�q�l��gjd�n�+��k�P���{�B���g�E���)J��'��J_=g�"�; �j&�,�����$wm�w���h�����A!���%�Zuv��;���9����I��e��o����튐���S��^<�5��S�+���u��wcXYS����!�iB?��@�m��������A��gn]�d`��_T�p���/j9�Ɣ�[�0���l�.��f�"��K�7f+hIsn!�����̯�+�"�#�^|jmœ�D:��u%l���l�^b�1�#�����H�J�������zmô1��n�b���ٗ�����jZg�RY�0�S�ل�G��<V~�<��ZRMRf�"�&A&�4<�>��v���=1��>�݀��̯i���_����o>�M}{�B�D�q�����{} ���Ⓢs�U�(�"hT��+�lM����ط�u�� ����vLN��.i����<�!�S�Y���Ϊa���M���<.Uc��������H������_��If7Gϕ�]�cs|de��ec(|G�^���r7��1V�Q��[Bȅ��~���v�>����M��o�[n&jZM��)J �uo��ޱ���r��~ i}CYJ����o��viY�{P2k4]XE�G#�/���w��uU��}��z�w�_��$"��ۼ���'�=L��1U0���L#�ۥ�)l�,��� �A�\ޱ��y:���Ҥ�ٍ�dyNb1���2�a�^���h��!�����0��� y��?|J��G� <��1|��,2��(�;]kc�X�*y�#��g�^����I�Ϩ�հ���]1,0�.Q݄{�=�%xM(�-\P�~&�`V�\�1�gf��m?p�<r�m"�ĦӺH~��D7�Z������a�X�y����F4#=^ ��v_!F@�Ԓ@E�n%,���yIz�ʌ���2Dt4�]V��1h�9d�f�*k��9�#s���])UY��j-����*�=r^z��0��ה�gLA��a\VZ�K=�2�kck�\�1��Ӵ{{�U��|���M����� �@�4�/�n'�l���z��tPF=,��|=��/><c�1�X��~>o�v�:HpO� -U����m���3�����;S1Η�vg'�X�ݝI�N�c���﹂�;�b��tX��EV(��� ��>�2f���C�����S[c~�M���±Vt��À�)"�^@�q���k�j�S��#<��_��~OO>��e=�3I��)w��c�q���t_-�Ú���)M�h��r��O-��/ Y8��巇/pGd�le���0:+�r��:��6�� �'�E^� ��Nt~:X�u?�!�ŕ)a� 3����g��O�n��+5jr�0'��P�����~-�B�S�~,���� <�Q�E�^������N'�J���䑅���P��[%H�� ��W�ڮ��6��Z��j���9N��=� ��6�5.U�a{� �&#����wFRV_%�Q��8ޭ�XPϚ�!^Ԛ��a��V�ٽ :)�}V��o��w=�Ry��LKC%�?���?�|�ۻ��pX�b@@�l������$������`@�*8U��?���ʯ{>c3�(��L7�ߦ�v��������\����l���,`��T�����S����O/���.�6o��Y�'���ք���ڴuID� ����Oǐ���!�*��鞻ww���B?>#�����L��bF���-��y7/R�h�h5G���x�!�s�Q{ĸ��)���O��dg)�J�,&��9��>�(0�O�x�E��?���[��z��3��朅 �g[�B^�K��+�J�W٦p.���N�0�Li���L�C��ܷ�����ry*���r��'�Z��0ƒD�@o�@������i��p��e%7P� R�# N�N!s=��b�<�s��{�Hr|fe� xC��B�ݢ��=%xlɸ������D1�ˑ���J��(�*�(�C�E��t=��r�Jߌo% x�Jp����36���~�==GK�!���� �6���.Zr�ʛ�����"ʂl��/ �o|�9��7W�P"��0�_�����=�֡4��n��z��u(6Ȅ5�͇/fng���`�HO �k2LT�=�UOB�y�XZ�"Ɵ��2?���MRe猶ZxrZSZS�c�+N�����:�E�הB�a:�Q�\#��o���'�6��E�������d�����¦�g>�R����쮟���8��!2�i=����ee�-��ka���9�<��{��h��tU�6'�t?�|6|L����$�L it��tJ�IJ����#9t�D��8�*�(���˂�k+��O6��[�qꑛ>�]OOG���k�7Gt�e��n�O}��b�z���ȡ`�>���5Q��D?�5���I�9 D�L4[��#��xw9�C����d�Z%i��yV0��3����.��҄ٝ���8:�A��~�Q}������J�ݬ&_�\55�B���Ti}R"�{O�U~���7������_0��.��~\��.G�Z4��H��.�&�C�>��o��w������'��rʗNJф�����d���ţ�!�J`�G��Y�pg/T;\&x��G�4�,�32��?��H->�[1b��:��@=MQ 'f�E\�&����WR�J��q��"-��v�[��W-��|@�� ^�� ��DN�CZuӜ���t�u�)���T�JV�*q>G�ɢwj�Ж)}f���u���r����ۃ ���)^&d�gs����b ז�|Z� 1���+n�-�-����@�?$qM�������͉)#�&Z��b��<L�_=S����-ɖ�I�̖]J툩��q�8���R���K���۷wh`�g63yȨNG?b���l��6�OG(d)��L�ǹy�q����%�.q̊�*�����>b��* ��g� $k��iد�m�"|>-���\� �rF����(��� �&D�Ea��i�p#U�ͧ�y3b�h��I���4��Й{kʒ�������{ź}-��u���֞W�:����SF_�
Static task
static1
Behavioral task
behavioral1
Sample
edcf729be2d4f7dabb97f876850aec4ee1e82e85710764bdadf884b7ed5048f3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
edcf729be2d4f7dabb97f876850aec4ee1e82e85710764bdadf884b7ed5048f3.exe
Resource
win10-20220812-en
General
-
Target
edcf729be2d4f7dabb97f876850aec4ee1e82e85710764bdadf884b7ed5048f3
-
Size
6.1MB
-
MD5
5c1a02c3402263330a0ff357a4da8813
-
SHA1
3df5eb3282b80422af4a2b0a3b1dba1349009990
-
SHA256
edcf729be2d4f7dabb97f876850aec4ee1e82e85710764bdadf884b7ed5048f3
-
SHA512
bff811a70f19c997e52d559e6e9bd7a8aac40a23acdc11effb43b477a6bbadfa7b9bd7025eee2605a4bef283f2b52405822079f6e2f1f668960454fe33a316b6
-
SSDEEP
196608:YBZ2RdKz8wOsH0jg2pvE9rU/KtC7RovVD/:YBZ2Rdj+ugYarnvZ
Malware Config
Signatures
Files
-
edcf729be2d4f7dabb97f876850aec4ee1e82e85710764bdadf884b7ed5048f3.exe windows x86
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RTS Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.3*h Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3`[ Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ