���K��N�3[��f��J��@s6����N�cē��z����7��f�ڠ<�uD c���}� ��IM�)�=fC!p.��� b�{�9Y�d� ����x���@A^K��H;4������h�)�+��+��?n��E����`�ݛ0�E�u�f뽸�2'���t�oM�Z_؆������K�Lo>$��[y^=�;�Uw���mU��q�n�n���-�]�B��c�. �䐀e�����[�骀B�s�����~�l e�����o0Nh�+ln9Z嶛c�� �( g���ϊ�����v����&G�pR��x�'\ ���0���!���m��K�"�R���[�N.�[�41�_;عz[�!��n��:�m^��֢� �@8`+�=s��8"��j[��$�?�@sz�-�x�C�>���T�E��cU��Z��L7��V�ψ��O�Au�V%��eg.諧����&#r�i"�9'ōFN����5�u�Zq��i+Sj��-�@FGG�u�&q�1מ�G,vz#+�d0�^#tW6Z9�c���kpw���qK(���4�7<�a��|<�Q3�7�[��D����w�;���������T�O��y'6Q4�,��(`��#�n�Y�X�E.�秴��k�)T��u�ƻD-:M9�=����żJ�V�l��!�kg���v�Z� M��Ƕs��!�hx"�6e�f��]����x�� �` �w�"�ąl�.}�.��d捘 J�7��h�]�\鯚���W~r��<���(}�s������٬���ۖ��hVo�g��0U�$7�F���G�1�2'����Q6#��3U1��l����=5rr�K&���?ʒ�Ĭ�ᕡ�q b��Y�_�_��n���@�bCSF��˘�������)/�b��E��V���t/T��d?5��{u�$%�hˌ��u�oh�fD!d��4V�d�I�e��#*��:��щs���uHtG�u��s&���f�"�G�\��� 9$�3��_~��=.�M��]h�EV�CXNrx�b�>FKq<���TC����}�Nt�Bv�i��L����ʽ��8�#���9MU���^>տ�,�Ix�� �����, �vc��OC�,l=�s �9R�|B�{Y�$.~�֬L��1"{��y�����p���-\���ư �0�F�7/�����rN�-W;�"��A]�]ڜ ���Qw0�d%x�����e�N�`Q ��R{��7k��R�G� ��#��wb2�@�^�X��d�+z��5SҪ�0���K��m���aL#��1G��H�����h���%S?EL�Z�^����Fʻ)n���? 7:�=�aT��x�6��>*�����c�7��� }82�ÿP������D�sl�?� ���_a���Ņ�s�Q^�V������ݭ�����0Ȩ'�[r�W��9s�ޗ)���Ô��� �na �g֙:����Q_�_�"����}6��� ���T���s"9�Y��_p\�� �d֪���M�IC���C<|o��ɿ��~ �֏�BK�k�5F�~��,������������[��^�w+?�w,�g$ �����8"��7���c��������T�(�k�WO����T!�O!�wb��4��u�������"\h������V��h+��S�B���U�(����Vjo���@A���ew+"$����V��<�s���wQ��E�Qg��+��$�����h:q�$8R>��/��2&m���)���h0����oS��P����� ��X��Ć'�LJ��}�%��l�x3�%#��E_;�4���fU��O�Ɏr7��C�;�3DOy���Y���>[������hx����eϚ`K��%r,��Z�q�._M��n�Hc�8��6#���ξ����6������ ���+%q��O�8��g�~��J�@���J9�-ռ�K����l� �q�������3��t����LΛ*�륅�N��|e��g�̟s��D�@I��2'#i���Y~�S��m.7-��{~��u�Z�v�� �{Qк�GH�3$=��z��ΰ���3x�X u���PPѯ��Ʊ�>�Q��H�ˎ����<���:�T�� ��"����~/泶L!\���WG�t�4cL�#(7���L�G;�����ɖ`j@���� j����j�y��b��.�\�OSKR`f��&�#l(٩3��r7bO}Au�� :��]�փB����n5��{L�o���uRz��C� S����'�.��|;�1�xn$X�)�A�T�����.����������}�5J��\_��U�$���J䧜ZM�����F�����)c֜���^�����W%sK��۷� ��t�ц�l�aR���/�gF{�P0 ��y�Ծ��Ƀ�^�~QWQT�a��Ij���i��L���>rhZG������b)[0�����Zi��::�;���a��M���6_'�ľEB�yK��C���{Iv�Sў۪�x����{+��N�%�Xɝ��+�#W�X�����9>�X S��*@�,>�>1����J����;��{~_m���� �������,w.Y�r�E��0�.B���E$M���؏07�u�AZp����-}��Ƅ_5��T���fWٝr���,�� ��(TNJUE�ǂ��fm%�~���������$vk��wF8?�"�2zϤ�p�,J(�Zc�b(�s��yڻ�G�j����dI��<�''�9������X�:7�᜶���8��5o-ˎ�5gI��U����wuq������?�y�¢�ܨݕ$��9j^�r�h�G�S�D��|m(e%g�ˊ#x�]K����4!�Rc6��"�<a�����bD�V���"&�`��7�}�)%�����C��n��S�+Moe�J{������tK�:r�P���H��0;��T����xYb��^t�M�8k2��$q��ج�$�t]���� �6�ۻ&n�*]�،i�7P[��Y8���R�w��6���I��@%4p�
Behavioral task
behavioral1
Sample
ebeee987ad50294ceb631c236d2860d1dc0acc35750279687b2dfec07e281ae7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ebeee987ad50294ceb631c236d2860d1dc0acc35750279687b2dfec07e281ae7.exe
Resource
win10v2004-20220901-en
General
-
Target
ebeee987ad50294ceb631c236d2860d1dc0acc35750279687b2dfec07e281ae7
-
Size
284KB
-
MD5
8661e68be9865f1af1fde705f9073935
-
SHA1
c39838e4d1e6e53ded66923d4a7e7b6292b9e1fc
-
SHA256
ebeee987ad50294ceb631c236d2860d1dc0acc35750279687b2dfec07e281ae7
-
SHA512
86b679c46be063d0c20f5e4a0572ba80f4d7c0a64b42f319cee74855a838d929902c8c7223d4156bce5ce0daec4ab28375ef3f0cab80f04ce1256a6eccbecc2f
-
SSDEEP
6144:8Gio8t9KCcPQvQgE9AmP/bTpEDtGBs4tz2t3WPxbATPRpvlL:8Got9aPQIgEamP/vpEZGftStmPxoPRFx
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
ebeee987ad50294ceb631c236d2860d1dc0acc35750279687b2dfec07e281ae7.exe windows x86
b8325eb1b3fe16e3a0cc92433c97dd38
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarMove
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 264KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ