XȵKg$3�'y��rd�8����� ��!Rs 䝑{��@� �Y�*���"��Ή�4�5��tC��� �\|�L������.��st�)�{��2b'@�AFx�����Yg^���qؿ�^hz�r6Έ,�W�Σ߶4,#ZzP$Yۙc*�tѰ���D,\�X݀g����0)�Ɨ�b��+Y��{4vX)&�踆i'��7;��A�� F��o�Z!�q_p��Ni0蟤��t]k��|��Gj$!8J�����9�N�cy��V�Em _�����.�2"m�]e�xg�f�����<_��ãسF.��w��.�d{���q�������k�� Q��RAF���&nCT�����j �웴M7�&��ӔYDӣnjA��)�XY��9�"��[E$l�+�m��Z��C��}bA��� ���?�B�o�lg��kqj�a�wD�Fʼ+�M� �M#䊸�^�8<�E��/�Z�m�o���-�(���i�!f��̉��3%��Z{"�`g���Q�� ��G�ˆn/�,�+��G��f\�#� �(.v�$�I�*#��~bcw۪�kco94��)��zwƦzV����'��/X��,ق���|(J-)�����u�*��2I5�.��m�F�&�T�O1��֚d��� sHeD������I^H�1��4^�4�ʤ�@����`;l�S`�$P"��ҞF���wD'>�6�6Ap��F��)'هM/�w�)n�O1#S�["n�ٺSY�l��eµ�W�kK���%5&^7.��Rt��W��5�S�����@�%��u�Q�Nߞ -��ҏ|]�X}����W���K�����w�-�w��O�e0��;�*PA:��R��mY���Ȣ��&ez͊�Ԙɼ��<��b'�R�h+�1ћ��7 ��S�T0��n�.�����Pp��}/@��o�խ�I���X�\.pP�5E�R�IeV ��"JE�צ���y��z�ȁH���2=�&Y������������o*4�{V����U�܄B� $�K+���'�ba�j���ⴓ��_Z�D�!������K֊L��C�y��g�r!�X�F����HL��=�*�� TZ�dS��Z�*���g˯�Ј%���N_�a�FcqJ؉X�@MRd�����:����%�TK.�����_�8E~_�l;�Xِ�ר�$�n�M�m��N�f�DH���4�䣽j^=����p������;�����m齪��H�8��Y������0$봙jx9.gHs���*W�_J�8���qq1\���g>����lZ.��66�!�¹b�zL��vC�Q� ��<U�L���n��vH��IĂ�֪����n;�v�g D�[�vx�DŽ�G`��պ:�ܤ�t<}�C�G��x;0�%�p�2��^jX���[ܬ���ڡylʹ֨�N���j��f��ٹñ�o�s�ك����~T��-s�A��h�����Ji(2;�E�7.t�Φ�@�L��9/�L#���yrs�Hl���z�_��<Pc��Bl��G��[�@�;�Tp�t���Bn6��K��I�[CȮ�g���Gf�B�ɮ�n��� t$#8���5t�-��6-��\�Qk,���1����������j?,�Y���^O�������7Ҩ@W}�?j���-��S?�0�z�g�'���#�kb>lC\Us:*��nn F�n��[ �����@�G��OͰ�h�.�K�����|�-mѬʿ�Z���RfAD�I���!�ZrXb��Li�1?�h=;�6 ��P!����x��:�-O�F*+����jd�hD�w����������o#nGL�U�˜����S6��)�ԕ�;�/ p�%%���*D�:��r�m���s��瑭�7��h~bI�3P�>_� �+A�o�_�TT�B㔜�l�UҘ�K��10��~�Ox������jj NZ��o����+��]�Κ����-B�g}�r�*��K@u���B�L���R�BJ/:�y5��?��4�#1�'4�~�z�dЅ<_���i�����>�� �@#�G`�M ~r�����#P���&>t����u!ec�OO�q�3��,�|x��(x��|C�-W��L��s��щ����0?!��QAL5G�rd��saB( �Q�qL��u��)� Ĵ����� �d�ϑθp����xC/�����[2�(�<-�T�'#(4�[��|�9��R��.�p�J��W�+�ͮzJ�f��^� &��n���SJ[��K�MRʏ��*��|��39��KI�$�7İDND��T-C�έ�Y�b"��Z e�X<��1�p�#��tQ������3<@�r�U��uGk6��Gbݾ�NoV� DF���0���Y0JL=9)�A� ���l弋C��)�ø% Fg��v�'q ƴBɕS,N{�tbi!���b�}�"�YMg�0�����(z}�g%@8�&�w��>��7<B-K/�H57P��C--]�W[�(���^N֎�n�Ϻ�D�H6ͅeL��[Lw����qj���m* B`F{O}X4:�ѐV�~Mp���NYG��h���q �:���<2j����caGS��W��M[iA�ؼ݄�E�V�B�ORø�p����U�I���u��G�8T�G��[�c�W�c�.�m�2��B���&@M�Q��xV��o���0$De`V��/�bY��$�;�ӐnD��ə�����W��)�6J��N��ހ��3g�39�J)�a��A5��Y�%�b'�>���jA<�t� ����m��l���y�AV��*�Gj�[0�*�=����L��Ɩ1?���n���W��3Nj&Qnrf�VۡCʹ�P_�� nu�&�5�K��;��V�b�ߏ/��o��o}-dx�kn��� �s��d����E<U�z��*c)�/a^B�_T]��-����|�c�����8[�����B���߃�j��`*}�W�q�"K�ͳ�7����̆LQ ����x��̖k7֬�J@��,��������P����VF�l�� �no�|!9�dxٷ����~�����h��"Vl��ƃ��߽���!O�I3�F�y��j
Behavioral task
behavioral1
Sample
04967fddf17101e1fafa9c0f8bf94c2c43f7742f02413fe3c0dc0db642374dd2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
04967fddf17101e1fafa9c0f8bf94c2c43f7742f02413fe3c0dc0db642374dd2.exe
Resource
win10v2004-20220812-en
General
-
Target
04967fddf17101e1fafa9c0f8bf94c2c43f7742f02413fe3c0dc0db642374dd2
-
Size
272KB
-
MD5
09b477692c95ba8fef4ee04ef8b5af2c
-
SHA1
e76430f53629f5452729ce6aeee723b3445dc00f
-
SHA256
04967fddf17101e1fafa9c0f8bf94c2c43f7742f02413fe3c0dc0db642374dd2
-
SHA512
e8d268e05b0a7402a1909c8f5377ab4884cfd3974bacf09d17bf442398d30fbe594f408c286e10f158204571a3c280818c03362855b277ca6847a5363031f143
-
SSDEEP
6144:5q6fush2UyxgWabamtgBu0ZsmQyVpfwp0jlmDAdw69gVnjMOa0sR:k0ht6za2mtCdRQyVpfwpjDb6OVjMOvsR
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
04967fddf17101e1fafa9c0f8bf94c2c43f7742f02413fe3c0dc0db642374dd2.exe windows x86
fba380078c431d31c78e827c57837df8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdiv_m64
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ