%��\���T3���@��������>�xRP2�ށEA�2''����GS�N�R2�.��88Oc"��ZEe�r���*� )�>z��_>ԕ7�7id�4��`�\����Q������^��_P:�����>������T��9Tg:�V�����'�ږ�`�rߘM��E'������u0F�Q�����J�T��6~o��������wO��'θ S6_#\<8�8�A�6�c>Q4��֥B�b���0�`}�f<`���R������r˻��4B��)`.��s�����̝�Q�4���c �1���}�>�-kѹ�����e��>���U��yT��t����������K�Q��C.{RL���K6�>f����T�-���T���C�u���V���^�(0_:�&�F � l�R�L<{p;ai��̸w�����OtE����@�FW���ر!��fn�i��P�� �([�:��z�X!�Ӯ$�/f��Ȭ^�HQ{z-�-5�v-���i)�y�U��n�0��l�0,�3ْg"J��8�ʦ$k���Lɢu/�xn ��d�dyp��������q��*}J�)����D��!��;���"^n�&; �4��W1�"gi���`��ǯz����dQ�+��~��k7��QoX���MG��-�g�{r��fpR��;����MDIx�5�&�a���߸�ۢ�6��8_�CG'�o�o�H����>������I���sK�����i��Z�}�ԥ���(!�lv�UG:�8s���D-����B� �q�8t�3�v='(��ߓ^Մ��/#V�(�V��(zN��I���q��&����u|���,o�C����60O�lU��G>���_�-JR|7�9_���M���lO�:(��6�Q�A��'</-prT$@��9����'�X*ϵ�7��é�� $9�N��Z�ȕ_�������܇��g��Y�U5��U� S؊e�\��@3��2��6d�i'� ����Ge��m;��b�@DŽ� �.��pB�S�;��D�]ҴBM1�K/�"7~�\���vj�tس��YZ�� -��5�h�d�j�Ђ�_�>հ�ˤ댡QA��$�6��X�zE�a!��˓R�H�����uz�c�.:�.hhkF�V��p�z܆����ۓ�JX[I��7��߇4G���%Q��б�a�`B��MƿQ��\�RF�Vր��P06<?�X"��NJ�����T�ύ��a�U��E�J��1#�y\����|��y�y,/+�9/��<$�eQ_��7h���$�Ѧn���Z.`{�(g�Q IE ���2kyGc��S������ � L�\���&�9���m[����ȴ�L����G1s*��a�|�����C� �f>���G'�N#0p/`M�����Zc�7fB�:r>4u�/Jט-E #~�LuZ����B/�c���L��!�?n[ >��s���?J\���GF�� z��k����ݭcFk��>�M�/X8i(gv'#;و�Ui*�Jq�'����=�Oy����X�Oާ���������3?��yJ�P,����|a3�����-�V��@X������>k�$�:W\�>U�k�(Hr��9��L(Q�:g�ڽ�tT^��n��Ț}�5X���f�p�y��{&1�2�`�^�r��Z2=�9�w�F �4�}��{�2���\� �P9�oI9��m%5w����>VS� ��E;�"��_xY�d4h"0�Z2��E�ԏ�b�coO���ۃ7:猛����/o�h�n ��r \�E������$W�N���b��1�Y�A�s8΅���)��ί�1)y��Ԭ7��~�:Ls9��j�[���]� �iW�`v��.r[ٳ����l����&�q����|A���Jg+�<���@�T�ܡ1�U�K]9�q\�l�[I\wަ�1`�x{>'�����0Ŷ�Z�&�c�nGwv8�M�̻�����J����! MME?w��q�����x������Cf)���:��iӗ�?���Iuo�Qj�d)~�,������!"��ֈm�H�<��;d��F �E���,�AP7�-k�qG!L��<�]Y3N�@]~�;f��13 ��<�md��D��k<� }B��x���k�.[ߟ��p�x��̔m͏�:y\A�R�C}�tС���uP�.}Wࠋ�J�y���-%S�)���$��^��h"�f��t��)9_������p��>xu� �RfϹ�n�a1��XJ���tn�*���H�`�jj��5��'�Ǟ�/c~@��v��Sߊ�ӳ�cw��n�y�������P/2�@����H�q.�$�>鯏�n�)�z���� �N��Y�zkZ��?��9�hK��KD�;��r�hƫ�v0v�*v�9}\�ͱ5_�}��yF�����w�m5h̕��v� ���Z�.R��8&f�ͥSi�U���T^�ۈ_�k�ymjB�ѕWYf�O�ށ�0F�r��f4h�[������nowo? L���XP}k��j���8A���Y��l�e6��x�9�6��XU&�*K2��}M&�7�n+O��6��s�"��;w&����tH��]́wB��NH�.�M#8�)�N�?L�\:�OaU:��W���L�%��O����EL����v��[J��:|:;�H[�����~���4Jl�y�@t̂~����/��4װ�c��t��PA�Z�K��`����GҮ :@�������]����D��e�ޖ��&؏7���Y7JZ�aAR�C��`��� H5�B�y֦�w��i�47e 5�c�6���OA�[3�����D)�ֲ��\������S�gzЛ����1���S��;�J�xIǴ�s�=�l'n��'Y������:�#�/C vBܽ���L�D����k!��e.uyd��.,)�g�iQv�۠������B/�@��7=�F��tx���;�r�%���� T��9j�W���!�dH�����~��h�([(6��j~p�q$�.���4��ԙ�Q4i}U}C�<5o����>��`+� 홁�24�?f �l)f��B?T�Pgܟ[
Static task
static1
Behavioral task
behavioral1
Sample
48e8ce6c92ca33afa546ee59da5f44ccaf0638711be76c75b1a98003222a0b23.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48e8ce6c92ca33afa546ee59da5f44ccaf0638711be76c75b1a98003222a0b23.exe
Resource
win10v2004-20220812-en
General
-
Target
48e8ce6c92ca33afa546ee59da5f44ccaf0638711be76c75b1a98003222a0b23
-
Size
725KB
-
MD5
7ced74ec75f3c0539d650544c3f464d0
-
SHA1
0db71a46e041b5f93489f0f3a4dd0e5296776dd9
-
SHA256
48e8ce6c92ca33afa546ee59da5f44ccaf0638711be76c75b1a98003222a0b23
-
SHA512
1649875f1b65efb8162ff4b0875e47c26710884a450e0452fb137269bf684f700168b0b73a9009645d55db1608831cb05dd2de77dda15e81f9623a5871661f18
-
SSDEEP
12288:kZm4nOK2WGWOJkiOAUH5Wp9sA5X4QHxi3R9Af/2XcNRFtA+vlIHobBKlY+IIr/XC:kY4niBWakhA8NAZ48i3jG2gFNKC+rTJw
Malware Config
Signatures
Files
-
48e8ce6c92ca33afa546ee59da5f44ccaf0638711be76c75b1a98003222a0b23.exe windows x86
94e9b600699f332e846c4f1230de34ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
setsockopt
version
GetFileVersionInfoSizeW
winmm
mciSendStringW
comctl32
InitCommonControlsEx
mpr
WNetCancelConnection2W
wininet
InternetQueryDataAvailable
psapi
EnumProcesses
userenv
LoadUserProfileW
kernel32
SetPriorityClass
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharLowerBuffW
MessageBoxA
gdi32
EndPath
comdlg32
GetOpenFileNameW
advapi32
RegConnectRegistryW
shell32
Shell_NotifyIconW
ole32
MkParseDisplayName
oleaut32
VarR8FromDec
Exports
Exports
Sections
.text Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.preddy0 Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.preddy1 Size: - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.preddy2 Size: 622KB - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ