<8�+�"�靟�K*��˲\s"s=�G�8wh�y�ɧ���4[t�Z6���u�����#Qq�X�DU��k����`�į�J�gF�Q��n��2<F�HϜ4�`2șZa�Nz���`������`��������=���n�1�� � �T0��E~�>CCꅚ�4�&QSuWXk���4���A���\�˃�V���@�3�q����Pw��,1��@YE}�kF��vM�&���E��"y������H��yވ=ͪ��\������)����e�ŁLO+9�Y�~#��E����Ӧ�̣\����l�y�I9���s��\���تk��_//��o:9�9�0��6��M�Gh-�i]y�2V�"��/[^�M�^�Ux*��a�!� �����DH����&չv��]O���@�?�M�^�I��ʰ���}����Ǯ-���=M[��}�j��9��N��R�� r����|N����m���}�q����x�':��je�{Y�cX��B���@�ɤ����&�j��d�'�� �p��?b�RЈ�gdS HJ���*��M�q��mW�k�<R�O�(�&�8��y����5.�[B2V8j����8D�jp3�qX�a����:�7�C��}�;S�L1bkh(����ɡ�/��l=e@y���r-�F�,���7��^AѝJa����ѝ��zHR��u����L��6C�D�0�2�6~���rⴤp��q�R��͉�b����% � ѤS�D7k���%�ܭ&�)��.t���̴.O��f��J��V�<m�-�-�������'�P��B�N`QXCa`�8��g�����ZQg�`ѥ�~g�[RF�6Uv�>�mMa�gY��X�[t땟K���?���"T>���6�7o���`^����z.7��$�-M��5c��Y���#sR�%rFWA��R�xA ��LBgrK���TH�S�:��L���a��x�l������/���N��_.}\�d��$���QU�A�oO��2@f �����Ȳ�-E�Fw�n����Y�$����Ʀ��>��j�/�W��p���Tx����d�B���.I�(�~��uk2�r`t���y�e����`�T��!��&�d�0�ۆ���D���=T�U��z这L ? ]�0�7��z��Va��^��W��� ����@�,Sj�>ɡ�T�7ba�P��7�k�Y�3D6���� ����i����^ ��y�9��̲z����bʷ���C.��r��w���Z�9��~�0��VW1�!��i����K%|�g�o���x�ȳ`om�T��H(ڹ7t������J.iI�}W �A2jw����{=:Hp�'����b����'F�榠�,l��5�@��U1CU����m��~{S�4��̍z���� {Y(HJ9@Oy����f�Dߘ�u;�Y���5E��`�3�.o�$̑(=�z���#�M�c��"��KOV�v'Y�w���J�#d*ۭ�6䪌xG[s@^S�D�+ ���nKG;O�U������E���#��&�㇘A���^z��뵂%S���Z��==��]6[����y��"m���eGG��8 D���rA �>��;�t�&��U�².(�wGB[!ș|�y��6�W�|�����z��`n�m��CbKH/�\���g���b|4�����J��Wmj�Л0����U���ТS&)J"d=A߶I�����l��k�p�������`j� TQ�α�/k�+�� �i4�}���JC���)�^Iw���_�Z����w\j��!1�����C���ؕf:�S��|��ɪ�d�g���8���/a"�����H�<b���2����^�����lt��,S����X���.�oy��y�y�(&��5p�ה����o�� ���ᐢ���5�*� x�����\-�s@㤺2�KjP՝�[Q&Z�Q������5��ݖP_�<S���=A���ꡤ/տ���#������p�:]%���sտ�2�gYʵↁ�uΠRm' <�|�G�M�5JS�}D�U����
Static task
static1
Behavioral task
behavioral1
Sample
f79c90eda6c8ea21e60f6a8a707e758513e13e0081258606b0a4750a0af0e438.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f79c90eda6c8ea21e60f6a8a707e758513e13e0081258606b0a4750a0af0e438.exe
Resource
win10-20220901-en
General
-
Target
f79c90eda6c8ea21e60f6a8a707e758513e13e0081258606b0a4750a0af0e438
-
Size
3.8MB
-
MD5
ca940ba23a365839caa3091ce3d47219
-
SHA1
6becb2dc6f5230a66e2840d801d34034e0216c92
-
SHA256
f79c90eda6c8ea21e60f6a8a707e758513e13e0081258606b0a4750a0af0e438
-
SHA512
021abcfd4a524ec6c912f82a50d69582315f96773cdbbb2d2b723ffae6911eda31916d40fb1055cc3e3be57a109f6294fed76f735bf0bb3fdece38ed1acd50e9
-
SSDEEP
98304:sa/l7xGEPRfn8N/U7XXA5R/rNMH7N6DwHVSNlqk4WuJ:X/ldFPxn8K7nAXrN6VHklqk4/
Malware Config
Signatures
Files
-
f79c90eda6c8ea21e60f6a8a707e758513e13e0081258606b0a4750a0af0e438.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 114KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE