ņ?E���1�bM`�F?��wT�Y�&���8����ʿc<E�� m��6�3萱Ӽ�a���p��ƥ� G�6z���I9� �o�?���,�l�"k��)����h��̖SVG�S��1A~�2g���l�DN� A��g���"�ؒ���A�\�w�@�2�F�&�p~l>�2�����1�tn�0�L����n�T>�k��\�.x)��P ��nJ�6��F��ʷ:d~�7r�r�|��8���Tzn�U���%�8�<nX�ݝ���k&�ݑn*�U���O�kB��o��C%7���\��;[5�UeE���Lp�Hw�D)�*S�8�F��,���ʑ�ġZ���<���*-# B����-]ޛ��שx�Pv��(�C�(o��*�ءmI�s��k�l���M��e���1D�c�,9a�E'eH����0�f٘�*F6����)�|\- K���������6��0ta��-��%#���=������\�d]t�����w��$�s�d�0D��Y�W�0!|��� �0��k�/��{'��-��\ mk�����帥�|-�A���Po93)#ċl��z�FL��Bċ���}�C��O�K�߃W.���ӭ��T_�H��6{A6,�&bSe�Iy�m �#c���2T�����@���N��HP�l����G���&�Aĉ�D���R�/:�q糃��7Kd��� �.٪o �z[���F�4�����fP�R�D���)���~+鿑>��� �ݍ�r�1H����5�h�5w��K���V_G�e��i�6�Bj|rչ���B|�\)��|m��+����&�C*s��㌱*`���tKI-|��nB���T~v� `����¾J3nZ����b�'�2�C�%R8��%�ϤXVЇ6� ғ�l�D�SQ�Z�PmHDw�=�S���^*]�ΤF�e���yVv��!�k���uqY�B�82"ǟ'�l��~����T|�M ��E�~�����W{R��s�z-v@O�$���.���F�O��z��H��#E��Ʋ�(8�}�H*R�&%)�{$M{pow_ =@�w���sau����g��S��cĭ�8��@=���Y������x�6�ؘi��cD��hg�}J�I�ƅb�//�����'�<����N��,��b�5�\1����ET�f��%8(� �Q���N��֎4����O�Q�|+�c�L���L��I"�?!��^� ���f�����s��&�F2��sГ�K�a�'MT>�X��Ĩ � ��4�rJ���?�k��{����#&���,���/8&��U>"nt��u��o��1%��q�IN�:�%�Gۤ���bܰ`�'����d��+�W��!f!R�A�)��ƛ>5�|Wi�C�+�FˉM��@_� �c�����Ł��ٷr��j�ʈylK���A���*�������a��>0/�xv���q�����e� �@�؟�E_Aܒ��E:�ޕyi���b��<�';�g�!���ؒ����� ZĽu���˥�֢~G� z���=$ۂ����;8�;82�t���D�uUzWM#�u]�Xڍ1 t�-\jo:��i�8o�<U�� ��ޑ��c�Ɍ�H��D���T�Z�iw��$��]���pm*c���<S,�T6WVO}wA�CQ����Ӯ�,�,��*�6�G��8 �)�w�&gq�����<^����OBLp���A���zT���bJ*i�Iyi�)H�$̰O2AY�n+��Gp���9ߺE�䭋�a������.��w�4�8�6Ct����ȱsFGu���Ok:l����(�~Tj�^Յ�0�h�!�ۧڢte���B�̹e���/(� ��inAC5s�AH��A8P����o1h��4}�=�M��D��tL�ћ�k�>��kN<7(zG�~XK"I��9;y=Ю{� $X������hO���-��Q1���� C�����$����:�W�.�`���z�>y�>��S2Վ��0{{I^�����:�=O���m,�P)�n Vt'o��>�`��ޖ�*�a^ߦ��� �rL�H����=S�d�K+����@�`Tɕ礇_���6Q�b^~�pmB�w+�1���� Ieh4�Է�8�I�����ĿP�$�����V����O�f�G{4u�Eq���r��_���t�l��{mʅPi�Ue���:;�Ԫ0P�����o1a��;#q�5Xw�vc�QZ��_*�l<��&��2B��3 J�_��G�8�=7(PU�FR2%�����h6O�QǶ�8��j�_�}z3�Ӿ1B�Z�Ҡ�j���]B�������Q����Ylj+$��1��KD���2G@��K�)�`��/o�G���q����E�"y^���i��G�ۇ��6��(�͓�����n�������X5b�u�K9668�N�rDZ����D�iy��'���!m�cH~�m�!v�PS��m��d24���^�N�E��>��uj3���ګ����AV�F��`)�B=ɽ�h�D(C�O�շM��2���x3B�{��P�IOk軹�D.�����{S=�h��VאR�b��f�'�vr�%�C��r_�a<��>��qyߍ�&����{S7tJ~����Ĵ���E�H�K�7ʕ� |���Ը�:�D��f�_�6�8J�̅!v�C�A�Wu���^Dw(��i��yܫXOV�ⵙ{�F �>�ɿ���$��)e�Ȟ�|���6Ms�t2_��� ������Sg�m��ɂd� H���T�FW`2W�0�B�K$]��B�s��G�kS��ʴ�_��|�}�}�`���j�L�����LD���œٸ���c}܋`V�jEj��`�V]�I�` ' ��{!"QSg��#Ӝ��Ⱥ�֚x��IB���ь�k�"�Y,��w B^�j�N����0)�K��<��� ��8qcƖ�9ģ^Qg9�A �["I6�p�: ��_��3D��jvb�����c�XiТ�����?��X�|�;#"��9���D+���T$�lͲ��T"��H�H�5?����ѹ]9w{ W5a����'��H���<�~�0
Static task
static1
Behavioral task
behavioral1
Sample
4e64323d39cdbf0ec3af7c241b32f3780e2f9ac994f7082289024e70f150d08f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4e64323d39cdbf0ec3af7c241b32f3780e2f9ac994f7082289024e70f150d08f.exe
Resource
win10-20220812-en
General
-
Target
4e64323d39cdbf0ec3af7c241b32f3780e2f9ac994f7082289024e70f150d08f
-
Size
6.1MB
-
MD5
204df28397f4ce049b324f5e1f8d0b08
-
SHA1
2032e4f4f2cdc8cb693358b843e924713a5572a6
-
SHA256
4e64323d39cdbf0ec3af7c241b32f3780e2f9ac994f7082289024e70f150d08f
-
SHA512
91321602b576be11a80c5ee1cb90f8deabd7ff05ef284a9ed1354d0e43c1f958ebb6f18f829dafcee00060537e70e55638ae3f6e0d40a58fc71cd1dec8b0edfc
-
SSDEEP
98304:3GKGPWoJk1bL5u281pOr7YqZlYgLho7cVosGO2StYkyvD:3LaJqst1pOrFNho7cVosGO12Z7
Malware Config
Signatures
Files
-
4e64323d39cdbf0ec3af7c241b32f3780e2f9ac994f7082289024e70f150d08f.exe windows x86
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v 3 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mH" Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>yB Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ