����]�_�\���B��*gm����r�ۚ�*v@А���Eb�ꄆ\Z�q(Ɉ��K��� �&ĂuY�%zJ&�� ��\U��L���v�q(�Ʌ��-6:-�h�f[宧�c9�C��_d5FS��DYbM���Wt�l�@���\H�|#�rXD�/Y�H1.��c^q�b��"��?ϱʏ�|��)�~T�۸OO�2�[�=\���m��Y̊�:~&�ھ� ���8�t) ��t�_�z�S'��l�2N���pu��tǖ ��"r <f8��ߐ�Mc�!�yC�/�������>!�u���H/�^���1����.>�q8�C�s.�1�v���,b�����Bs�Tg���і��A�F�)>�6#���ʆ�$}��T�xP)�����ժP��y���`�AAt!v5�#������x�"��S�sd�~�7���0����}>%�-X����-��-$������d�8���j����~�[t�.û���s��yM}��3�9�R�����������Ų�/�yw�;��ū�������z/CG<-��ڨ ������g�����w�"�3\?�9�`1��W�_�ݦ")�i�R�v�8h��}�Ϩ��V�`��p�j����N��0��/ ? �8;��MȈ��m0!�d��%)R�D�p�9FM)r����!I�[+�,��-B������.>�9�����t��X�_��������۸��a3����-T}���7-_:����HUWĒ���������te���V�뱅�_U,���� ����>;{���aE�¥��u��4�/9�.��,T�)�*Y���_t���W��%śΉ<U��R��%�a�~)�?4< (1˖�V����e�ڿ���6Ԙ�������`�x�2��ڃ�8ӱ��vD����(�?�c[q��圃��� ��y&GQ�l�TqJ�c>4P����b�<u�n*\ĉ��)����^pR���tA T�n3��h3ne����P��_8%�V������S��a�]jx�C�3�y�R�cϿ��� �*w��@�jל�z���닐Gގ, �Dف���"�lk��Js\�X~kXw��I懛,+�T��� ���cO��(�&&�n����%%ps.�:���b�`�䊩]eL��G��V����}�`���̔��_J#E8����A��0B#.����{ �<C���Q�0�k#QHB��%2t �OCw�zh>����w�K���Qb�(SB����V~%�ϊb��E��0��]�N=�q��xԩo��O��I1Y�Ț(��⌴����o����i^�g��xp���,�2�4����s%�n��|��Y�����H����xE�ϓ�hV��9�/ � �vA�M.ve-´�\J��*�Sx�C�S�Y�%�_F�}��b���U��F��u�u� �B�27'���~ϛ�'���:m\���y���S(���;��`�i��s������Z�����s�X�Řt��.x3X�qZ����ѡi�t�y�e6|�C���"�� �-�P��mj��2�*�N��I��Ū�"������6b1�Ө� )���QἝ�. �W���F��R��:��4��0&M��^ ��\����(ap |�#�Q�V���Y������:���Y(3�W�����izdAwvl)����CX�$� ^:����^��lZ�<r0ь١����L���7����m�ߘ�cz{�#���\Ү��B}�S>���� u^���z_��E�V4Ň�Y�XS��;ڔ���bA<��2y#h�yÖF�X�i&�%�̐�'6�|���eHA�!�|Y��ju���Z'�ʫ~�/�r>�]{{<�joF���9��}*w��֕XyA�������-m����X7�z.Һ�ڔ��ɸo��⋢�e؟�n,�U�Ց7��5��R��4Rm��4�˓��L��v�RE�l��H0)��Ȋ �����9˧c�r�/�ಥ!n����H[I����FZ��K���UU�e�6݉9��RV$�4��������.9eg e���a�f���j�y~HR�ɺ��Zl�� �P���b_��Y�������מS ��O�� Ů'�_�ҦO�#�JR���jH�M��F,h���.�U��Hb[&�R��(2��ִN��_����2&Ӽ�ѐ�#ɚh|�� �k�~�ˊ4a� �0��I�����.�l�c˷3H5CZ-Hq���$�hN��3[��M�B���GSE�{�WZ���{߳]r�W�6a�u2�� *���-�e��e���� �0T��� ��7"ԥ� _6]�L]�i�P�����Q��&٣o��8{���r�$����M�:���g�c�Q\k���-�$�R�M/���МGqs ��Jzu_[���5q�����9~���-�4s���0,�V�*��+�w�ۇ�:Ym&������i"��h����fN@T��a �L#�! �!{-ߐ�C"�ݖǣU��mY:㟰�߱���l�ak{��sܠGv�0�d��_��ey�y���������Qkg.�/e1��n=CH�r��{}9&BXhȊx�*�X�W�w��5�oiК��$�c�y�fTՒ��K-���QU�r�)b�_G��hK)��#Ɔ�����O�DH�^I�DhV�K�K?~j��b娞�k��ѝ���2Dj4 A�W�Sе��T~�;���u^�����uX��~WZ-��E|��9fGq������Q��Z�AH�F�Dp8S`�GI�?�_���yW�/����Ӻ�<2�O�-�8&��N۔���]Q�Σ˞�j����L�?���H�������j�[�vB@T,�j�]m�����W6^hpRߕ��Nrz����꽋&�����]��I�V�&}�ID�`@�S��[>#[N9�/v<�;^�BN*�G��,��v��d��h��������̿P�b��S��&�;�:cdzTF���L�K�)�"7���h�;��i�z��?& �FK�7g�*E \X�h����Vc3�@�9��[�+>�j�UE���nR�__���|�G
Static task
static1
Behavioral task
behavioral1
Sample
16ff62ea07f00f6a2d5f32e209b494bc5055a05877ca86b5cbf7b3dccc15759b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
16ff62ea07f00f6a2d5f32e209b494bc5055a05877ca86b5cbf7b3dccc15759b.exe
Resource
win10v2004-20220812-en
General
-
Target
16ff62ea07f00f6a2d5f32e209b494bc5055a05877ca86b5cbf7b3dccc15759b
-
Size
1.1MB
-
MD5
9003ac7cdce5d451f78c4b0fdb7d9f01
-
SHA1
74054543fac27c4404ee87d05e803fa5cfc02977
-
SHA256
16ff62ea07f00f6a2d5f32e209b494bc5055a05877ca86b5cbf7b3dccc15759b
-
SHA512
a07c22248c58124140d456d640cb5894985410e999184440aea8fdf2e6ed2531171edfb442ed1c40be8ce59ce89569dfe6c82255567fb21be793c6cc3130957d
-
SSDEEP
24576:kR2z5asBkxcKGMKanqjpDPkML3gt8CC8Vs:dhkxZGjphg88Vs
Malware Config
Signatures
Files
-
16ff62ea07f00f6a2d5f32e209b494bc5055a05877ca86b5cbf7b3dccc15759b.exe windows x86
f100536916685734867dcbf966b8bac1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetActiveObject
advapi32
RegOpenKeyExA
user32
GetWindowTextW
MessageBoxA
kernel32
GlobalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetCurrentObject
version
GetFileVersionInfoA
ole32
OleSetMenuDescriptor
comctl32
ImageList_DragLeave
shell32
ShellExecuteA
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ