����+��QMn'�/�Ds�'��� �����j&W����h�衚��p\,�B�B�ԝ���X�+r��4J����PQS�V�q�(���w�,�5�JsqK}B�%;슲lys�? V� q��_���'�S��B�To���0�j�����[�eo�w�gr��.JߘD&��q����� �O������(��~h�bL�����T.�� �̼��0�� ����D�`*��Fp�/�ӀU�s����ݲ����=�j���רx�v�:χ��� :�T��<Ǡ��bH��5mM|�d�iWR^�r���+��L��4���,��ܤ��i K.�^���t}�W��l�sn��5��0ϩǍ)&c%�����j�\9�ݛX������'�{%�Ŋ�5ߡt���:1#fu�?�����H!�q�!�J���i�1�AT���{ ��L�ä1��AO¼d��:�n�~��{�ۇ�L�����n���7̜�־q�kH#cu����?���J������ }��l�61�?�xǛq�>�41Ҕ\5)8��wRY�������Sلةi������[My���*��!8�j�x�������+����q����^�pg��&�n�y���X)�IS4����կ�!/Wy�d�g���Q���Q ��/�<��s�T}ջwv�I�S.rGŊ&���s��y��)QC���Zv���ȥ.��.ˁ\����EZ1����B�t.H��ד-+BE�?HV����c��/���2��yX O���e�߀���A��T�y�!6tJ;J)� ��9c��o��������4X��<�W��i����Tr߫j�����5C�@�9(�a�dN�q E�}��E�� �hI���^X�K1�8i�&6W�s���.81rEj�Z#26[�)�P��B�� ���;N���H�&�w��h�)�-G�LXy��Nh�q"{I�>���j����:Q�Z�Ղ>1���]!��Fy9.`��y~He��!�Cǒ�TO�K�y�G����&No1��j�t�I���-"rU"�r8���X/-R)e���j���ө��G��a��~�{ql^g3a|�j�B_8/J�� �Cc^]�X0�5OW)8)5���b�dZC�u{�l�G+�����Y�}&`s�� �j�̽�������ڐ��D g�ũb)�\�}��Ο7u�g�p�Qp����LO��HH��>�W v�'�B�S�� �[Ą����/`��"9�����<�pG�ڜ��vM�+JA+�=��iy|����t<̦B�@�R6y̜�N@����8t� x1��-�ʡZ��:�� �j�Ni �a)�3�r%ƅ.ޯ�c���N=]5�����6�@c͆����G4��T����l��f;�pJ����ZEE]rr*��Xc��Ŏ���᪶%�R�c�j�+h�D�{� <����7��=��W��?;f�?t p_J�c�{oLe�v�O���۪�gN��hus-��>aP�$�㠳�].O��պ�'�;�)&�_���It��Bp�����S�?���bL*�{4��?Ŝ8��BE��a�@=Kߩ��.䋈]vۄ�wg;��7��u�3x0�+�;����k�2^�>Ѫ% �S�˸.�d,@���v �s��g� ��ږ��E�0]l���Z~���I�ά�kӔ\��tȩ �61Jy[!ݤ����D��ic�D�3f�l�����ɰ��#_A=��ޏ�Q��aOڦ�[�5���1��N�����}"��*S��@�-�i����dW�kUǼ�OT����BUMvKI�9!��9T9��yhI3��R�����~�ty͎����0\>�]儜q�i�o_$m�[�f�:_e�����4R6�Q_�h>��2вQ7ͯ�D�OF��g����0,�6��E�2l�n�s~֣�2���(pӃ,�ii��,��|�*d�*����?H�]+�\F]�~"���� �����s�p�6%#���b�!�F���|I�]�L�a3�9�"�)�;i���_��XC�s�2�&6k��$e��=W����"w����q�̀���u�?tV�e-?G�Rb����+�ҝ����(.I],ˊU�8� ���#�r+�N��`�ߕ�I_⇘��ܸ��X.5�-�;ڕF�Ժ��A��q�zY�W���r�ë6��$U5��������� t�tt"���1Wfq��m�S6ļ�L��ꊲ������~�lh�1��HhȲ�'��pi�g1���4� S�N�:~�?�6)G�j�f.�f@0�N�l[����"h�pt�w�1}�d�0�#�s�3|?�u\*����<ÂQ��x_փ��i���XkB�lWr���O@D#[j�~��i�iE+,vտ&�Q�=u���$y�t88���>�R�Nm�>�!o9���sd�βq)t���U�p�.l��� 5I����)��N!��Q>� ͕7U�$�9<'� g���4�9��"��9f�tS�SP�\�^�$X}\�g�c�` ���Ǭ���MO�T�vĘ;_���ҭ�l��K;Y��"|��XD�b����չvf����Г��m'�F�d��Q!���hw_����� ��)�uD�=�ī|��.ﯡ���?�� �d���K��V�K��]�&�U7ր�Y�NĨOu�)X�,Su���M� _F~q4I1�j�sO�������#��!�D���tގ�q/�s��7T-}e����5���I�mrQ lcй�8i�/��Ҍ/�Z��k��eO;1�A�͡Ѣ�M>�^Q-��J'�JפCS�@���Y��ͻ*��h�"�H�l-�`������O����θ������)t�w3���kAWP��a9���*�̾{���)j*f�~�^[\o��s�+���h���[eV{��b���s���c�v��nJ�NY[P²}ƸNGj����� vu���3��������2��`��P�R>�*��Wt��|���UKM�Uh����v}SZ��B�����i)q_^��IU�˚2�r1g�4����Zd����TafÉ.�c4�\����f��!t\ ���nݖ�k��cg���s��ڞϖ�� 8�?ɶ�ɤ�1����Hb`0CW
Static task
static1
Behavioral task
behavioral1
Sample
a1185b21dc06f5fb6fa10788951e24b28bcb79fef84d4b9ed6f19df698dd5fdf.exe
Resource
win7-20220812-en
General
-
Target
a1185b21dc06f5fb6fa10788951e24b28bcb79fef84d4b9ed6f19df698dd5fdf
-
Size
149KB
-
MD5
6e3cba2d8323d8f3b50584b04be444d0
-
SHA1
a6ffa772557ef579b1da8c6ce3bc3433dbbe95a8
-
SHA256
a1185b21dc06f5fb6fa10788951e24b28bcb79fef84d4b9ed6f19df698dd5fdf
-
SHA512
2103cd6999012e78590e98de8ca480ae9f5b10f138f5f6ead7cdef6bca2afe46db7865a15a532a63f9c032c2be1d5395a85ad1806ed0ab48e6cd47edcc449e02
-
SSDEEP
3072:kzac+BsZFqU+DsbR6GJT6kJsLAu6lUoZV4HS:oL+B0EU+UdcAny
Malware Config
Signatures
Files
-
a1185b21dc06f5fb6fa10788951e24b28bcb79fef84d4b9ed6f19df698dd5fdf.exe windows x86
45e2bd15ba62888440093fb8934ec862
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
shlwapi
SHDeleteKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE