��_C���ii�^q�89����OW���` ��L�� �xn�33�An�a�ntjN������v-ef�Y�!���%a�l������}���Ne,.4�^�+s�1��"�b����V�.���_0�Y˪b����a+6�ՠo-qa�� JF��<��YJ�))���{A��C�-}A���)�ǔ�Z�x��y33��.�X\��%IL'hG�Vb �n|��}O��%K!^M9j݂��}����Gx� �>�jc1ے ' ����'T�J�T 831�!)�.�ͫE��GXM��dK��x\�Q<�A�wR'�:��X��X�.���Ƌ'�{L�<����W+n���,[�g��Q�]_OJOa������]C�Q�3�V'��2�#�$�bj�_!�5�h��3��(/��n%6F� ����cڝ�x���!���yt�\�S�nj��6��-�k���}�0��O��_�{�q3��x��L����������r���@J�6I��L�0Ʊ�M'W��l� @4 bB�̵2��k�@C��4��l��1��[2�����F�ЇP!�orp�N�&I��s8an�T�s�e=h0&��K���t�KC!�N���2Uy���z�<J�����e(�*�{��2�n�Ɋ�k.�5��R����(�(}�?�>�/�yWr/��F�S�&W0W�%�_zAxu�'��-���f�,!��m���_��w��G�����K8F�_�%_Ds��0Ul��Ka��5�ʤ��(s R����:O�fTNV��?���q�dzM?`42�b�OV܁+i��W**��(C$�m� �Z%MK'P^:w� ��H��0_��Va*(�U�6O`�k�j�D�i^�p 7ivxp藾s�=���$��N.�E}��J����^��?V�]I���[�[���-��p�V�_�� l�������7�ԡmc�l?�8�C����D��ld^�N�QZ�]�M�e�G���V{��n�m�748��t8�v81H#�h���δ�%OA1���>!����)9mן�)Zl� ��n�8�0]s���@L� e�6Kĵx(��&�U'����)#�����,⤑���>ܬ���3�����gbΨW� A>9�eE�Z�>�.��:# ��:�2���i&�0�5d`�ĕ|���[?�'�� ��ͱ��9'��M��h��c���3����2)����=�Cۖ㘱��q��Q�.�IX�Z[��� ���_��������I�,�Y�~��Z �_��YӜ/�?d��>B�`[���9/!b Hǁ�\�tк�Tۦ �"8���1�d�,�K�Gh�c=�to��pD�Jѩ�ʧ�G�#�9'�Y�ӆ��� ^�tn��o`�w���U KBp+n�ӏ��tZ��C�� �D�!�Q�0���q� �:�����������}f��hA+�Rt�%�!�b���V��x �Z;ϩ9��`�!��Ҷr���G�{���<�oi���>{s�-���v�2tMn'���)�Bᓄ���j�P��Mr��"{<�3�� ���Ъ{:��d�6�M���UidO������x�� �9������4ȸ�sK��f��ul��)@$c��o���="�՞\|����k�����Gah@�����R�e!����t���܇�"c ��p�ȟ��PƋ� �o���S�y������!�!y_>h����l��c�$ H�"9�a���?K#跚-OR�bS��{B��)m�UIJIגN�'Ӳ��/`��Ȥʾ����J&���]~���ay�W�K�#,����\�Ŋ7�c6�Wv���O��F�\��K��7n��2,���ix/�Sf+��j6;�gLK氎^���Gۤ�9���Y�g�:�y|���Y�{����N����F�s�P��U�&sl{���O �N��\Ld�Ɔ��A?l�H}�>K���P?jr�����X����#�r���fj.r��l}?�թ���p�ݼT�� ۛS)�^[��%?I~��NL�e��M�<x[@��_8����<cLy�����4����ً��RY���1�����6T�K���,Lu���rF|�q��@�h�e���C9��K�����V*�EI1c�V�B�CΣD�5��!�ֺ�������;p\�`�)4g/�R�.�]T���-��&99�R�$�cM���'������;�0-G����Q��AX��G��4|f������L���\���k3��O��^U���C �bjɈ�t�[��y�,�0L0q��:j������3��� ��'�9�2�v�ª�@�MpwX9 V��Li�d�e��@�Q�3�eB��zA�4�)7�Z��kj`�G�ھa�O��pu������g�>OƄ�����m#Ұ��`w��1���[�����?��(�����#���6��[����|��܃hF}8��G��"��6 ��F{�̵����(�A%Fy���Mk%���S3?ce���P@(�P�(����#�ms.����>;��{5vtYc͟��@� -ad����|��ߤM !�,2��T���Vrq��t�w�|����+|���k,k@��U9~�LK�*��r�-�bT�᳤FF��$^� -�/ϱZ⼩��EQ��6��Ҁ�X��z�g�5x�N/0)H�c7[b��L����6>8o��aVa��eƸ2b���Q�8��d���~����'�*/ɝ��*ߣNŘq�����pZ����J��b'P��s �[��k����}�a�ZS�KϹU�������Rh57os�W�i)�H�\�T�����qq2������-]R����X��UeY���xsb�Qt�������C$����s��glH^���4q��9,y5%{�w��%�sX*����,\I�L���S��7Y�8G������9��ER� ��!�Lq���P��G�=��q���?ʓO��@�GK����WL9?rF��X\!��f�=o�ך���S��Χ: �El1��l�z[?�S�:�!1�G���ȝu!�;�^X����z �*���_�nZ�F�,`�I�MȽ ��
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp
-
Size
6.6MB
-
MD5
9a619b78715b784ed801ee162514cd30
-
SHA1
523f138c7b0847ec3668ebeb63d7ac89f1505692
-
SHA256
137f888429094a1dece66c656564cde7d4f60f7b132c8105c6eaaecd95f3f9d9
-
SHA512
9d3a5bb0e2c735fe9ea953a7c20ae12a27dccfa651797ffbb8240d8e697958ebc0abde2c48de2b652936087679ca49a6f1c65929a532f04ac479aa7e7c68f060
-
SSDEEP
98304:79EhXldOyxZapIzPj2EtsQHOPgrs772BB4TmRaXv/1os7tVX946DeFm5I:70xgqbjPTHYyWmRaX+s7tM6Um2
Malware Config
Signatures
Files
-
tmp.exe windows x86
dafdbbc6109353a89cfda1e51dd5d507
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.S{R Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jyE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.L55 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 471KB - Virtual size: 470KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ