���"��{d�k�^^�����r��F��P6�H���H�4&���d�~���,�C����\�1�&�m��"�/�,r����L\Y�����8�`��4��L�E0�#���A����\x�#Zɨ3��ck9E��?B�� ���,�o���a�D�2Z��O���>4#��Jp�[�vabۂ��G�ӊ 8᪸�&_̎<U��φ��;7nv>i�%�R��{7�=P�2�q �FDdi�xy-s`!�lʺ;\f#���+/Q6ܗ~�]�C�n��G�����}��e�I�L6#���IX��g�%�-s�7��7�(Gⅈ������j%p��шxg��������T��7���u�����<$�q����=��b\1���fzG�w�i�(�72�9����*����CǼ25hoH���j�K?ηs�x�{�Yۄ>A��# � ,�Ԕ�ׇ���}&�'�&^3�^o3�ϲ�d����*�M�µ-ld1��Տ?��KZ�K��~���Yr�V97�=Z� ��i;"��K �5!�o�?`� =�a�HF���M`2i�l���@B�`V{�PR���� ��[So~>����8��h>#�y�>]��}2����>1ZK^�R*$��*�`�Bv3kS���F5�,�}��p����|�"Aߡ�k16�8�5ŷ�rae~ >��ZC����9۲2���e��B�! ���4-��0�׀1�� ,��E#V�E���6j6XCߥ ���;1�Z��8g[i��W�8ܜ~��N�b����=��SU"�rW�л0��MZ_���[��Ɋ+XR,'��ɱ�~�5���<�������@ߊ��G����� {�n+�W=O\=���(a����O}��Sg�N�Kb8?RPk�Yl�gm;����Wqq�V���ay��[�c�}�w�����D?�:n..������?OW�� HIr=��Kh&�5����Vi�Pw�����'xw����/��� �U������jrP��Q�"��F��?���]����#yX[� �µCe�!W �Q<vv��/S���O��o�I��ν�ć�Nhː�\�ط�G�,ϲS��`ᄘ���9@���K���� K]1@�ش��BN��#전Y�g�Ll�aF����M��yZu4�R�<$ۙ��r��� �B����m�pK��Z�3�խ�F����"��Q���9�%�s��k���������+�2�=�Ɋͭ�_55�؇�Gz3�p�g�T�n 5�����M����fl&ғ�������,iS|R4[�/�{��1]�8���]�����h�S�����>S���D^�}=�t��8�m$_���"����X7���6ِȷW��9x-ĊAx��Nʘ��/⢃>?���Gڽ�B����Z:�m1� BD<1Zz#��#Wg͌������(3��K5&�Wynj"�tS����`���} ; ���S��h�E�e ?ʓru�Ǎ{�=��|VKw���|�4�(�:-ȿ�nڏLfkw}���~R�K�9�����R�MS�Lg̝� mD'I^J�0]�4� J��*�]�+��������澭/���f��� �"�_a�}r=/������Rv��͟+$�� �.H�s#����ء����h�+FK�T ���ڿag&&�]��-��|�l�$�u~l鴊\�/������Ojbn�}����^OAO��' �j�sO�X��(e�,-�g3�-��C�+sA���5X��=U��z�p�Ի������FX�8R�ZCȨ�Kx)(��믰-�}�S퇭6��VhBK*ڪ��DD���bc��0�i��-|�;��+rΫ���#�'_���6Ƥ�8-v#�Yj������t5�f�at��T����kN��"�`,m���a�{��[�)��cv{�<���gE]����|wH�\�ğ�b��f�@`�b��?��3���� ,��]D~�:�o`��~w�%K���8gQ]����n���i�_A���5��n��S��4�E��&��5V�����-t4n����GUH���R����;�51��-�)�>�nU���mlZ���Aob�e��B|��=C�2��Ir���^b䎢�#����x�ٙ�tČ�� >w�[,�<a���"I+�n���ֱ���<0unI���z���f��e!T���(<ՉJ_�_�^u��bo��W�0�����e(�s49� ��� �Le,�� @U�p�j~�4K�:~��!Hn2��.�0�S5��'�\��8������f��Y���V[L<�l�12: �q~QNj������Ҕ-QJ++ =�|c��qװK��&���n8Y-(�#�ӛ�UW��N%����hYU�`�Kj���DH�DE�'姕_5� �8^#���3��7ٹ�TD�c[�f%5��!�A \�� �[��X:���1͈���"�����jȃ�P��\��j�@� V�E6������q�ٕ�N�m+uj��f���$�պ<y���k@�(� �RqcC�ܷN��ե ���f���'��fE83bs��h� �k�n(]� �8�3�����!�[t�eJ_�g&��v �FXA �v�e�48�d��2<����H������v�:Rt���x�]��(�t�GF8\;����yG�"�� 4:��t��T� Zt@���;=�e:]Z�N5���2�`v����zǎ��0J4(�y��ֽ֗i��v��f����l��I$���X�b"𬆶ŷ��b 1n���X��� �� �7�I�U�c����\��#zK�=���n�N� �[K� �/ (.<���'/VK��� r|�������U�}+a:ֻ\!$ѯk��0)b��0[�_�}t?� �"���GF i�x �(�)V@ B�&ڨ���0C ��;�V�X� 梹G�RmpN��_�6�H�nNg���6���=I͙'h�������u�B:�0�A���ꙥc\��|r��=%���&Y ��4�msa*�����i�RL�ٸ#��h{�.Z٨�N ����cL�2���25�)�E�����hO';Ͱ2I��\�^��)�3wv�yIx?!қm�<(����N��������0����*�^��d1`_�8 ֏�r1]E�r��>?$������h�RU�Ր�:��'9J��}�)Q�e�a�"k�L���*h��0(��^��B��ZJ�i�!�BER�6ڬ�ׁ������}p~��ѡ�#���ڭ�����d��w֣`8F4Pdž�N�L�,�3��'; @�$1���!1����`.�HX.�E94 L����L��ʑ�k��_�鱟7�Oy�*�$}�Z�ծZ*lC<�~���/�!8�����j����C`r�����?)9 �֔
Static task
static1
Behavioral task
behavioral1
Sample
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
Resource
win10-20220812-en
General
-
Target
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a
-
Size
3.8MB
-
MD5
102d3fa40d97527969092a10edf227fa
-
SHA1
5c80cf703216391fd2eabfd726c433d721d16e2d
-
SHA256
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a
-
SHA512
fe3f974a7204bf0dc582cbc5fa274248fc3a493a7c538d59920f6ebc0777bda37d70d614ecdee05856aa00023e2904f7e130ee4ed4f3161035dc27a05f2f3201
-
SSDEEP
98304:gAaWLv99o6OGCyps4mFlHPqmHzUkUz3paWw:BLvOKWblV0wJ
Malware Config
Signatures
Files
-
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aexo Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE