�u��/�,t�al�XK`�$'ׇ���s�뎎ŀ���;�^^��� �E������)7%D�PF\脃�&1:�� �|և��]{,9�9�\[F���s�� N��Y�s>�~mV>c�!�x�P���JV�;��z)�a��墻M�& ��{f`9Ɉ�kU��Wqt���Y v�����eE����}L倖�����32�tx|���.'�<}ĥ��k�I@*�JH��c�&T�۬dT��M�����&�������H��DNܟ���4���O���yF_�t�_��|�^kTT2��r�:��q��*=�8����1,������Ӌ���y�����ܟ8%d�'�U����ۛ�/����s��L�D�ˊ�w�\�>��t_!�qSl���<b������ʾ��3���Gb�J'ĥ�FT��d�G߳�m)-��������"�v�JQ$�8 y�,�/)j���Xy.�ί�rzΉI0n���q���?���u���A//��F-O!���F��:���A��?L�����O�TPv'�����{e��eEb���^����Ҡy]+�s�U���icN?7��5��+��#j���RC�aN-���t�ѫ��hbVBi?���4�d3��i�鱶a��x��eC�Ђ��]��;����a�TA r�����oG7���֊nӴ�D����H,l�܇79�t�_�8 &42|Z'�"�Gd�a���wpۿZ�H|; ��ZIЈ����%sn�G�3Vi����R���U��b�ɉJ��){���<:��*�^lƵ���W)5��)م��� G`�e*�]��`�s�M��P��y-8�'����9�%�APֳ�8Xں����s����-)vmr�]M{N�$��af�t��=�8�AGˁ�b�/U��s���c���@����D���~�������av�$�Ho���bG����"�A�}��[wl�l���4�k�MvU]��!��m�%�~mm���F��f'Dm�Jd0BUT���mx�ӓM���>r��Kl�!�:?��oo������ϝ����>�v�l�G9۽���E��4$'��#��O+���[����~����ؗ&������\ 4}���Z�W6 �M3�#J�w@⼡��67�?�MkΌ; Un�f��+lJIm7S�1 f�@Z Z0��X�Z�ю�i^8����������(��K�hl+T=X�p����W� ;���42»�oM��0ī)k��4��*�+��W�>���K`�ի���Y��VA���m������ܽ��f����?���Y s��"���_�]`]��MW�Y�H��٪��"��u)J� βIev,x� ���]�b�s������N�#�Tќ��U�0��&E�Y����wb{��g�R���Nq*r�0��9��D$'�S��9�"hK�j��BՕ<㥯�Q��Mu��-��YU}Bl :��:Hl��������N�ɞ2q�t.0�n6H���9W���\܇ٽ<�)+C_��&�rjJ�NM���gB�+{��O��nc���eV� c 3�9�'B��:Vg71AS�7r�f+M J��I��r���lN���m:��pT�pA��S d� ��4�!��XV�+�~"����C�f�㓁�B�r��/ot��krd��5�h�Ϳ�ͤ�+�7W�������3�LvK�����q^Bz�8�A�?����,�^����!�) �Ү2��:Cq#8�(p�2�0����>��рk�-��}����5i3,Y �@ݨ+��h�t�<œu<�K�̅�4��J�֔�,��g��A� �슜?�/�4���t�x~̓@��ʷ��3�� C@�T���P���b��Ţ�I~�v����������,ˁ�S|dA�������#�qdc��6�|h\TQٷ���f��F������f �iԡ귮��X`�O�JqqdM���C)4zAk�iE2�>�0ԥ?��� #��-p��l�kC�tz�k���}�c�iv��ڜ[�O0��&����^-�Lt�÷���:�}:ό{G$�ܡ� !���Ƅ�7WPN0���j<D�<�e!��X�D�K�[)Q LΝ)5�G �fp�'xoO1]�x"hȔ4 �rܳ�z.��F���u�˜,�K���`�adզ9��ߵe�����iQy���[Ӵ��H#�������B;��+s��8K �0R��5�L����υX��)@�f|�:��i����/@�ty̕b�����>�l\�3�\�)��.4�;��:]z���%��i65ɪ������k�OO2��T��9.\$^��o&���R��[B�Q_X����DY4���OPw�z�{�A�~��MJbz���b�%djH勽���K��d�����I�B����^$�TT���K��[C�1fÛ���.7��ƍ���'Z���0�r� !�3=��#�Ŀ�&��_Wj�J�D:��2�'O@]��[B_s⚥�����֑Rq;Fa�J���t��h{��#�S;���9�;2 ���I�TdO��Ѓݿw�`-}�Uv���c��s���#� ���~D���B_�� ;�0r�.�2���Vm�Ѫ��rɨA�*� ��7]D~߷_��Ĵ*ӋB/��P���P������U$�����+��*iI�ż�ػ�N'a���s�рc<<��-Y�n5�/FC�z���a�x��V�o��V/f*'[��۽1u���f��/�Q� kl��3%m|�j���b< p��[p5xX� �ߏ�I��!f!���I�>_x� ��_ې��ax�yJ��kf�e����M[����N���4��- +H��i��b��P� 4E�x$q��RM��$�c*�}�n������l!�#|>h*������eګ��}����m}��VKP�k�W�)��w8b ���I�������cj��?�'ˡ9�#�BSOz�� p� R p����o�Fqq����̘u�3��<��'��Bl������~ ?r��Z����`�@Ǧp{��X�j��ϲ�0Iѧi�oI^����t��p�:z}�q��M��K=��l��ҽ�?��!��d��� ���2-��PpilӘh�U?i_;�^r�����G�<���bS7��j��lTL��MR��T�3�V�x�Ứ}e/v́�2]��} �Kb�oU]�?7 ƛ�'|�{5>�`�ǧkVbI�����kÅ�?<��/�T�2/�л@�)B����T9 ���h�Ó1��]itx�//��j$�S>�T̂����2�0�������lU�[*f��B���ž�ߣ�E1S^�sA-C�>Z�i����v��G�l�5�N-�aJ���ɀ�>H���3��r�ݳ� ���$?��B�������Ben�O/1S��>h�_������̓q�<���rN�$�:��w�<�Z7���ܬ�ϳ��<�D�eVۋ��8�[w�!�i��/�a��7E>?�cph'����m;�:a=��c!d6��� CTp?^�U���d�e_��Օ.�c:h�q�R�~��yť����,C>��R�ά��a#ٔq.��0)����pb���BZa�2�6���"��ؐ\J�c���2����c�$����ZB�
Static task
static1
Behavioral task
behavioral1
Sample
e228aeaa8bc4541b749f1e2a6f0ce6692f0822b93243e00778dd940c903be729.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e228aeaa8bc4541b749f1e2a6f0ce6692f0822b93243e00778dd940c903be729.exe
Resource
win10-20220901-en
General
-
Target
e228aeaa8bc4541b749f1e2a6f0ce6692f0822b93243e00778dd940c903be729
-
Size
5.9MB
-
MD5
77bf70f8c1da395f912d51fff3e6b18a
-
SHA1
b43ba34649de3f6a1371d50cfe54f81e1fbf23f4
-
SHA256
e228aeaa8bc4541b749f1e2a6f0ce6692f0822b93243e00778dd940c903be729
-
SHA512
07b53ffe3ead2b151c17c97c1af025bf81313cd26e92f73508680ca7c273c1494de0f36ca7038ae9c39c74395cf1c36daa5fa2ba051058b17f08cac85bb7550d
-
SSDEEP
98304:MyPKcjUaampDA4HZpEkEno6DxWd9NadL+++zMap5Eiyao6UTzm9gFJFjH:zicdampfHZ6fo6DxLu/p5EiC6U2qfF
Malware Config
Signatures
Files
-
e228aeaa8bc4541b749f1e2a6f0ce6692f0822b93243e00778dd940c903be729.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 384KB - Virtual size: 504KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 20.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.civa Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE