#�2���6��歂{�vyXOk$��3���y;��xa`�,��:� D���O��3Lݽ~[ti��ДeuV�,�[b+q�@ R` ��~��v���ʃ?����g&��K�'%F"3<s�1���H�V�CL1�rU�xhS�M�}��\�P��Z>+ 7�9~_}H[\<W��������㏑Zk-�)��Xn�RR9>���������&puA� �������!�Pm���e3)NR*�σ9�^8/�T�Kg��'�M��B�sڹ%���g����x�H#��K@�?�����CO�n]��X=����B��|��$�r��ES�k� �᜕Ztu�z*���ݑ|�+w���3:���{��}���֜ҩV���n���h��� /M${؎��@����3?C̞�H ��StE��;?�Z�{�x��&{�V=<���/X7��"e�h5r�&y�ϙ(�G������龛N��@�Fr9u���i�B}�i�/N�T��G��JY@Қ�Rw����������2��x���q�n��Z����٭D�����j��(��Ȗ���@N�slS ��[J�&���I�lo)K��R���p��6�}���� ��@� ��b&�PU+�^��_�H�4�a��G�� yw������ʈ�����0��ߋ����s��7��֙�hhJB����)^�i�ɚ�sa�����K�0C���v�r�pB�e9�/���ct!�G���.��˵wQWH��[�J]��%���H�v��r�?g� �.5�`����"�#<1���.�]v�ZP|��f�g��LŎg��t`/�d���&�g��ϔO�0�����8�"����[[װ��7yS/���q�;��8Oշ_8�����Wa�f�l L�|�d�(1��-�I�$ X4���m}�9�Z�;JZ����Y*�'lx �H8%�����:aКѧ�c��и�H�KL���}�j%c�J�f�^�QIPm��1(V0� �$�����J/� ����O�� �������+W�����X�C�����0�P�Ǡ�e�!�m��Gd�q�<��gQY7/�K�|��@�|c�s_yg/���_����������bs�3?$o�)l�y+�w�|�������~�MB,����2i?֠������w��Id�����Dξi�#q�9�<��-y�3�!XR�ge��~��jB�����Ou+�[��ˁ��p��%F֡�Z���a��.�@'�^+U^����.L��l,�RvC�j2��B2p�_�*9F�>+n��t�%�����!SIbf���!������hZO�tZ��� ���)~qs���:Yx�y�i�̶���N���#8m��B��{c^�]�<{�)�[_䙽�^�KG �W^D��-�4��]�d7��m0�p������F���p(���4�}EԻ���cęc���o�5�f��{�٦��fU�i�y}��moc��yL��ܟ���B�y�_��$عL� �_���ٳ�f�ʼnq�J�ah1�5�+I����fj��.���؝붗 �n����,!���s.)���3����j�:�7�������e���M�����F��hQ)��'��E�V��eD���&:3���ɼ�?ʥ��t��%������M��w���O���@�f'��>��_���d���H��������f�g��9�KS����Qy�p@L�"l��U-��kI��9�-EX�S�����<v���zt���q80Z�9�Zj���3���3-i����k��:N�4�m��N���B��ȹ�O�Yk�;������&�n��c��"��u��"�h�D@@@Ȼ�3�o�d��&qШ �{���0m��4 ��G�"�R��#��¬L������>s(�%8C����\ڵ�a����)�/#a��z������@wk ��5�����:��8M�GY}ge�1u� �BY6������1 Y�r=��T+�!���l���:�Agj�3vK�P�P3�T��ߌ���-]���)��Ol<`QTP��Uv�EB��wA�1�R�pt ��JV7vO�������_*j�Z(���z�6^Ү�)£��aű��9njmYSy��墸2���X_��t(<�@l���yDAd�nz)�W����PE�Qڡ5��e]�m��G��<�`�����?Ֆ}[�x�5���n� O�ɭ6!��/��v?�%mP���9z�`��c*��ޯ{�&�� ��J��g���<�!����U_�+���{�[iu:�<M"�-���<��h��+=�j��XVwK5eY���4 ��!~�RIo��#;���w��Dm=z�'r�Y����ͩ����qj�C#�<���9��&���A2+�w�7���א����Ga´�DR����f�3�(�x�%�u�~0��*���c��02[���.��L����<��ㄳ`�\�EtP���4{��ݴe�[Q;�z�[�u�9AK)t��6��~��9N�Zf~�p����21u1�����JV���4w��Y��N�ӥ�$�\e��˽���G� -�T�z�����2���11��H�z��x<� ����F��[����� �$T����z���.s�;���ⵚp:XCg�w������XR ���& �Z����ػ�m�[�2֫���Q��������7��N����nygt�J,�ߒI�F$ZJb�/�#��5�ysT�[&�,��l~#GL~���d��A��������$���K��~������7�m]ز�'�o�� ^��ﭢMu� :� p�uy�Z��%t�����F��5��A����y�z�ځ��t�fu��W�Y5K����y�j�':?A*V���P����\�/�n{�9��ӱ�I2�*�F)�/,ٴ,G�4�����]����X���ɨC�7�F/�Foj��NCdf��`9ofF�DQIv�Y�ϓ�b����PQ���-�qT�>�M ,6��_!x��=K���c$�~���t6(��ǧ.?���6�#>�gLq2�=��|�T:�>b�=���/f��]�Z��S��}������
Static task
static1
Behavioral task
behavioral1
Sample
29eb3cc25822120a3d0e9cf2dff71834f50e49b0ea7c71cc55fc95dfb9f1b962.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
29eb3cc25822120a3d0e9cf2dff71834f50e49b0ea7c71cc55fc95dfb9f1b962.exe
Resource
win10v2004-20220812-en
General
-
Target
29eb3cc25822120a3d0e9cf2dff71834f50e49b0ea7c71cc55fc95dfb9f1b962
-
Size
3.7MB
-
MD5
e6b25ff936b120af136f465f8e5c728f
-
SHA1
6df07bf5aae7b5e74d062b5c62a5f0316bbd8bc5
-
SHA256
29eb3cc25822120a3d0e9cf2dff71834f50e49b0ea7c71cc55fc95dfb9f1b962
-
SHA512
3196b51ceee2f55a5620307fed9a0f04aa37207472e59bc9fb346f2844119688c9df8338ae30d08ac324e31c1f4f13fbca7266502dffc11adad5e1f5ea48e13d
-
SSDEEP
49152:1QQPF7PN3taRHFP3clnBowOWbX3TW/Fr3ebYM8VWEgpljSLxiel3TkS:1vFpQFP3a2qTml3TuEIjSLxiel3TkS
Malware Config
Signatures
Files
-
29eb3cc25822120a3d0e9cf2dff71834f50e49b0ea7c71cc55fc95dfb9f1b962.exe windows x86
aa812dce955d404afd7636e03cc4046a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantChangeType
advapi32
RegFlushKey
user32
SendMessageW
kernel32
GetVersion
GetVersionExA
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
RectVisible
version
GetFileVersionInfoA
ole32
IsEqualGUID
comctl32
ImageList_DragShowNolock
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1009KB - Virtual size: 1009KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ