:r�� ~�ej���k9��]�:�V4��L���Ip�;o��� ��7��K4'�&w �-�0�V���\�rS�(�%����Y=_�KpʛM�,�u(����3�ǝ��a^�"�U�`���K��iRW����y�1)�p��y+Z�e;����U�M�l�s�M�:��ËZ|����,�ՀO�36��y��Z�Wv�����ڵ���'�L�Qq�� i~hGN�����L�?������U8� ew��� g�ȦcT��)m���5�����,Kx�������)��[��t]��g��%ӜGr#&-XS$G͘:��㡃� � �|B�o�ÜG�}��5�89UAMN��T0}F�Ҽz���QD���2Nv\/m�5�f6�2؍x�����8��l�L�غ�j_�0H��u���|�)��pV���@ ��82�M� ؐ����������cLj^s�㍁��I����<T�7[_���ur8٠Թ��yM?(���!�L�&5n�}U�+�` @f �| �s�Jq�@檑\v�3����bQC늶X����a�B�Γv�n;�iK���&� ��gJ�����[ā��p�D�������p��N�bJ�%�h}35`PEŸ5�e*��_>q����8q\�T�$N^v2���$�:���Jb ���jR�%zB���u2N~2�K;��:�_P����� P��w$Q1cZ� �v����a��ϻ,Ɍ�D� o<÷��z8��V'R? �a���m��S�vϰ`L�&�WÀ�Q͓� )Um��#�����Vc�/���F�Br���J|�4�A�)w����"�e������Q$/c�w�ʺ�oT1n�8������ӈH�F�:y�ŗb�k�Mt���5���֍{��ۡ������H�˟&H��^UR���#˹�p��}~�&5�f�$�K��Ԛ^��Z��<���"�^@�t@��9���M����w݁�F�k��#����hb����cUo2������q>G_r��)��Sr&�1�E!R:����l��t����0���!t�������jaU&E�h�<��9��.�B��eXˋ��� �CV��Oc�M��V�A,���0m�W����!?��<b�x�� ���)^�������T�!��ς�3�O��r���veA� �����<4�Z(#�V��#�/^�s��&Z��~� �~���;.�X�V�k�Skџ��I��oA����TvG�7�}���,�m?�/���@���*�A�ó2�����Ox������O���N�d���.��,M���*���3����LPi9��J�����K)�x����a舡O���f -]�ꪝ����3۳���!��4H/���ڂ�ݩR�$�bXl�y�C���b�Ş����Ы�]�K��XLL%������t����Š�~�����f�/!>_-��nIG��L@ZgB���n��7�X�0�>�;�K9gϕ\O[�{p1�������|�oA��z,��ng���I�As��Y:��I�g~�k�,�6���|R%����&(��`({�1�Ҽ�I�3I}�k�Y��E��c���=����d�Jž^c�X�g��z��@3��������'�_�d]�[g�Z(ɨ8d�+��\������Piu������I���ŝf���45TN�7��{�v�(�/��Yc�bE�i45�usI7�����Y�ʥ�Ç��Oh�Η1�r>�l�էxXu������8l�ܩ<����y���0�s 8�*�B���h�'!���� Mo`/��ཫ��$��y�倷k�+��%��nǹ� ���'���uSu�8���_tuUrg���ȗ��E�>#>'qkg�>VSSjMU��!�/�7������<��@���UFxP����oUp$�<���f4���2_�V�� ßk���>����>;� ���D�rF����Q���X�&��X��~�^��u�.-�MF���y��+��Qg\����?������[ P�㢔L�z���ťHK;W"T��*br��c~����5�{k�r�Q�/P0!�v�&@�'���.X�^R�K�*)suR('� ��N��b����Bl1��� �&�d �X�'7_�����A�� �IŰة�=ɵ�2�B�.��KzQ��4/i����jZ;�{u�k6�&Ȣ<>'��' �����ep�T��MMΦ���![-FĮ#tZ������~�I M�z0�N����p*[)����T�cO���ʍ XZL>�0�����/�|�tF��y�v�4�a�I����h���@䫌���l=�ܳ�fsrx:�{��\��x�������N�4��.�Ըcj��ǰ5L��rkRd8���l�ɏ������!�����K��v��Z����da^����-�����4P*��2E��kF��HJ�$�M,���J���~ Ɏ�ݕ�9ղ\� ���z��kMD!��&�h �P�K^}�.h܃��+��c�4 ����\ %1��'�ƴ�1t=z��Im� ���Ef��6��C9��钢�®{!��� �� �~e�I.�7����Su��Qݽ�0����z���%��~�f�-v�������3���sɻTF�!�����vgǃ$���^A�(�Wĸ!��6|0�,���1�t]�f��g�9��^�*X� ���6]��gVoa%��Ů�P(��L��r�EKC6VC����?^������C>P���!��� ��4���R�� \��{���4`^�}��B��gs�R�n��!h���i����72L!��*��wS�E���ݽvK�j~%p�eT�:O���m\�>�S�S!y�)�� /��̈́V������dJQ��hG���X��Բ���YϜ(E0��^^����o��N��2ʤ��kL�l:_����|EV��%x���2�"�����V7ba��ԫ�k/�(�R�Y�q�����>��>���&�K�FfjL�c1�oΧϛ�3E�E�� ��g,"=_�u|��h�mzC�=�?�D�,j�<�1k��,��b%���p
Static task
static1
Behavioral task
behavioral1
Sample
fdaded099183991362824c98c64ad2cfb535bae53ff76d6265ab7e5c852d6575.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fdaded099183991362824c98c64ad2cfb535bae53ff76d6265ab7e5c852d6575.exe
Resource
win10v2004-20220901-en
General
-
Target
fdaded099183991362824c98c64ad2cfb535bae53ff76d6265ab7e5c852d6575
-
Size
1.1MB
-
MD5
901ab74993001e4eee643b58f27dbbca
-
SHA1
2e8c947af660c6c52486338ddf7d5346a32b9106
-
SHA256
fdaded099183991362824c98c64ad2cfb535bae53ff76d6265ab7e5c852d6575
-
SHA512
a24e90ac44981849fef0f61ba044632232622edac1cfc9388384d8d954fc0d694b2ac2e3648b178730afa6588baaace57772ed842599971a0eb125259c7e260d
-
SSDEEP
24576:WfT56ayzrA2VRxECj0zciXJrHNHH/ZhaJYZZ6lwiS6E0++:WfFy9x0VXHhh7wwG++
Malware Config
Signatures
Files
-
fdaded099183991362824c98c64ad2cfb535bae53ff76d6265ab7e5c852d6575.exe windows x86
54dceb60b01389efed9525fce7cce07f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DefWindowProcA
MessageBoxA
gdi32
GetStockObject
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
wininet
InternetOpenA
psapi
GetModuleFileNameExA
msvcrt
puts
shlwapi
PathRemoveFileSpecA
Exports
Exports
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code1 Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ