Β��Մ�S�O��h ��(��q@����вY�M������<�0���3d�>a����ޤ�csc�� Fֲ� [��+����� �#�>+4p�.@��/gb5��{�>�Y��Hm�%Ep�nM�N*"ޠ��b�uٸ����6��#�X��D2����J�X�+���H���]<"�x�!H9!)I�MG�}��Ag�N��;?]�;��g�&^���W� ��@���אX��Zz��tҊ���������EϢΥp�s��3����xI���#�&��W�����)�_'�բI?�Y��fp:B�#pJT ��%��D���_���%-1j���ÈM���_��,�Yb�GEZ�\�j��2����o3^�&c&��,f~�#s�EJ�<� �勇���j�a�� �������EUe��5G��(���+�;(�a6`A�ʳ>F��H+P0?���ܴ���[�X�f֡�����XN��t�T��Ċ=���va�X��&'�;���{���*4:G[TW&�\�tN�q�Z�c4 ���-�X��n1��~%�i?<�2IF�M��|?�G�&ޫo4E�;�8�mu��Q'n-3M��]m����5M�O��.�1���7��俀���V�����y�g�R��i� ��DU'��W^]��K3r�\ƒ5��GS�u"�4��� ��N5��w}����o,��y�)`�-�'(�����G��W?y: ޱ" �D�^��:(���h��y�m�C~��i���z؟\����YD������Y}FL�(�džJw�&�-۵)�#&�hAQyΤ pO,0��nrYb��>3����:�����J�֢�a��UE�$��] ��J�60�b���� �H��H�\��v�խ�(q�;�ު�L=��܇��ak؛�Í��f��S�Π�� ,�KUp���`�Y� T��䱁 ��2����`Bc�q*4tf��6��c���X�k(ʛ�-T���K����m���I3���j�o��as�i�}��HIY6���7 ��y�E[U�7�@�.¯�VlT��8��ƭZ����6L��Ul����E-�I����*[k������҄�k��J��Dg�%�څ���@�KN�q��PB������j����$�YS�0k�v{i8�^����i��toM5�i��@�Ӟ:z� f�#���+��;�� Ae�y�E�4k��B$�:�T�1� $>�l��b�53���>�?`]��^f6Lv ����m�w�4~�����;���30T�P����%�1"!�$ T(�S����I�h�E�Gda���Q�����6gO�v��;��C�a6�xfC�q,}�["��*c�N���ۖ�ƥ��)`�h�s�����Q۳�M����@����i�Z��?����q��B���X���>����E*� �%Ϸ�� f������g�$�(]C�}��s��h�,�{%X��]X%�,L٫�� �sBh����$�%��1�R��4����jى���=������O� ���Xt��z�#��T.��m������ �2k� �Ew�^B-�m�>�i:hȾ�D�BJ�,�M�ӱw9�Iϧ)f,�� qQx%%���Q:�.'�&�|D�`I`�.2+%�/�}m��gWr��<ʣ�k�yHGL���~o�"���V�0�I�NȲ�z��}t��,��=���mj�,PP?R&�m�Y6\��� ��� u`�՝���з��O�X�_m��M�&Ui�����Y� 1ZAz�ä6�`h@x��ʎ�NB8�1�7��HE������x����V5����A���Ï{e�������Oj4��`�"�� d�T'.���F�F�9��K�u������%����]�-�O.jC�X!�[w�� "_s߭��r�z�rfZm=��p��Z0�b�Yu�"Zr�!�ԛ�L�c��I���p7:����=�e��ZL#F��\ѿ�g��k�z+(�/����cz� �rp>z�8��D<;#`�4��~�]ڠ1���[�m�ƿ��&��5�(��X-\���5��`�����}������FMPgW�jɰ���Ů���o瑲�8�=)�#� �[坞�h W*һL���Ve�nu;�`zX�_W�d6����Q�;E�D����s���ؾ?� p��I�����/%M��r0WZW2����V�c��?tS���C�&�N��m/ΐ>��-C��e�q�(�.7�h�>}�T�j�d7�$�jd��SGBx ����N�8�!p/+'j�i��n[N+�3ww��a�U_��/I:vn)`a���M�ԓf95k�HBe'�7�k�=�o�!><^���$��P�a���G*d�tyڰ �j[ˀ$��[d]F� LV����sI>-hN��bH0S*����ÈP�{���W�u�(�E�9�,����E�C59I���-�����{tN�����¡p��(Y��H{<�Q�>���*����4�I��S*$�H�)<�_�p8��5ܱ���1$���B#UR��k��T�/7.��s�uI�u�is#5I�[8���l��F�k\-[���mH�Fa���=_�穢s���[c>|��+��ޛB^�$5u�iD+����4}E�8��Ǭ�.�aG���V^ߝ�m����}��K����3��� ���0��{4�D����b�x��|V�´ �D������R����y���,��^�B����0�F�!:hp�jp:A������߷�H�$*��A�Ѕ1Y���Ti�$������_�? ��i�DAN���sB7ea���f!��y���4� ����ce���0{W��f� S y@���� >2�O�v���JV��Y[�7�����5����w�R'_$!�;<%�2}.��},3��B��[ͳ�:`��dX��f���y��s�^�H�[�.Y\�DU�� N��V�+8��,."��v��0���GhB`��s�?�s��9��C���">vl������{���Ҿ�ao �/�r����eø ��|��Njy��R��hP�'�*S�f�C���ѥ�J��� �}�hO��v������gW`6��������G�
Static task
static1
Behavioral task
behavioral1
Sample
kAaTdSGcbQFM.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
kAaTdSGcbQFM.exe
Resource
win10v2004-20220812-en
General
-
Target
kAaTdSGcbQFM.exe
-
Size
6.7MB
-
MD5
b7ccf24de6a8258f0609b0c95997ca15
-
SHA1
1b5603f51a1362c8770b14cceae28b26f3709971
-
SHA256
fce8a9656872d13632a2342c515bcd5b1b0fce7db509715747821ea40539c82c
-
SHA512
a9d597992f8e6945c56d3191273bb6996825fbfabf8d65519981203735cfe1a0dacd411bf84fbf1f200036dcd5af484aef9d8692fffdeb040e5e3a2f921e6582
-
SSDEEP
196608:1/UMAF+Y8QZTWHG/7aCI/r5Iwb6++8XuR:O+Y8QZKQ7POia6+9Xu
Malware Config
Signatures
Files
-
kAaTdSGcbQFM.exe.exe windows x86
664b6bf9678748018619292417a78034
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteW
imm32
ImmGetContext
xinput1_3
ord4
ws2_32
WSAIoctl
crypt32
CertOpenStore
wldap32
ord35
normaliz
IdnToAscii
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
Exports
Exports
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 628KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
."Ke Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.#B1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j1p Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ