���y�,���n�x<T6i�E,��La&�VD���%RR�?��Ѱ{�tf�%�9�P͡�JZ�|��^���������h&�Y�qV�W�����]���q��;$�_C@�Mi����6�{���͇otT�+E-��eqB��3G�8a�߭>��HPrw�WD�U��s�2�T���k!Ϲ����ot�`�ч)�&�)����Ⱦ}�N��ȭ��hd{���J�Z6Qg|����_51Ǎ��$��x�c2�������B�X1�:m�@������ip��%BP�*/��%��lƶqX�(�o����y]�C;�R�汸s+�hk�k���*9��ph�i+�7���j�߁-�)>. ��r�����l���7nA�@�~c.B���J�c����G�]߯Q�-I4�D���x�/j��T� A�p�Za���'6�� �9���]&�����& �[FJ�e:{B#F��,��Z�RP��Č��`me�����d��d�ޘ�M�L1�.�m^ix��*|����ۡ��-�A��!7gb/�≉v��j�K�����,_+⎴������A6����Ԉ�6�����Raޅ�+��Y�z��oɼ��S;�43|���� �~M]���%������ ��G�Ғ��R���{ܩ��~W�qu�n52�ȇ�,�=J�Nn�P�U�hFÔ�p��}��^�����i�_�~>J&���Ӎ�,�>:A��6���&��qT� �gY�.l:�6ѻ��#�p7�R!�ղe�=��i�����Yf.<�}m���<v`z�a+��gP�uh��:�(��2�w� ���Yb�3>�� ����|�I��+��P�/�mJx<4P�7I3F�3��W�O!��]�tXJ������w�f@UB��4D^��V����eU��亂��Y"��������!��dE�H (��l̂+U�Iيzt5�Ȃ��B8��ʾ���=^1�hP-��p�[�8��I\)�j��?�V��Yғ��ْ��OC]�:��S� �L��^��F5O~���Eua��4yuQ����51tDAL��}� �#�ۄw\N *8?O&�3�{~5R"�z�RWb@�M�`@9��Q��]����<���b,!�����J.�����c����j�5��C��Bh� �yc`���7�<�H1s�>ޗW��s�78���F�y�MXب���ZX�Is�۫ ���?�o�#���=�2�M�H9�I���m��wx�ew��)Q0�A�m�<� sn��|_�Z� �C�� �g��?�á>�u�W���^T��1D�T�����������Wj�Buj; QJ����� ���QC%f p�X��,�Oi����{_�>_�x��<H (R&umg�F:m�۶+��^/�ʔ�4�FJ�ǭ��a��bY���M�9q�L3tETs"�_����/�ItZÙ���Q���U;p�?����̇�H7���a^k�G�[� ��|�}�&�|' *j'���u�������LXx��7��� �|�*��d�B=��}8����>���������O�ˌ�v�o�����ޒ̏���w E�כD�.����y$ �q��US��|�\?^�����d+�g|[���Ҹi%�͟_���[j=Q���nߩ#4���?kx�����(��]F�|�>�Y��W�]2�IV-�ٝ�� �jW�정���%nC3 �t+4�c�$��� ��h����&�>��Is�����O��w���P²0������В���ܔ0�P�,���|{��*!�tv�����8��|�yP����{`�^�����DP��p`˰����h#d�쬚ߤ�աD� �YI���x�����]y+D{�L^�P���Pp�F��\|�z�n6-M�y��z�/Ä��dJ�����D�L�d�R_�9x�g芳�TLP�ex*��n�H¤�o>� ����{�Jn����!~�{�����O��Z���4��~p(�|�W��9�Ư�tC/PP2.���!��jG G,�1IT$͡�U;1�I�i��A�jY�hyZ�e�$�}�O��ְe� K{vz�+�ECf��Ҕ�!��O�.60��[�qÇ3�7��åiW��YJ�,� ?(����X#Y=+ln�W��c3]�i�RX8Тnƶ�6|_$ع�)b��^�1��">e��~�������˝���m�w��Y�Fj���� g �u_4��-��x����)�q�N�%����ZFi`<�,��f!�q��!�3A^�����A�h�)�v�3�i ͻ����l�[o��٩���� �Ӗ�E� s��!�}P�������_��[�����`�I���r�a�3:�d�:���Jx��'s���O�Z�y��-���/5�S�`yݶ��3`��|�ʪ�IOI���͇gEvǾ� %dN����U&w{s�-�=��Ƕ5d��|>r"��*�ޅ�B�6�ދ/�R��>������� �d���( 3K+����\���Sc��+zPTΐ`���fe��w�����`m��v8ō�:V"fU*Y��ʮу���⥚6�^��V@�v�8�2T l�I�%�Tw���(c��)�%��;vw��G���S�L�j�˪�j"�����s��Lx�X�RĽ&RU� :��O&���0�!�APgTұ3w�U�FSӗ^�y��`���ޘʋڪ��D:W��j�Z ��2��DrS�6.t|*@0������mʪ)��M�������n1��6<�ۮBR�J������0ۃZb�%ǁh��{�r`wn֗{{�{��9i���DͲ���aޓ�K�2�є#��Ao��.����E��6��k�Y�*�к�p��L�v��E�.]�s^K�h�Z셢�N�V' �����r�&2�����r\Y�D��nWy�B(O7��q���Q2e���o|^< ���D��7���F<��(C�,�~��w)6�#�Z+?~�1��p���jVϊ6�3r&&*A����4�F�7�I,�b@�E$;�n��<k�JUA�Nh�������M�ɫ��ۂ#@F�@|G ��0R%4�����6�+��tC�a0bV�X��<�����(�&�a�
Static task
static1
Behavioral task
behavioral1
Sample
798df1418ba88f61ccb01c071e3a0ce07731c68d4023f4a3ad7896b565b8be30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
798df1418ba88f61ccb01c071e3a0ce07731c68d4023f4a3ad7896b565b8be30.exe
Resource
win10v2004-20220901-en
General
-
Target
798df1418ba88f61ccb01c071e3a0ce07731c68d4023f4a3ad7896b565b8be30
-
Size
573KB
-
MD5
6e728eb4c763dad7a50a9e32757cf870
-
SHA1
17a869f3ecba91b352f067fa1f07f289d071f8f2
-
SHA256
798df1418ba88f61ccb01c071e3a0ce07731c68d4023f4a3ad7896b565b8be30
-
SHA512
87dba77987c68abbba68b89bae8b8169c35443fbefec093d6469e28275030a49c6f14a9018fca2ddbca56c545f05940dc109a5c66428dca41b83394576c42bfb
-
SSDEEP
12288:pLvdc/ECkmbIquntzaNswbsT3mIgWI6Kj96Fox:pzdc/AmzktmN5s3xV86Y
Malware Config
Signatures
Files
-
798df1418ba88f61ccb01c071e3a0ce07731c68d4023f4a3ad7896b565b8be30.exe windows x86
9792c7591cbe42e93ede8a0160a449d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetRecordInfoFromGuids
LPSAFEARRAY_Marshal
VariantTimeToDosDateTime
gdi32
OffsetWindowOrgEx
StretchBlt
GdiConvertRegion
EndFormPage
EnumICMProfilesW
IntersectClipRect
GetTextMetricsA
wtsapi32
WTSShutdownSystem
WTSUnRegisterSessionNotification
WTSVirtualChannelWrite
comctl32
GetEffectiveClientRect
FlatSB_SetScrollRange
kernel32
GetCurrentThreadId
GetACP
CancelWaitableTimer
FindNextFileW
LZCreateFileW
GetPrivateProfileSectionNamesA
LoadLibraryExA
VirtualUnlock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
CODE Size: 441KB - Virtual size: 444KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 65KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ