5� #���H�Px4�4�Zy��H����"��$����Ҁ�Y �o�{�o�����ub}� 'Hu\8�G���j�w��,8���r)]�A$o>b���9"�#X�(kWel�M�/5tވk���3���c��C�E�~�7,T��Xݑ2�&�@���������{kVP� `����x�PZ�p��Rz5&vA~H��=j;���@�ܦ͞��4Z�q5*�S6��-��5,~K.�֓�Y�4OLB�/e�w���[R8>���UB��a�;B�z6��)a�~kT����6-���k+�S[B���Z��=��U�_���5��~����� 7&�����n�7!j�AS_����J��2qK�vF���v����ר�3�gf��<T)H�����8�zG��n#�1�֚�FL:�=t�.�Y�����T���@��"��8�|]�Gx�I�-�|/@���"��6�j+��F$��@ ;��y�'ee���vR���Y�JPu�#��9x�j��y��Tm����Z>���*�� �`������hć��ڊ&�`�MCp\���4^.1�:=���Tp���^��T���mD� Э�[R��_hk)�����6�ˋP7e�X�!24v�4HƬk��p[��$�wJe1���M��m�ژ&�)�����>�]jlU�J��Ӆ݁!��d0��6�֬��7=���O�z9,o������� �4A�`��D(|�A�� ��9K�G s�|ߣU���& ����z ��-9!Jڴ2�P�P�i��6;�����B�oh)O��dt��Hd�y�7C$K�z�/1�L]�X��H��NTƙOі�`)�Ӧ�9y�'FP��+�P�K될�j�?�o (~M���>Y"��*���_(S�uG��8'h�2C���* (���δ�����sY���N�F�X��1�t���gj� �C@�#/E�Q���XX����-��s�k{w,U~`���Zql�#?�2�o��m�������W��d����"L�Ba��keĘz�"b���>���||��)�����oc�N�z�H�\禤"��~�}�Z�}?P�/�E-�c�qƟ~��;�+���Po܍�I����}�y��$Gl!"��Yzo2�mG���ŝP��c����o ���uX���{�t!�9:�����'�L�ۢT���t�k:`������l�?ʥf��[xZC�L����P��A�K�d���FW�?�Y��)�I�17#T����:!5�>���,��q�s�l����Z�����{�_`���$K���8��j-����u��G�Vqm�/_�adBc� j@����MF���ñ�»��BdFxb�oU2��&�GM� E��i'-� U*� ��6M�����}�x��[EkUò��Z�\�m�,�x{!��2@��j.�F�:���i��*��F�k�`�y��n8�tY��S����tߏ��--n�6'Q�dm��2��w��TXrP�58)�_��n�Y�c=��u�SF���p�ƹ˳P�x0�Y���p#�V���/u�I�R�pd߯��D ��'�f�l+�Ze�>�5��K���?篂��ۮ�����!{T���� r��s)�<���Ъ�t���8�0,�w���o?U�0I����Xx�Fi�{xs��kR��:�JYj�#�z�Y�r��y���Tu ×�+&�����(�Զ��ZT���O2�ܱoT*���Q�:�oZ��U��A�YCϐw�ʉWcp|��9,)���g�1�����!{�}$�h�o��=x6�>��xQ���d�(#`�b�#R:rBm�jZ�D���(&or8Nf{��f�jT����S�[�%)�]h���J��<�PGD��b�t �~�8�٫{��v���>��&aK�������)ge9�7`��B��E4��_�`Ed�ɩ���EF�F}��$^�����CV��,�,|��e� lI*+R��\������>q���T���1S��[�Krd���2A6H�� ���9�Q�\ޅ4o�:�`�~5����[Z`�(r��R+��i�?��]��{��d������Zm��Qdk��u �֏��kj�Ud�*�f\h���{6|s��s� OO�Y����,���]OQ+Z�(1�.���7��6KD3����`OS�3V8�]�f��!����G�[Aa�b��F����H�2i����σ�h�A&��ߛ��E� 9+B��?}��ҡ�o�O�Rv3bA�����n߃�iF�Pu����Q�=p����=U)Һ0�k�Mԇ�yL��PE�����5S�QL��_P6pM^)I6�û^��7�c�=���=���8�jHw��n��Qy���"c�eK�^n��m?�j�L�mB�0�=��h�]�%�Q}N>XZot�6 m@�h�>f��A���c,����N\���s�������Z}�aEG6M�䗃����JTiXbQ���#H��-�A���8���M����%ݖ Y �ز��a�"-1瞽c�ݏ)���.�G��b�m6;�E��I����p�!��b�!Էm��}S�[A�$��q�)Y)���[4æo#���J���6#A_�&%c�`��o�;v�[ls���k�?h�'ȩx<�<�%�/�ZWgt���z�M�tij�f����]���'��ݏ�AoF���d�3o�mG2�{-�?;'��d��K&X�#s| v��l��CVܥ[��e�l��z����hV���TЛ����o�_ �p�ay�B�K����ɍ_@EsJ���=�tL3�!�����&�J3{)��kV�`�4���L��T�!#J���� ���7�-%�O�(3�Ө�5�,".�!?����~����s{� 0 <)�[+�r2Q�"��(z�P��L��UU������a����Tr��3tTT�q��a^��������M��e3�ő� 4�$�~��)6Uo"@ƽ0���)yF��@�!�:�uun�ǃ/Q��r�~7��Ѥ�v�E}�YIi^��8��.!������)kw3,? �܊�Yzޟx�&NN��
Static task
static1
Behavioral task
behavioral1
Sample
4fe48642abf895b22488aed15072c094a94afae6c609fedd0f8b148045dea4b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4fe48642abf895b22488aed15072c094a94afae6c609fedd0f8b148045dea4b9.exe
Resource
win10-20220812-en
General
-
Target
4fe48642abf895b22488aed15072c094a94afae6c609fedd0f8b148045dea4b9
-
Size
6.0MB
-
MD5
4a762932667c59311568ed01dcfd2b99
-
SHA1
3ded7cfb34ae2c1328bea262863ba781bbe9b82f
-
SHA256
4fe48642abf895b22488aed15072c094a94afae6c609fedd0f8b148045dea4b9
-
SHA512
110fc5575e9051f4f3eeba49e436d32973853ce6712099448e021d7ce841ea9c5ec353a4eafe09fba70049f12e7f00a9588bef6bc0d1e300ecc2ab0af9570827
-
SSDEEP
98304:QnKA6DOm9lIzoO4Lt+CKJaaG4gjuCawzeJJ9rTPsuajVuc0HhGl:Qnh6KwI54R+vAuCaTJdjszjYcehI
Malware Config
Signatures
Files
-
4fe48642abf895b22488aed15072c094a94afae6c609fedd0f8b148045dea4b9.exe windows x86
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.s;W Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Xr6 Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n0$ Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ