w��*)�T�|#��1�I 旌O6l� ,l-��q(*Q�g#w���vd*E�|��0��DB��jd7{�Oq�'�uY�֮ Ux�'��5J����w��>~m"c�J�zg4a��ԓ�b&�9�6E�f� �}S[�F�G��'���դf2zQv&:�W~aߔ���5&� J���cf��ㄬ���5�����`���]�xj�� �kt����a����-֖��n��1�ֵ�[a:��\�)�ۂ� ������e���C��m)�#@_V�� �|g����s� h���C`=���Ə* ?��}$�0�5:�](Mc�_��D��:ݨ�e2�����^(š�b"]Dj<A���}��^e��~H�R�T����n��*O�YȤ� ���lʼn7���*SŞ-ڒuK�D��w�1?��>n�y�6���$�$-�Z�}�A����"�㡠�����i\�9Rpnk�B- d�)��|���.�6c�h�L|���xW����������̞�gq%���D��dl�b=v ���ј,�"����s�3�������q\�h�JxγZ�k�!^C����>"�#.Ʈ�A:>���@������%d�# $W��e��3f�9,-n1�?�����B�.���L��dgs~�d���Z`r9�U��F�Eȉ:���4G+��LJN]��K��=��0���y,������9��A��DA�`3"`N�3��A�6��y�A����Ml�bH�8�*,��&'1�$�J�>~ۘz �JC�o�,y$ҷyQ�o�]dA���T�v}����x�P�[/����d���*p!�+`�GyC��&qc���ʌ�Xs�����բui�U6�H ��#bKA/g��C ��5��{�iRF.��8{5���;�ZFu质6J�2ڲ?��儺���E|o/���oӢ�azD�ä�2ʯ���������O��;!Ѻ(!��{s�J���ϟ���솯���4�ۉ���Iz�&���u$�W�������!�8�`���z�9e�D����J����`�9����'���uM�j�A+ =���3�}\ry(��x2 e��8��x���٣�妔iG2V/���hΒ�Gxm:8�>��]���]�RWw��Q �2�AjDұ x�&֑����I]'_�����3�E�;��R��qn9�����2S�~]@��}@�)r�<�]�����>���}W��L�+��?��?�K�ɝ9;����1A�Y�Q���>c���ъsz�>���7V�gwI��\_�ح&w9P�H0��Z6��t�c��פ %������ Ƞ�����ݹ.CX�X��rFbT�=��ty�e6A�n����[B{��d;���=�~�p�ei/>6O� v6��8�~�@�o��n��oOC��F�mH/{�V�[C����J>Gp�w=����ܤ�(+��V�P8�[�Q.�W�q���u�X�lZ�� ����W�y�[�&���q�V��O=� OT������<n�aV�ڒֲ.&l}#�:�GlqG�<��"�|��Q�A2��3ⶻm�M��� f�W?j*)/�B|S�Y�I��X�,��Ui����J�V}�.��+�G�S!ؖ�Ki�i��z<7���a^=d �[���"�_���������(��Vvu���%'�8�P�������{"�ba�e^:l�KH[�O�apCֈ%Ȱ����!w�`�y����"�́in��2��-4�؛䮣D1�O���LY���j(�Q��Y�S�sM�ff<?W� �{} �,s�}O"�џ#%H��#����)@& �4�N2�ܨ;^d�:�V�)��Hw#�ӡ[�?����J��, !�p{R�P�P &�<�9�1��p�i�T�I���d �0�Y�4y��İ?-���G���j���������T��{�D#�L��C���*��YvuM����l;? � b誜��ƣq[XRwM�8�����ě����C��T��Z2��z Ϡx�B`Q�;7�!u����EXcyB��� $�#��i�'�u�f��.B� )�c�i`Y� �� ��%,J�X���0�瑱x^:�e<9;�:���\~j<��U��� �*�O���{���'gvL"7)�I3�cq���w�r{����f�Z6t��ǫ4� wU�~\��u��L��c���#���0͝S)ٽR/t�q�U�%���{�~"���\�Ш����(��ЇӅ������}��J�im@G0��P9ы�^����A��D\��q*��>?Bl�|>�oE��J�N~�D:t�T)9���nװh�[}�T-�sTI�O��[�GF�j��fz꾒'�+��� ��W�]��L�����<���q*Ӛ@�+��㜊�<803��������.P�zO�ޭI,5��J�1Q#�R� +A�F��g}��r� 5l�s'g^5 ڙ0A���jh�$7od�����={��?�Ruz^Z��}V��%��A�5��p��t�3D�B �<�!�(�{��[���p~z��v�BK;ʹ��v �@�cuj"+�4szU83� j���ϸPRw'��qB�h]����(������ү�5��u$_�X\����,���Tq��iͼ-��c�cv��{�&��%���LJE�f�x�ٔ}l��F�r1#�2rL>< ��A�z���n��ˣ�M'ݥ�ܘ�\�Ʉ!��3�;����ݍ�>?��j.�5����Pp?6���P�'9,Ӧ���q,���g2���c��~~���!�A����~S�^�� ��۶���{��1�o9�@�y:�&A2&�V�,��K��>Q�Be�o���J�hw 2���C/s�>��#ϟN>9q�ފ4uP���E��q/'vNg(0���zl����'@uxA�+�<aƐ{:�[ڐ8��٨T��` �c:�P0�8I�⫸31�/~&�h4/ ����a/�4�|"|�$A�`��b�^��WZ��c�V}ɴ����M�w�*��с-n6ݾgW#!�)w#�ܱ$��7"���>�3�#�r�<�m��SS��ͱ���nϜ������jhll�Q��Ur�J�(,c*Ŧ-L���}-[�-I�����
Static task
static1
Behavioral task
behavioral1
Sample
ffdad52c3fd4ce357a76b40804aa98838c677d2987421c1cdff12536fb27b93e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ffdad52c3fd4ce357a76b40804aa98838c677d2987421c1cdff12536fb27b93e.exe
Resource
win10v2004-20220812-en
General
-
Target
ffdad52c3fd4ce357a76b40804aa98838c677d2987421c1cdff12536fb27b93e
-
Size
5.2MB
-
MD5
d6e1230205bf3f0111dc9c651206a9c0
-
SHA1
5b43ab25262f59deb99af71fa2b8057c3e7e33f4
-
SHA256
ffdad52c3fd4ce357a76b40804aa98838c677d2987421c1cdff12536fb27b93e
-
SHA512
7ffe8f81fe780fbef572bdbf03d52eeab5360f6f6783d52084f0db1d060e543d352d86765fec5b5a9d91e9409a9ef0be8ce679f0165f2187179bcf58f34830f3
-
SSDEEP
98304:TpIM+sno8rCxQQP8vIyygCqzYGJhn3wLSEycb+WgOgLkJG3t+kTBqZmT8EDvMNEP:Tp5no0TAKztZ68LkJG3t+4BqZmTNl7q5
Malware Config
Signatures
Files
-
ffdad52c3fd4ce357a76b40804aa98838c677d2987421c1cdff12536fb27b93e.exe windows x86
ac3164c2f8759b9100abff0b3ed8e035
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
wtsapi32
WTSSendMessageW
kernel32
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ