/n�z1T�;�W]�Is�[%h�S�Fy{=f�4w�r�~r#��P�$=A���+��:�Œ]Q/)�����9�m��X;��y�F�O��N�{]����b0�J2A��^�}����L��rVv�����^/S_]�.�kD��^�W�mb�J+1�2��g*58-�"@�;*��pm���=Ƒ�H��sĀ>m L��hjp�Zz�P�ҋA�1�={u��,�����9�8�H@��)H�P�eZ�݈�.>���{���:��)�y\��ε��X�F�,>�E������P��I���^���!E�˩8��|���bv�hN�+n� �1���n�3Kp���� e��cm��94s�$�՝�$���j��4�D p.Y���̓��Kd���i�����+ƃ�< 2�� �Q��ł����y')ST_�)�������k���V�L&w�J�D�� ���J���h����7�o�.����=Q�&t�pU���]�!��.�M���s���؇x�+��^sy���dS�k�Sg_O�5Ky����n#9@r�x��d���^�Y"B��Pm�O�v9��o����4f�*C�-z drYZ��h�c�����ؗDX3�;���T�>[����}��l�60�\�W6��.���!��8���@�� ���G{}p���h�e�J��P'eT �/�^ vD\�2�.��HXE� [����Ӄ�i� #���3\��k/T��N<�Hc��o`�n A�iF0���9�_��������?}'���ԁE;�X��K�-Z;��!��zk��S����� "r[Ӄ�[c%M,��1�K:e�mJS���� 1�c��-ٱ��O���s�=�-�%�>ik-9?��;E�y����~8��>�/�{�|��W���T���_:N�g)���\�@#�v���� X0�>c��`^��_ߒ˟A<۞��zM��/��d!�^�zi��kW�EUt> �Λ���u ۹��'�+Z� �>B������E��A��x�C�3�� �dJ�L��O�5���Ti�K�W �"Ȟ��(�'"D��~����2�*����`�qT����\u�H>���N/��ip�J\c�窼��7�j�)���4�ٰ�� �I�qJE��-q�����i����|��&�0s}��|��C_��q���nI��d����}:]4b���p��/����'ߞ�\����2Pv���� �rKK�������Y~';j+�pÞ.���{m?S���kH{�R��0U�U{�ǤL����,�hZ<�@rVx���s\��Ӂ�� [u��o�^�ss���V�nO�.�ew(�d`�]d�\ ÌE13��lV2$v~Y���Jݭ3N��ژ}�G��`Q_ua1��7 q��(%��W��l7���y8�m�p�Λ��_n@t (�(��5��m:�YOn��}�R[ix�X����������F�����QB�|���o%�&���{�o��^Y^��2WLx͙�C���RTZJ|$'��>K��26L����D�rO��<�3WJ�^����~Z���u��r��dܾӨ�`�\I�H�Lg3%Mz��_\]�@�DAu~��S<��NV�E��m<���rr~ή�������D�3���>�����3� 1�q�%<�� D7��8�d��N�hh��k��ea���� ���|���z?�Y��U֩w%^��Ko!�A�y�������$�� ھ{���g�m��-�;`���?ߤ�Kl����(#��H�DU"���v}�{�-��x��%@�GI����p���&&K��Z�qZ���p��7�"�����F����${���5!�������t��:}�.R����j��n�]� ؈�;��Pv��]~�z�K��ˍ�;~�Q�0��|��'p����������)ū����X��N�BK�TTb��6��3!��F ��zWE��2G T}�J���g���S�Oݳty�2P�� �5J�Q���Ao�����X���pv��ƃ���꜃D���}܅p�[_�p����QX��.��Ԣ$sU�7n; ��C�%5G�gg8��k�Y��'��m���?;|�L�������,Ұ?�GF"/`����d��++z���Ꮶ:�;̧6��}B���*�Ш�:��c4���x�76^����!+����>��/���q��߫�̄<�S���^�Y#��"+P@�{z��I莮>4���^!����[�3���ɘ?��*�I")BCH�j�0� u���@��|q��҃G4�wT��Mp�W��:@}3*n�R��~=�B�������� ��˳���w�ϱ�֫�l����S��C(�]y_� �7�L�(��6�u�Ů@��!<�����n����&�M`,�&��6�������6L���Obɨw�k�Y1�{�CP���H�D��.d�;�.����E��l��*z���@%NVj6ȓ\�r��)�<S~�������)�|�L|��V��_�oU��r7B�R��S�1*���d=MUu�f`�D�w�����w��s�}���p���|�d��{H��/:h��M�um���B�R�Ŵ� 3^��?�b�Q����rz�o�����J�ම �To�~F�c�o��V��)�\�3�M='��w���$$�1�W�@�WH���d�3KJ�?z�c=Abҳ���E�D3Ђ�-���� <� (� �����X\�U<ӉQ�� �����5���8�=9���f��rB[#Xٚ�5ҕWvW�p"�(q�&���v�a�)�Q6bǭ�~֦f��A�%'�턕�[�xٹ���3����ny6�PI�^�3_� Xr��/ȷ��ӑPZN���]I���Q�gn�pV ��$��o;L������� u*�4�O[��4���S�nt���]�{���)Ǣ��a��=%�I�ҡȌl.�%v�b�ii}{����7ћ]?d��b+kZ7�"�D_l��6mC����v�����x��!BJ)�Zdo�'�R�v����{,cX��;�����Yx�0̔�d��ف��r*�
Static task
static1
Behavioral task
behavioral1
Sample
98ba7942b008954282475a4f1d2d7d55b88851dcd3a62f59761c0275c23b25c2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
98ba7942b008954282475a4f1d2d7d55b88851dcd3a62f59761c0275c23b25c2.exe
Resource
win10v2004-20220901-en
General
-
Target
98ba7942b008954282475a4f1d2d7d55b88851dcd3a62f59761c0275c23b25c2
-
Size
259KB
-
MD5
8eb97b78cadd1ef96f31428f5a356a7a
-
SHA1
5aa6e9966322998843a3e675273c54d9c001cb75
-
SHA256
98ba7942b008954282475a4f1d2d7d55b88851dcd3a62f59761c0275c23b25c2
-
SHA512
face228ed19f11d7a0eff721b4118668da54d8b3bfe39ce55b49864cdbd6365954349b2471fdf477c6dbd92cb606a19ff1b779cb91e186dc14be4844d417479e
-
SSDEEP
6144:160Erpa3KDcoqrAQVSMjrkLT10oO1JxrsyY5kDg:16DrpWAcoqrASkl0osjr9YCc
Malware Config
Signatures
Files
-
98ba7942b008954282475a4f1d2d7d55b88851dcd3a62f59761c0275c23b25c2.exe windows x86
0a36f3ad4f6732338cb6760d50dc7611
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yiran0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yiran1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.yiran2 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ