�O�hGm0������&��{�qb�h�S0D�(!�Ԑ� ��6��pm�e�>���S�r<� D")R<��aK��X����f'���s�]ʙ�LvN��h�¬�L����l,5̞1�Q �k���,<����5?��N�sR2;1���|��yy�g8=��9�� ������}7DM���x�/W�EҕA��u����ĝo�@�FE&Q3O�k�ݭ���������F��Χd�/�#[Xb�>~������:���i�+WsM��/c�����n������U� hI���t��$�g�o��o19���Ǝ�i��ا�3�j��:�i����.��^#�L����C�q��� j�]̲���B��7����ՙ< �����r}����l x8Ain��6�:T^������`� j*s�`���ݐ��Ѳ�g�k�ǀ��3� ���F}�Tl��T7wV%�_��ի�U�<$���wɷ.��ɍS�sz��-puA�Mq ԕ%o#�5$�F��kI�����1��0Nk�R�^n�!�>��p[�%�շ�֝P�%��Qa����tk�z��UEݬ<%ξ(\�5V@��UY��m����M�E�#'��`h�Mg{\������uW���I��[ (��S�i����q���̱S�V��6���:f���-�3ĵMϮfqepw�a��o~K�J����Mb4���>H��gz��/��` ���șJ�����6ܙiA�\q�Mc�Wm�W�/Ks�bk����R��HՓ�D!�x�F�2��'`� :7�6o�˒h��̉�L��@���^֢ٿ���Yl5� S$<���}�h�}Wij "��~�� �uu����E]��'@&���M�Ѩ�����&�η..�d��:u+��)(%��%]ߢ�dAF3>R xvs?��͗-����QY��54��r�%n�0K��f��^j�-H��� ��DA3����k���G�nz���f-#)"��VO��Ef������*"��8�c�u�$�TJI��NVSk�P!wt|Ɋt�\6;�ί��k�p��!�=�e3k�^��NA� �Ha\��Z�^yF��t��F�=�C�Ka6j}�%��+���]���*Z�ح�s�#7=, �O���u�|b�����q�"�D�1�+�ι+0`�u���G'���w����d�.9'}�T :����$N��#�1uL��U��!�ۙ����Q�X>í����lֆ��[�L�P�q�W��g�l\�R�%~;�4���$E�%�+��G�')�9.����bx8J���bl>��6[|�Z����(���F�gYT�Hn����DHYf���>w�)�`=���R�?�YL��.��ٹF��Zh���ߕYP��-��r���dz�*��� �����v�W�,~�7����%N Ps��;�.$�;�T���SpC�3��+ˎ$�ُ��.6�ʞ���t���>����^A5�k��öK~�f<�4�_u�{��**`Ϧya����2��j6K>�2�K+ޤ�nF�����ғ @"Z7)M�{���������w���1�K�ujS|�ҏŖ����h����L����ہ��6N�[8jn�j �SE�n$ 1ƫ�~}��/0�'օ�cQ�CE?Wwʡ�*<^Ϝ iP2 r�M�����Q�MBc̺ELT>�P�` �Y��U O#鉗�=XG�=�M��F6�|���Ѳ����y�$g>��A���o�Pg�����` H˂�z����a%������.<���tn+��Αh}�ҥ�����B����q�Fέ��!(�-W�]���f��қr������>8nsd�H �� l���f�G� i1`�>t��/���P��r�*i���M5��H��Vְ� A�+8(�-�|g����k���O*��]�� -��=l����ư���]��~����|�U4Tp�e������xO�:���0�?�p=���/3� b+8�������D��l.���$Ϭ�O�\"2� X�8q)�� ����بh]���Zo�օv�LW�-Qta4/r�t��1Qk� �D$V���"���0?Ƌ��d����\�I��| }v�ti�A����r��OWH��j.,�s[��p�j���A��s~3�/Rh뷶���̰.;�Q�x��#�I�Ū"���[��;���8���t?|L[h�VGA�d$�����+|�u�\, �T�J��������)��X�Hf�n�T�?^�����W�A�+ŝş"�|6O��CmT�M[�xo0J��6��L ��w�d������l��D�����Tm�'voN����x��9��k|�#qSY�������*L�ˀk�>��i����=�~tĒeq��: ����~�F��^��W��L���($H����8vbz���^�������o��DZ�v�xd��-ؐ2�� X&\.3Lq��o,I���A9 D�w ���B���L2p����/��������+90�.� �u�5��hPiʒR����Q2.�p���8Jj�T�b���,����#l��@tC }Y@x�����5��j�������̍(p��0L�6NE����U?C7Va>S�����!�|6��T!�hDR���iF`�������R�X�:���s��� ����xԼ�M�� �4�� �&\\�ؑ��Tr��@lp��/���č��Z����g�U%Jh�T�������Y�f�v��Fv��D����jW��)̪BA�W+ك"�i��sQ���JFX/����&U�֒�9 ũ슷C������T�������,(�1�t/�V�|Q��m6DFz���H�iN��B��y��������=�\`���B�q�������~��u�e�Z���h�d�a\Ӵ&~��OKԎ�Ȟ��+9���/�G��N�pn��g��k �Ң>Y�ng��?.�D��B�+����SIA[��A%U.���L��� �𪐬������8H{�f<�go���a�Ӣ8i�u��W��t墊F!*U��q�3�0Q?M}I�)H۠��z$ �3���)iv����"}a
Static task
static1
Behavioral task
behavioral1
Sample
7a70dfd3b34510e2f70f616b0d4be20f58d3deb258ae744bf84d6f11f88f0f40.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a70dfd3b34510e2f70f616b0d4be20f58d3deb258ae744bf84d6f11f88f0f40.exe
Resource
win10v2004-20220812-en
General
-
Target
7a70dfd3b34510e2f70f616b0d4be20f58d3deb258ae744bf84d6f11f88f0f40
-
Size
493KB
-
MD5
695091e8c9819820b5d1554e4955a0c0
-
SHA1
ce56b0f80e8d5daa69f5a9ddd407eacba8053c62
-
SHA256
7a70dfd3b34510e2f70f616b0d4be20f58d3deb258ae744bf84d6f11f88f0f40
-
SHA512
80428a872f77516831957441284662cd83fba1729cd38880228e9218337073f6f05a23bb63a587d1b706f02df37b233ea313d749cf686f43d1bd43e8f0fc1a29
-
SSDEEP
3072:wLE/mNPpFhIj93NdXmSo8Xf5MrQ/M3dEGUZwa0+L4saai+4ZElnj:wbDel/X5XXf5Mr13KwQtaai/ZQj
Malware Config
Signatures
Files
-
7a70dfd3b34510e2f70f616b0d4be20f58d3deb258ae744bf84d6f11f88f0f40.exe windows x86
b5bffb5c7786a616a50d9300571a45be
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohs
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
dnsapi
DnsFlushResolverCache
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
mpr
WNetGetUserA
wininet
InternetReadFile
msvcrt
free
advapi32
RegOpenKeyA
ole32
CoCreateInstance
oleaut32
SafeArrayGetUBound
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ