�������<�ͽ��1i��$3��!q�LyJ��N���!���F @`8��,2�̵�;CS��{����5���n�(���n���Z}6�[������C����/�Q��=z�W��N�־��sr��b�&Fpb�����SL!�1x(�/��4U�0usa^��Ye {oT'�}����ohVn1�$Ҳ�1��hӍ��G��#J6�� �B>!$�,���.�"37g�����]~��q�����@��� �la.�u��B��w*��8B��e�L���x���8��m�J��-5�����7!Uu�* �?�^�� �#HN�ؐK'G^O;�&2!���O\���j�f@�n �-�"���dDw佥:V����c�ӓ.�cI�j��;8wV��1���2�Pxu�v�8?�"�������<��DP��&]�0��� p�6�!��+q������'݊%H�/��5����`7���_5j� $H���@Ҍuύ�O�{=�����@���]�� �x��%����} ���iʴ�����P��C���B�`�pU�g������@$���D�>��'���~2�k&�^����E,��Hƈ��3��>'��)�����'�K��c ��]@!���t��)�7u{��^�Eȳh��T̂�]��,5+B ���@�ך�62X��������)ҊSmP-Þ7[� �2 �!I��G���L0���/�V?�Ɩ=����R�l��Z<Yo:�"�T�u��M������-�N���Po�`Fޖ��OH�d�i�.ޡ/�� �-!����\�Ȕ��`)�����YI�=� =;�U���K��7����u�#dA;GM���>��gq�}q!���K�J^@��w^�3�*uW���Ks6�tY�Yp�~��� ��.Y낥����IQ�n{��p ��{�my���6yJR����Z�>�R:��E6IU>�q(y�7d�MZl5���g��N�@����J��56@6$�ι�2��^P .�'hNˎ$��ζ(Dھwc��8�ʩӐa%yI�hl� ����7��(����u�% M$Cݚ�p*�*ZѤ�kC}�md����|Z� H�H�a�jct��.s3b�o���"mwE� �_�ظ�oDyʂ���˓c����?qx4׀�Vވ����%/rQ %0�bI\�~����:�C���������ҷ��|�ù�:���-)c�`Ċz�(^坞�ڛa����B��� `)�4F[��i;�}q�K\��ٍE��=�:7;������W����,��LM�Nu���K�������G�|�"_�ǓH�]+���H���մ�9�W����u)Jrs���/�Gg�w���b�ε��ݱd��<�P�����g�,T�i�'����K6�G/��δ8���a��D��������5�+6���LC���P��v�P��=g��.��V��kȯ�m�?j7ܾE|[��q��>��+w�T�G~xӵ%�\����۞W��30��*���A��/M'����$����y��'�oΥRU�td�C-����l�[ox�M���F�N���^C^���T��n�Ηc�9 �&{�:. ����-�Ҝ���V3�[�����=�����%�R��K��J�p��O<�گs��<���:$�}K0��M��1ү���W� ��Ї\�)�%������W�p8be�\��yf8"o�O���<�-��H��P̯|Kݶ�8��z6�öĝBm��_m+���prUh|i�2�Y�U~��_A~��n���s8/8o�܆Jy� G��U�*^\�m�����~��O-'��mfSW!���q�2���߱O��YC�pw��p�pn�M��^�L�= ��*��'4�TK^�'џ�ͶL�g L�Ĝ������zX���СnP���w���������f��^����%ϸ2���6��kJ\�%�tA��~uA��F`Y���������H�~�����}�]Ҧ��υB�s��Il5v59˒f���W�#�=���|+��Jhc0D���+`^���V� ��opQaT=諆X�C�}�������-�k�Z8(v���xm�of)"f 4��m�B���3'֥� p�+0��-��F�c�\.aw�de�3p�U�4,�df3��Ȝ3<F�bKm���=@m��WG�J����,�oV��4�Tc��A�R�ڌ*I/��[�����|ފ�VqlZ�5�B(�%E��z8Da��'���*��%� 3K��� � 7�� ��<�&*�d�����R��9���h��%�" �g�C��,�A@��P���b���0=Vx6HS��]��Ɂb�! (�ƞQ;��t�:$���( F�3��g��� F=>1�o7�?�Q|�]�5hcSS�Q���'Ƣ��1@�����|ek�1���c(�y���E"�oFD���I����6�#�6��J��fs��|q5�z�@eOTj��n��M&%��}�T�/���cv=����.3X]*$��|�͋�Dכ��-t�P�w^ִRj.3F�o��JC�kBx��J�8RkM�NJ����������]�a����4��W�)� ~���w�绺�J_�Ҵ��)ә��ۻ��X��u\�)P ǽS��� &pv_=���T�V�;%�I���?x|�e��׀q#T��n�jȜ&W�Q �����ci8��Lǯ1y&�Y���#�~�b� �U�����{q��QXǐ�jBP�O���Y�ٻ�b��ŗs���|�m���q7x�c�!�����#������ֶʢ����-J��w�p��K������DI2��;���2�J$c�wQ�a�����1�����o���Æl�N��dA��V{�Ѽx�:������9�!��hzd^������gZq$�ՙzXgiSd�q υ��K��V�R��~�]?oY���z97��.�����~���z/�3��� }�ܮ�g3&��T ��?���y?�)�q���\``�|qQ��`�#�ϥ`�:on��5Gh�d�gꓒ3���!B�n�ĄC<����=+���*L���В�TBG��b�m�*Q -&�{Y����{��8�v�VE#G�S�?�;�pd��a�l�-70:��y�J<�a���d�W�/����;
Static task
static1
Behavioral task
behavioral1
Sample
c959f9998ba7348e0cfa31e5907323d436967629d9b85ce2e34deb24421250a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c959f9998ba7348e0cfa31e5907323d436967629d9b85ce2e34deb24421250a4.exe
Resource
win10-20220812-en
General
-
Target
c959f9998ba7348e0cfa31e5907323d436967629d9b85ce2e34deb24421250a4
-
Size
6.1MB
-
MD5
deb2aeb841922588bbb92baf85e79183
-
SHA1
25aeed5eef1c6e71a02f901cff928f58a1e8c2c6
-
SHA256
c959f9998ba7348e0cfa31e5907323d436967629d9b85ce2e34deb24421250a4
-
SHA512
c19e20053ed6e2f67d0610481e29daae5535830d64e3c2f8c6e140b8322d8fae2723bab8abbe10bc2fbc94c8085036b15d1a8b55c3bb3ea0b96bcbabc338165b
-
SSDEEP
196608:WCcv6PdAxnDSH4aEbORsIIH+2cfDzgi22YBi:WCcedwc4ahyIIHyfHHEB
Malware Config
Signatures
Files
-
c959f9998ba7348e0cfa31e5907323d436967629d9b85ce2e34deb24421250a4.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 329KB - Virtual size: 864KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 472KB - Virtual size: 480KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 14.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.civa Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE