��X�7��&IB��//����=��$&��]���a��f��Ċ\nbko1&�=�-�٩� �αp�oM�a��G�3-�]�dBq�X�)��r�NpgI-_'�F� �<][�kd��d������f m2���c���#_2�3�{���p?�^�ڡ�941��]m��o��m���mb�*�?.��ϴT�$��Vk@�����N���}0�@rա!z���� &'�8!����-�'��x��̕''�yա��,�_��sO����άܥ�%B<A��ki�+�ޓSZ�-b��t��y �jf�����+�n��Av�9[�U�{���6=�[5˪˲A����EZU��$��uЫ �����Ndښ塔����R���(u�u/�xh��"�����x��#*�S�$�̙@��jQ�ٯ�wa��x2Vq�ӥ��'�����������x����y{h���]4J������:/5�l�3��-n˥���z�l�5��P/������)�<$�U�vRr���X㱢��Dq�B�����׆��r���eK����@j�Z���X�p8-8���ϢN�x�����l��N�$�Ȯ�$�^*y:jM:�ԓ��5�K���U���>�~of��۴���#ГR�����~�I�sh�5���W�}&��kSZ;R�_.Ls+�S���O=�*J/��i��ZQ�DP%z����EҌ�z*� /��0��ܝR������������g�{<bB�+r=~S�y0<��ΖS���aU��>��Z�,�L�C>���5��:�/!yX�0Q&�H���`F���ɷ���Er��Vp¦�p֍�L~���^�4a#,������ �����)�" X?XY=����(�&h؟��u�r��Ao T����[�{������ӭ��7��厖�L��PCד���8����ﱔ7�ߞY�j�z�o���t����|�W+��rS�1�PT��l�V���;_�1��⫖7k7d��n5�.i��'�Vg����a��eV�w�P^�"N�6��̒,�*�䃡��덍<�!�uzN%�C"�0o�)UA�ӵ� �g��n'���2<���c�O�wͺ�=u�2�jQ9X�C���s�������<5##���`#��%Y��v5Rs�/�;3�u�ǘLw����A[�au�-���R�.�0)��g��.�Y�;f����h2������K,á`��_���H���^ٍ�ŖS�ZE~�'Y.R�*�W9��Fr�#ﱒ\ߟ$i��3�5Y.���q|��ߪ^�t�W�!�b���2��R4C�Еs���ա�h��e�=�H_"�е!h��$|וh-��eE�P[�|Ѓ�:*�y��흑�=��]�c<�����D���=Bp~����T�F,o����)WQqy8�������oz6����%=?>Z_<�-jtೂw �6�ѧL��x����sp�_Уb��e�.=�ؕx&����[e.)V������|}���Ae�7�q��Ҙh�H� �ZSZ��5��)�b[������Kt�l��=;I�kf�V�����:�0`���},c4��1��H4�?��_��D#�������bln���{�U0q�:��(�ӎ��f&�K��}� ��ҭ%�s�O���(;��;���A��S�M����Η[��*@E#v'\Q��9��!K����Ύ}zm���sw>=7�a��9Y���GyÓɈ�����@l!�����f�N�s$��*��H#��^���#�{�e�Z'N$(�k^�9��N��x�S����RJ\coX��}�I�rr ���R���9�0������ R���Ӧ�M�˚%��f���8���=5�,�� �>��a�����Nv�߅"%˟�@���������ƞ"H�o���������Z�bhDm�I,�z�4�RUJ��ߺd(���7ᅌ%�Ҭ�Ԇ�/�N��k�����Zik#"'NF�n��IL������(�XzdV��TE��.٥~���aD0kp�}DG �O�����ab�%[�&7=�ȼS`sݻ����|��g8gd�+�],J2���6[��w�81�8���!ɨ�%��"�Me���[���7Jg�9Q9�=b�ݥ����Yfi��PE��տ:�$���g��Iv+�G+�w��%C,8����ü3���J�DLLϋ̕��l�Y-�ZL�I���]���ĥ�z�6d�:����ã.�����J�w[t�/�!��&�ֆY5W��ʼ���p���K6}�TP���TKrocg�&00ڿb@�Nf?)=c��V!���I?�>l�v�eA�1�����1��[�o���Z������"��$�� ��^#�]>,^�R��Yĥ�FOI#��P�t!{���5���,�Y%����*#��F�Y��Q*�1)d�l-O.u�g�H�����"])��P�@-�K�����;j]`���)�:�8�Q��_݇y.�+ш�ߟ�C��� W8�)Ƥ�q)����D����n����f*�2�j!��K���Ms��t`���<4|��E%��;�u�Eۋ�d�c���C�a̼���P�2K���]��hʿ3Y8"�ƵkQE�^�@W(�3�Y�������9u�YDt��i��R��oNO�������D������2є��w�b���)x��G��1���a2��Iv��ע[�h`�� e���w�t���Q@��@�uA��5:H飕>4�wd_m�m�{٨��0�HO�x�O���S���G�S1F�����Q���-O@&��!"i�CzEw���i�jJD��w���B��Z��.a�Ȋ���a��R��^� G�J�Ƭ�u�������~�������Qoo��+Q��,��v{��ؓ�U�,���m 9�RW�������O��+]��-�V���C.F.��X�.+q{m,����Isa{�B��<��A���ջQ갳ϛ����ƢWy�SvxR7\�@�!K��O�UkÀu"U�:��[�?�t�I�~{\���1�*�x#J}^L��&m[���w�1&� �*;�$Z�,qr�
Static task
static1
Behavioral task
behavioral1
Sample
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
Resource
win10v2004-20220812-en
General
-
Target
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a
-
Size
2.0MB
-
MD5
b840498b8e287f603675aa7f1d97c6d0
-
SHA1
d7f6880fdda5d041af68ee61e11e66c26832d52f
-
SHA256
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a
-
SHA512
b3f477646594a8845f41943bd48806c400973e01c3be4ae89268e661931a39cd95312374b48cddbd2c53d6596b1a04b1d3030e86e6f8ed12865e2c77955604c7
-
SSDEEP
49152:260FEMdfbV+X/anvdkIxyuYRp6tF509BcjvsqvxVKbS:260/dh+IvpoXYtHTvxkbS
Malware Config
Signatures
Files
-
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe windows x86
2f8f24daf9517cf90156eb9aceba11f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutOpen
ws2_32
inet_ntoa
kernel32
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperA
gdi32
SetPixel
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoFreeUnusedLibraries
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Create
oledlg
ord8
wininet
InternetSetOptionA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 962KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
upx0 Size: - Virtual size: 362KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
upx1 Size: 1000KB - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ