��8E:��춑����c҄�< 6�)�q8��9mB��$�>V��95:�/�����@�m�����*�����ƛZ��קQ�0�W�ӇX�$XQL����U��#kv������bOد�p8(�ͼ3�`#���4��:l�5�Q���W$��H��C�}��ryȜ���\�H81��� 9�"!�r�(�6=HV-��*4+ć�o[�p��1ۨ.�xP�5�ƌ��`Xn����"�~))���>^ �-��1�"�e�)mձ��#.�f��p���B��n�����e�~��T!*2}��Ap~��ϊ2���1GöeI���L��� t��q��.��o���`P�S�$q�g���Q��2�� ��aڽ9�sZA��U�ϑ:q��=IA���Q�f��[�"6XR����h �T���rN����kN3�|�c\��eW���蹁�!Q�RP}���uwI�R���X�a� �����%ZT���W�9ʖ����<����-e.z�X��l��X�<ZzU�LN����!�k ��!/��-�*��?}V�E�M�� �5��&����������ll�n���?-�E�4QX.�>lq�_"�J���t��Ym���|��GO L'���rc� R�����#$�5a�/lU�H'�ي�p1mVE/�Q1�!{�8��uR���w�%gw��k`�Bh|����{�����G.��OW��-W���f����y�<}�j �� ���zu}�&V�%X��t|2����!u�����^��g�pY�~P����:��e*)8Í���߈�,N3~t;v����5JQ$�� _E,�xM��~�{�d�Z��9�����R���0+�9)�.+Bu�� �̑�D�!�����+"��1��� ThKqV��쒦}�@Y���K�*)jw�d�q��~Is�p�3����Ҕ\��?/���� c��&��3ύt��'�����B�����_ԏ����cE�:�����R'����`�6�_�He���Fyx�����_֢�@/���b���၉�;]=�]�(5��,\g�|�' l �>�N�`�,���On�NTɃ��0�!G�9B$n]<Թ��Ɇ����e����eW�η��A��+�@9}�����]/�5�ۇ�R�;kt������R@��p��{����ֿW����4�~�{-w�e:��<A��evm�/�H�K��3lk+�j����E�}xn|�l~FF�5«Z~� eT|ўs�4y��/���m�E$B��N�AaR�xv�Nu����N��5B�dzŧ6�$�qd�P�X��̦��zHKؕeٽ1I���b�z%T��}�b0�3oʶ1���v��D#8���x�-c���d!,��'�$�;E���J�Syރ�����IX��-����m�bǩ���"#��Q�GNV�v�Ӓ�ŏ�xȳ����q��Ʉ�>[pWX2�FJ;��������#p%ي��S���(�BQ��.p�?��Y� W-ֹ����fv�D�G��~��;��� N3�D"I挸Q�;���@[��iO�DY H�5��J/�D���;��k6k��N]ܤ�UL+���\�r��q}�lȣ2�EXGgҸ#|G�fN�m���l�0 ��J����� B0� G@���C�V/�������y���zmKkO�"�4h��k]��L���@~\<RI�C�R�9�?����������F_Kb�{T��������*>n k����|��L}N�ǂ�����́���a�d4�\�@��G>����6"z�䝰��I��i�^���)�[<��[�ߍ��n*�{������1C���5ɔ8�٨�|��)d��D�c���ӑ�li��OC����K=@�")�Uu�+�p<�z��]�VE^[��g�����3�t5�� 'ek(�ql*�n�m��1N-��Ma��ޘ��� �) �bl%����y���]��.��{j����fլ��$��H���P�(x!����u �$J���B �>�i��m�d��@ˎ��p�h�j�<z�m��ʊb̿����ނ�Y�͖�t���N�l�3 �:��e#�V��K��6&n� �.�ӿ\�~8�����a!Ce(�V�,�ep���0���g'�����ME:5#BZgZR�{_�����}3d��i�(wE䅞�sM胃x�؞������h'�4��y'�<~�Ʊ�@O̦)�TW:y<��Em�U�fQ~=�U�6J��.8=��6���&�E�6d U��P�\�)&_u<�uF�6��nv�D�-Ƈ��RN�TA���V�c"EG��_����Y��5.C߭�g� Q$^���t�@�B���N�huy�������3�/4����^hr .�#�9�-ז5�E��ɲ�2�1������x��x�5n�� ��͞ e��=���5y=��XFD�SO�BQs�t!�c���25���Ra,�������W��*�`*0t- �T�!pG�q~�%z�c#�t���o\C+�tc7f���+��^��K%jAZ����� Y�a����+�'���j�'�)�7>��h�H�ǝ]��W�9⾇(_���=X"����'=m@<f؇��s�`�:�19��R����]_5�{�[��?�EO����3s�P�%�����R�kM����J)粨Qհw����_F&������T�� �����jkV�K'XPo�,�V����G�Eڝ!�?�j�l���O�c��V"�IU�~��j�f�ոĊ�mGj�1"Y�ء��g\ܶ�%tFR��J"�Ω:���o��ۏŚ;���(����r<E..Nib� J��<Q`���s�P�ڎ���]�>�_�����j*2h.P����)��Ŏ(2��0CWO���h��n�����!�4s����m!e�� �� ϚS^��-R��<�j|?��AeKb�j� ��T�sh�fBϏR���� �8hky�.��Q-�,no�;RLn���I��O�*���Bl���A�;�yqq<��pͣ"�X�����[���G)������ꈞG�'���[�m���g Ƕ�SN��H��P�
Static task
static1
Behavioral task
behavioral1
Sample
FZVIJHEZURZKJPV.exe
Resource
win7-20220812-de
Behavioral task
behavioral2
Sample
FZVIJHEZURZKJPV.exe
Resource
win10v2004-20220812-de
General
-
Target
FZVIJHEZURZKJPV.exe
-
Size
5.7MB
-
MD5
63bd5dd0c373d71be1fe2db900b7b9f1
-
SHA1
9f8860ad6cda1bcf9c0eaf8dd3befb1edfd31995
-
SHA256
595e7f0ec2757381f721ae58e94c32ccc87f222628142279f4a49d3f6f889405
-
SHA512
082f9c461fd00677a407253988e24750d31d169f897a1c2ac3ddc61d87be3785a92b846e89af75c0d0a63033a84a12eb59e036d3e37724b78e5aad46228fef82
-
SSDEEP
98304:pOMN84giIQSzBEvqeIAVOQAZ5loXMXLeOFKfZ/GlGH9y6bUunJRAmbvhG3fXSz:cM+0IZBESeCQAZ5loX5Zf9gwFlJRAQvj
Malware Config
Signatures
Files
-
FZVIJHEZURZKJPV.exe.exe windows x64
8e1532e741d8d55b9d9cb20366128b60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
GetSystemDirectoryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmGetContext
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
d3d9
Direct3DCreate9Ex
ntdll
VerSetConditionMask
xinput1_4
ord2
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertFindCertificateInStore
ws2_32
ntohl
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-time-l1-1-0
_gmtime64
advapi32
CryptReleaseContext
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nig0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nig1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ