M�������[��/B$�}�p{2b����d�I9{Ɗ�+N��ߎ�����V[�����#������mw��al8!���&��z��m�p����7�W��N��,��"иK�nf��!�;�������U��$��o�xЌP��obzRV&ⴽ�[�ڷ)_���F�Q�b~����+��-�<㣌�E#�����ˋ�%nm[�ނ!�P?�5�5���߯z�'ʑW��T㎧�p��g���=�H�9���b�0�āt�eY%) ׃�8���!l}�7�a`��8c��M�B߷dH���Ƅ#Z����Y����u!2D�jcU�!����ws"��O��$�{dGq��ȟ5c+�j>p}�N�R 4g t��Ԇ�[���ob�o��6V#��Q���[_'p[�+�H���f��D��z���d����/�ӫ���Mj�:8����%W#��c��lD�B�)h��Ɲ)�s�Z���J<��M�����O�q8g�V�#����?Xz����%9Y�f�!zl�5��CH`�����cx)��y�T�Z�%i��"�sR�Jߴw.���1l��9<Q{�#�`���7�0��K}(.��W\�pHa���bB��Gg�ϰ@��]�R+ d����QB#B=4��c�A�R�au}����:��^;V�}�u)bSD� �O��T�����g������K�<j�=�w�kǠ~W&�o�`B$X���4��!���Dp���{=��x}�����d6Q���i�O�fZ��:[bX4���<��}�L�Z���l��ja���cٹE~��5�ֺh��[��S$��M�E� _D���a۲퓦p�����'탼@��c�T��*�Ai�'"��#*�����i�f�]���-�5"2d������`��C�Bt�K�#���o#��X�����0���+MrL(�q�;�~��#�����0�[��t���-�ʤ%��\�6�ʠ1E�����VN�����E�����O94�K,��[_*I!����?ݯ}���~%r�6O��(j.�Qd��_8�jn='��U������/ yA��'�N����r詠��x���b5��.ZduU�̈́6���bY>�;䂶$���b�*��}�)��ʚ<���F�����J�z@��|��D���P�������hUK- %^}��$���dt1$;���0�"b��"!��{-����LTnj7�<u0R��<Vg�W�����-�3� Yz%U㍸x��n1{-�מҐ&�z)���dp��k%�s],#�m�mN������AE>6�P�B����Pѡ�/�R����=k8Y�7�~ւt��]������- .�i���ZN8VX!r펛qJ���#!�4��3���35��H$�R]S�|;�_�`���������,�WdJ�g�|��{��pNp��0����c'��@^��� ��u�.{���������9v��sƖ3��üh�}�ѥ�ďgkt���R<k/�PX˿k�Ga�b��b�Sl��i� �sH/�Œ���ۼ��v�m�\�{���F<���2HT�d\QB� �<Q���'^�\C�n���4{���˫�J��լ�K�h��Ӣ�����Y��$�d��/^�_M�,I֬�!�A�[����w�Ssb�I�n��}J��R?Tw�OIx���]d/ &��i�nH�?w8�������ZA�`b���}[�q��V�rD3�q��)EZ��wm��w�}�dPf�!Yc�g�TE�� ��P�)�.����t��V�.]�Cy��!v�|wF7� ���*x�l4��&Z�:���3�fw.�mٕoV�Qjc��E�~�����\W�D���w�:X��w�����|5v�0�!����ltk��V�:T�"J�����mj�<���i'4,[�a!���<AR�2��*Y�r�`��)Xfog�q G1�I��GY9��NT�7����#]��`G>��q>�Ah��R.fU;}���������}Cc���EX-K~�'�(viw��Z�tp%��qُ܄�� >�L��]��U���py!w��!G�ְ���8>X���VT�s�}��N�˪�}S�s��#v�Z!��P$�[�:d�Ɋ��?�1�c�)�x`���K��R��Zl$���ZӄY�����j6v;<dUK͙�}N0�����J����U�K��iF8�_�)7�� 3�n�=���=f��W�������֘C�;����� ���s�1mR��i��n��u���t����׳�L�S�PRT� �f�"��ָӊ�.CW<��ë�B�H�G���*��ܿW��������W�L��r�;��X�/�E�W<�^0ՔU0��{���k��K�:������c�0�@�K$����� ���I��L���� '_��Ԅf��n�FK']n'�㣻���x�����gA�@�#4��<�?�h ZKm���h��������N��n={�ٛ$ O�8Wu�s��Xu*/A��D��< ~k�&X��P����!O!�]��f��l�}<� ������L���.�f����R���K"+,wJ� ]�͠��������l')��K�\N�����[f��%�Џ���W䪩�sdcJ��r�:�T,���Y�ѫ��тlJt�D�D//5{�yh���ڸ.��@�1���wl��L�:s�.*^�_� �,����k[�\��l��6�4���:d��*�Q,��0 7W��s���gmXOi������`��U�wO]�e��Kt�'£�]8�I=�G%� @r���������ըc���;x,��f�W eR����x�G���>���o46����*�7���uC�_L:ϬѲOif"���Ii�pn�����Y0� �L��������"͚���sM��8�gʜ�n�g��2�t��ٲn%�k���u�� �} FTs�G�c,L(!����BV�&�>~x���݁������guFJ5��͜���2ɱ�H�]D,�u�Z�`���YW��,�heOɶ���}+�m!//^KMc���lFT t��k��X���AY*_����@
Static task
static1
Behavioral task
behavioral1
Sample
aa23a0497476fe9433579c4053e7e1c01dfe2de4969d07475c75ac33b301cc21.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa23a0497476fe9433579c4053e7e1c01dfe2de4969d07475c75ac33b301cc21.exe
Resource
win10v2004-20220812-en
General
-
Target
aa23a0497476fe9433579c4053e7e1c01dfe2de4969d07475c75ac33b301cc21.7z
-
Size
5.9MB
-
MD5
4d501c85962f710da313157e949d95ac
-
SHA1
bf00839188009a545291cdfcb0e08b4fda272a65
-
SHA256
10f783ff769828e0961ceb6c2c8515cc30c010530c10537ee0815ff0a904fb94
-
SHA512
dbb0c91a039477bfe241688938d6e78c3f958f5b70c93be197b4f369eab4136a77516620955c887362e14cc7157e8e0f0663742bcde51f227ae5f17795353700
-
SSDEEP
98304:VGvGMcFgpDrgJkHf8M13/9zirGp5nc1NENSvv+x46zaccYF5OJuus:ViFp/G+8Ev9Qq5nc1NEFi6zRHDOUus
Malware Config
Signatures
Files
-
aa23a0497476fe9433579c4053e7e1c01dfe2de4969d07475c75ac33b301cc21.7z.7z
Password: infected
-
aa23a0497476fe9433579c4053e7e1c01dfe2de4969d07475c75ac33b301cc21.exe windows x86
Password: infected
d812527b5988192695ea156eae610de1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
SHGetFolderPathW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.R2} Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ZYl Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ySw Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ