F7�Y<vvq�����>v��Ƈ<��w�B`5�����|�v�/w�Ҏ�S�2*9� k�Q%��[�#��Dy]�N�0�a��;$�&��#}��^���xi>n17E�#�J�[l<�3 0U'"��7ۖr\�G���&G�BKC`��r�ǔ:X�Y(�g7~��<�e�@+�.�0A>{����9���f˃��]�����D��A��A�IAg p��t ��J}D���v]l�zek��γ�V�].���.���2��C�����td�Tڸ����v^+*BS:}���?`^�W-�e�_�>6w��u(� ��J1��c$���R5=O���������z]�s��p�Ӥ`W��8h�l�N��r�/쟾\+�4�NA82�kwF��J�� �s�$��~�8�B=�2�(-�O��b1b�x�s"68�!W2P9��èV8�)�L���=Y ?���A/�����@�1?j���=o��N���t�Rg��6"D+a�5�����P+w{&q)�=����)C�I!��o�OtA�ښ����TR�b�ӏ� �� $� ���W�#C����Ƽ�려���VoT/���1KF��2?}�� "x1Y�=�1��$� �_�'0��������a�.B-I�uy��?��&���6֕�O�8�?gd�hqf'K��d8��`���n1�t��Q�'��dž�Io�1�Fn�5����1���f4z_���PK�*Q�m���\V!t�P_R P�.݆¤9�R�x��A����xZl{�57=�ov���i�5�Q�3�<⟦"fp"��Bg��7N+C�]\�eɋ_6����嶉���k���ʹ5�IUe���|k�m���&Ewz��$�4f�jgѼ�T_��|aQ6|Vۉ���e������kS��gsHqu�:%rd�G��v#��0�u�`��D-؟��X�i�B.�������)�HX�f�g���Hy�b{J�cl�>=2`ڰ*5���( �D���7���f�� Z"�z�4Aoa�Up |��#z�C��(���\'�u+{6��˜X���.�$Q�v��=%��.$�Š�;��A*�|4Q��s�muM�1��d�lc��d�3N�v����]��ղƤ3k;3i7Ԝ��*�����o*������� f��8�l0�$ �o��vX���K�꿢�AgH2�w��=6�����+nlFd�Q[� a/d���A����|&�](=��q 0��#'����Ah�V� n�f,��2v���.�ו���z����m#��t����1��#�~�,Eӥ�G�쪾䓛���#�ø�`��HO����˟>G&b�+-A1��J(��fn `���p�c|1e'�����O(��C%���ő+�)t��8pক/�"��;6��R%$��ӡI3Ԩ����'�0{��8�� ���˖=�F��Fe��v]8n]vk���f�W��I�ښ���f���� ����W�.p�^��ۚE���ؐ�<��jY��6��Uq�����x�j��5�aT���!.�πf���q��c,��] �� !Nj�rF�{�>�� �{襪Bɿ��Lu��s�FC���?�v��������Z�!["���N�۩�c8\"$�l����u����v)�7rΐW��,�@�^y��lj+�y����V�X�'�#ˢ�s�:��噾M���l�����_� �i�?��>i'gVo�b 1/���J���?���a�WCN�������_7��K�RԮ𧈡�|�)��RpK�C +�ˋ �"@P���p�\i���.�����ۻ&��_�g����_��Aˎ��!�3'爑/ ����l��ox�*���R�����{P���g�k�3_� �aN���C���.����?�撙X�ά��cf^����U��e�ٿ�Xh�q������y!�)��,�u�\�V�^K��0���'��_�O�B�w`��q-�Zyŧ~F��c/j����C���N. ��{�����%�sv�T����$�b�����gWm���)����;}m���ܲ���l�խ]���$'ut�5��e��"w����a���?>> �2o�*5d�D���J �ݚ.�o�2^ %/��?��k�uc�'�T2��`��si5�D3��2��MbUG"�<TvZ��^�G�f��ܬ��P|��)w�Ⱥo�8��� 4z$k�(Ya�p�a���_L:�4SmU���{�<����r�/)hG9�vsW��p�8����e�M�mL�G�� g�� �hȶ_�7��J�ebR�.�?��I����gt Z� �;-FB� +����D>]��|�T���jV�^,Q�0)br�n�%3������@��%�W'� ��@��ho�?�H�$`U�f�^[�(��W��M����c�{����tL+�:��Ӂ'����>j��UZ��^��M��I��ޓTv$��ܪt�!���6�|:r�Lu�2l�k���S�K�m��Hiny���/����}QÙ��F���CW���ᧁc�:P�<1��U��I`s?���Bz��qtx�o �� �V�w�O��ON|�;�!�lup���$���L���ݗ�8�B��IHN+#DY(z� x�!� �\p�(&5ߙ����I�fIv}\Dhl4��:�<��dz�+n���=5NÄl��yAn�a�G��V��Q�8%l��~f=�\�KS��ɕy�L����Bv��������+�!ts��Y���C��Ό5�� 6$���(5�/dge�idc�(��(�u|f1c�w�;h�j{KFe�ClK��ܨ19F�r���;�T ���(�Ni�)�1mS�`>/���Hv>��GSʙ�~�)���cb; EYY(��>�}�_IC�]�x�$]�)R�&���|a��������w���Њ$�dj��kI��2n+�I�M��lWO���[0~�(Y(8�v�^ߠ�F &FR(; ��v��ׁ)�M���a\��=1ܤFk9�E+{��ܴF�܆�]hF��{��I�h����3�,��~�71�^�W�Zy@Xm5��
Static task
static1
Behavioral task
behavioral1
Sample
3dec06e86314194ea1689dd566fdb37a0f5690c422c1325184df0758b97a038d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3dec06e86314194ea1689dd566fdb37a0f5690c422c1325184df0758b97a038d.exe
Resource
win10-20220812-en
General
-
Target
3dec06e86314194ea1689dd566fdb37a0f5690c422c1325184df0758b97a038d
-
Size
6.0MB
-
MD5
5d206f4d1fe0c98bf21d7d1d34a911ee
-
SHA1
bcea62048671088e1c6856a6829c48515c2f0487
-
SHA256
3dec06e86314194ea1689dd566fdb37a0f5690c422c1325184df0758b97a038d
-
SHA512
a247ec04eb86039b76e7be451026fbaa677c02058bdfeba67b890eaa47b34b5c2b988962ec812081cfb435f21e9fc42b2663bcf509540d93be21ebb95487bd55
-
SSDEEP
98304:XSaqSv4dHfHiZFB/wBzS4z0YKc63ERrdV2z6AU7WHBLHEBFejto3ztCxGxlD:tfv4d/CZ7eI61d9xIBLfBo3RCox
Malware Config
Signatures
Files
-
3dec06e86314194ea1689dd566fdb37a0f5690c422c1325184df0758b97a038d.exe windows x86
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c=S Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rXX Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pCh Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ