j�)�yˡ�w8�$��q������f��/��{z��<�������eg� #���=�S��%�.S��j� D����6�Ĥ|�B���ٌ��S,TX�P3OZH�q���H�rQ�� d���*C��t7"���������pd�W:[},mH�������I;T��p��gpu�)�:�]��� ��M�H�r�p�5BW���_j��V�/L� ����0�c�s/{}%�>T�\�ykl��zϰi��� �-o���% ����R/O��L�*�#��;�V,Q��C�3m�l^���v��Y��p;SnkKh�K�o�0��=����� �� j�<��A(Ӝ��U�Kw}��I��hzѸ�}��r���sQ^5����K���b\Wl�1����t�J����%��Ao�JBa�`]^_ڳ�W���yD�Z�=�(�����P��I����و�F�Ygt��Ǟ�9w�ő�T�<U>Z���sx{��?F����d�J¼!�$d����t�Z`���%��8ς�m� ��+�&z����n �Z<p�J�oJ�&�s��*��#:����?*�¦]�n�n�P�_�ߪ��ܸ�Q>��%����8�x��{�ɾ�*����h���]� �@�߹=qj�I$��D�B���>�w?�E�.W/�*]甹#��.����D�o;K�� �^���e��L�%R}1�gkM��A��15�v Ȁ�L����.~�uyGF� �V���"r.��M���^��!���1ް�-^k���P�(�"��2�֨GE*�A��C=p�v���o�P�U��p��mN�(����G��-mZ�|�!�5A}%F�(sg�C���Lkn���㚣g1��*A����߀?DŽ@���%s�ة\q9��eo�@�(��� p�N��E��e(�v����w?a�Uz�|N��5/ ��6��*c?�Y��v����r,������c�b�]�T�ʩ~�9���q)�����O܀�ݶ w��IQ�����>yC��swo�H���>N�S$�ay�ɊJ\�$!��I��1/�H����_���͗����s ���bN]�u�����k���c �ԏb�Yk-LG�L��S���1Ė�*���|8'�j���� ��F���'fQ���Ȼ��=�,�~0�Ȓɴ�f��6���.�1�L_I�����Ŵ�Ɋ!�Nk���&>�Gށ�ao!Ic$z�-V�,�n����' _k�0�Ί�mvb!o�[��)�j ,��5o��]E�A�2�|>Tv�g���j[݊'���,�Vo��j���v���Ώ�S�A�5dUKaQ�A���k'�^t���q���J)\��q�?���?����-�N]��:�D7�i�DL�<]��j�{a<CGK__o�*�����"�6�յ2�~Hn�E �.b@ʻml'��F��ml�0��_�tD(�I�C�H�H�7)t�P��a��=*����Z)��#�G_����|CbX�$I/��2KY�YBywh�l�lf�r����¶��i�)�RT� �aL��]�a�7bQr!'R�Y�X��(c68���DU��/�q�cr=3e�}Obrt�o�>�:�y���2���x�Ey�(3��ƙ��JZ)]��y��������3�\@���T��I�_W[�'� Ѻ|V�f�¶����ѓb^���=�؆Ť����S�%늭"�M;�3�]\�7: {� �x֥$Hr���n���J 2�'��3�v��oE$ _���J�K��b��@��Z�Nk�ς������ѩ�F<o���Z|���5ϴ -~����D�y>E���5�6L�1k�/w����A)��hj?�iT�C3���>�2����J��4���N�Wg_A��8�z���T���W��Ͽ ���s�Np+T4d57^�,��M�E�����pQ��%��V���0��d�σ�d��9��·�k��G��0G؟��~F�.**�d�C��Tx欭�+�T��(xM����X�&.�.�����[#�\a�� 7��D�nH��r���G�u?H�$.v6�����[��J�Qvt�����t9Yx�,�R�&�_C����c,�4�.=4g��ǟ�N���t����D9?�����]}�S� ^`�BU��dA6�{�����iQ)EJ�^�Q.2Y� yH� ;5==�q�B�Px��}hZ�(pkz ����4�F^`p'��HS wB������F<�0�����'�ga����m�+Ol�g��3�=�?�U�'S��d��{�OF����1������CZ�MH�����"���$AK�ٞq��Np�n��X&������wU��q�+kl:ST��x �^���'ZK�M ��ٳ ��)��º� ���̉u�\��>���,�6 ��WNs+53kvX)�2�[\2h�頺>��_yũ:v \���d�|��W�����>�U�y�T�bQ�@�8ӿɥár&~+R^l��3��<�'(�Vs�x#T��Ϛ����"Q�����KH�zwVz&ï�,@�R�<�#" 1��� ��E���;��O���^��6\`GW1��=��,Ԩ�²������oj~�Dq�%*Ob{N\����ι���&�\b ���VΠ��!Њ���� ����3H3�#��Z2 n'�HW^���O��vK`���=jrB�`;���@)����U/e�.c��Ąc���"!�����w���a�.����'��k�oxG��c�ge�c�Oߜȡ��(6S��Iy��fD'ɔ�����\��6 �3���!�x���.��W�*3c3�9������z��Q��o���sYx�gD������t��!��^�]7l�{�زb>�ܬ������Qm� �eǚ��:5�c�탒�4g�S��\�,k=��0���x�Y/���uT235,�y�3�l��:M��%�:�;���� F��&�R������{������8��' g�t݈k���I@�fI�!'r��s���j [.{�M�D�Am!3�'��/>2jt����p��:Ss*.y��SO���Ao�i��}U ��l��x�F�NtG����>���Q�Lk_�6hZ�g#�m�
Static task
static1
Behavioral task
behavioral1
Sample
46f7b8fc9ba4e511b4a8e1bc1c519b4c682219e0130b572978e523bc12502dba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
46f7b8fc9ba4e511b4a8e1bc1c519b4c682219e0130b572978e523bc12502dba.exe
Resource
win10v2004-20220812-en
General
-
Target
46f7b8fc9ba4e511b4a8e1bc1c519b4c682219e0130b572978e523bc12502dba
-
Size
5.3MB
-
MD5
072f535acd18a27b06b162e969c96462
-
SHA1
df72058a482610217a7cc104d1752185f21fa1ba
-
SHA256
46f7b8fc9ba4e511b4a8e1bc1c519b4c682219e0130b572978e523bc12502dba
-
SHA512
6e332ac62bd5afc8168846b357ff3868ebfdcc66e0ba9e24719902fe30f0b59b7d3548f79f8ec3630d97fad30056946d05dc2317c9a04236cb38e78392c31f05
-
SSDEEP
49152:xxNBF7PN3taRHFP3clnBowx8LFrzSll3HTN8VOiduUH2yXfVsLbd0VfBgsZUZxd:x1FpQFP3aJSFnKH6VOidxWyPvxBgn
Malware Config
Signatures
Files
-
46f7b8fc9ba4e511b4a8e1bc1c519b4c682219e0130b572978e523bc12502dba.exe windows x86
b83edfb7d36312a01139830670992771
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantCopy
advapi32
RegOpenKeyExA
user32
UnregisterClassA
kernel32
GetVersion
GetVersionExA
LoadLibraryExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SelectObject
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
ImageList_Add
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1015KB - Virtual size: 1014KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ