��m��(�v��q��<�A���V>��ol����&HN�wg�:7h +�`?9���t��T��~\��H BU�n�^zuL�oޜ6��/���ڂ\����B?>��A�̍vR;{��~t ��f�O������WB����q�ޡ��9ƥ���S6���McV������r-{�îcq���'x�����Ek��>���w���%�B����jl�T;�1h+Xo�,��7Ĝ9�#�[Ўzü5j���!�g�O'�^R���ti�1��g���&Vo�h #lI��J��?%'tu*����E�$|#2}NZ�ɫ����^���mR��,G�J�ROR�'��+ڢ`����� ���H'M�B3R�v�#/ ��b�a�/��L سp��WlJ��sV.����y{�� � �p�j�_)�[Q �#�zut�`��i|�k�����=I�HRXS6�knH�����Npe7�D����*�_�7�ؒ��2ፖ�@��S� D�Pΰ�FR���6�;o�ކ��Dq�$�U���G~��!��K o��6���rU�'ƍwe$�_9�w��y���F������QwW�Lr�da/���!�~�Gk}�#wƝA4VxT B����J8��f��� �S#�t �3���_K�1]��~�q�XV<����?� ���qW�]y�`��cO���ő����R��s�MFƗ.AV�����N\+��L�8* �z@��nH.P��N�FZO�-O��w`�p'E ��f%�kN<|f�An���]O�� ��{�]��Q���T�ko5H��5�.���T�Z��\R����j��X#��{��A�C���u��t�}����;H��C��ܶ��)�$�J�6���:�*���W��� 0Q8�ft�N���0b&���3 �hw����o�F�U�w�W�v�8��t��:�1��^J����u�M:C�+Pe��$�}���:j�z�������A����ug�Z6���1u�-�Dzj�l�{4B��-��.Dy�A������ϫ����x�2'���ԇ�Q�u��N����O�~�q�����miU��(�_�B�� ���a�e�{�~}��7!N��Wb�ލj����B�Ok{�]��{��ʿ�C�k��� L�Z:���mp�^����ѡ��,2y��]ӗ,��\ ��F��2ҌL�� -4����N���}��Dz��++TO*�G��D��8���&#]����Jj\���@D�D0��;�Vm��*;\�$���p.�����=]7ء�`��XX�+/l�����(]��Zn�! �\¼�94>�N��p�n�V��DC�a��-���/*>~�:�F�K��T��F�Yn�D�1�Z�̥5��$g�X���NT�T5jG�˴��&�&uXW=촡qw�f�f\G���X�D{ ά��@�'������j���]Nຂ�I�,d%���kP�h;nf����z �%Ӥ��0�w,��W���H��%\x6�<w��G;�X��������������>�c���� ��I�V���#��+���T�9�ʚ>�r�J�(7zwr�̈́2.��<ZhcB������c����{1?B�GG�0l� Q_��9��1k�V��^�0,�P!����V�3=��#�1�U<IR������r�4gM~ �V�(T��3��fL(�6�|�6_~of��7MtPO?�e����'�Y]�����S�=Ӝ��m.���d��W�>���n�i:n z���H�������Ml��<���jE'$:��8�Phİs����H���.��3�U��{x�ߠ�9�I*ޝ��x�^������>���}4�5�f��[)�n��g�0be����e웑�-X��rR�|b���`C�d��twf���D��>����0���;=�'ab����� !����'xkdž��䜧�Z��^�B����Ќ`�������`�δ��kJ���"�4'�E B�?��DS�u��/k;:*I��*T���;Q����V�9r*�mbO��gG&_��s�Ԡ)�n�H0��v)*w���"�ƭ�eq���iQl�_*q��Q�T���mQa�&����>�I�R�K��G�u��\�Garo����3��-�䏜r��:�BK!*����e�ׅ��Q�{��/Ճ�^&e�������U�I\��aQ��Zm&�[f����?Dn�f`��X���0�cIi��3��X������o� ��F(�����Y�b 9{/Եz,� u>�)�}��mOE���P���S�W1�e C�N��J�lT#x)��� ���(�y��'&�>{�K,�0�_��o�*_lj������6��M��9}���MQ�(Y_h�S��������4-����l�ݤ�q���Q#&�{e$'�W=�)0.Bk��=XV�8��-�R�jH*R�%��LUEy��_�ѱϬߘ���e����?��Ů�͐6�oE�C�Cl �88X&2p ZSu����@�aPI�䉛)����H�]Y� �3�1D����:_��_j]��K�dL`����4���q��q���댮��T��XP Z�ӝp��h�/J?Ř�Q{�R��5�/�{F�L�1��gJ�e����J�l�����'�8Xjx��)�˒#`7�a\���|ѡ��9��Յ1�ӂw��Xs]�͇y��o�����_""�����U�"K����BX�妢�"�+S�B��hF�#�����-��������L��nWQm̹��>a$��� �� 5s6�f ��L���^۞�h~W�~�/Τ������. e~��p(OCeò�8��� ��r<?��"6�la�����0�B��P������9����q[�:���[���F����OC���UZ���3�����3���������7�%q�(�U�'?̔6��J��`Xh��5+8�.�Y,��E�?T�ϕ��f�A�)~��=w[c�&�̼�z&��VG�&g���t���=�ɛ��bN#Hmф槐�x/w)�]D�N��˹���N�1W�:<�QDG����������ވc�p�SN_yV���Գ]t����D+�/J�:3 �2�
Static task
static1
Behavioral task
behavioral1
Sample
d5a91c73379bc4ccd357bf29402152ef2e19a239f0ed8b4a5974885be393532f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d5a91c73379bc4ccd357bf29402152ef2e19a239f0ed8b4a5974885be393532f.exe
Resource
win10v2004-20220901-en
General
-
Target
d5a91c73379bc4ccd357bf29402152ef2e19a239f0ed8b4a5974885be393532f
-
Size
408KB
-
MD5
08540a9efd203c345200cb2ff177a830
-
SHA1
e26be6ad37d3dcabafe010cfca97056026a16d16
-
SHA256
d5a91c73379bc4ccd357bf29402152ef2e19a239f0ed8b4a5974885be393532f
-
SHA512
e85defdfe12e72eb5c02d3cd2f5105691146e8ad037b21baba2b8c029c219979839a1c84e32763057ca0e9b3322a81964735ba1a58f594d442856537f17e2c28
-
SSDEEP
6144:l/YRm9opOqYA328UIsNRxob1KR2TXj5Ey7xHyFI1nlLNeHPbPSA2LvfXZbBNk:dyxpYRzDxrk7hyyZeTSHv/tB+
Malware Config
Signatures
Files
-
d5a91c73379bc4ccd357bf29402152ef2e19a239f0ed8b4a5974885be393532f.exe windows x86
4a73cac585a5e6a6ae1cc722227836f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3081
msvcrt
__dllonexit
kernel32
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawIcon
gdi32
SelectObject
pci-dask
DO_WritePort
wsock32
closesocket
winmm
timeSetEvent
advapi32
RegOpenKeyExA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
Exports
Exports
Sections
.text Size: - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss0 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss1 Size: 376KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE