��!Zӓ���5NLb�l��l�AiÎ��+�;[� �-��\�;�ܺ��gij5W���k����w� ��.��╎J�?dH�9���;GT�n<�1<ej�DC �w]� I9�J��C�_+�ݚ���X�ʘ15A4����T���"k�W�+�be1O���s���p���թ��s4/��q's��B[�"c�l�@ ���Fd�A(E{�n�X��H>G��m������Y�{�:E�E����R9<���A�~��6 ��j��of��%���к��Y4F��<[6�LN�Pq��%�wp�O��ÿd���Ɂe!;c]^��Vv�܄n=}�d��_���"�v�Z������ɡif\8;�� c��rf0f��aD�_!��j.�l����S���ҚC�����{M]>�5�����Q����q�� +�H���_�����i2#^�(�=%�>��f/��5J :�F��A>���ԗ�%3�3��,������������xi5rG�'�B�]�ω�7˓OO�d0'$�&�pZe��/[�]`�}��.���$�@��8��" �+�]��]ˡ55˸ I���٣px��7py6��[���o����ȃ�r&[30���!��"��lj�� {̣q���f�6Pφ�Q�l��eH2?���.��F��z�\�G,�H���/�x��a�"�����h�Լ���m��ά� �^��n����� =۫0��x�{�O����a�]�1�s\�P3�I�[,�����*h��ô�A�O?a�/��cB��1��cQ�z�Mr�Ip%�MF�W6z!Ԁ'!r;��% �K����hU<��j�F7�B;�#$CS[��I���ł`K���n�e��y#��R&� Q�o��/ɘ�NV^?�y�ؘ�`��&У��!j�Kި�U�=9�C&�6�]��1z��������$B�_�/kq3����ts��\6|��F�c.>��~�m��ݏAG������@Aj�f�g�c�1�Gqo�v�EF- ��k�t��2��,�wGx��Dp�c��uU"JԮ�D%�P�Rv��� I��%%��@&�^5uNn �>S��6N�-�8:\Y}��/�'���͠�|/���%r��;��g�2@G���Hr���.�xi4���Nh�)G;�7���F�Eȧks�U�o�?ʜ�����X+cWZ�-�����~ϓ�����E�2���f�pC��Q�E��X�V����6��@-0���N��_��E�*�� ��O)M��]����2��&K�ْ�Wٶ�S� ͋Wz�li�n��nʳ��t����ͣ��dUZ��/<H?�'�#C!�&�t�`f�#�-'b�c����4��E�q(����/� bB�������yg���$��U�n�f��:PI�8����`s �f�`�l6���lJ��}>b���)�z��i)J6�7��^AA��+� Q�Y$lF=Q%7G��T��LI�sh ,�_�cnE��.B7ĈO�|fX����݈r`7�0�N)&�PSt��&�)�<�/���I�k4�u��\�ls�)�V�5�8$�L�d^J��7�/]�jE�!���C!q����i�b�פU8:g��Q�"��P1��#�����-���!��GbJ��6�s�J��V���8����I���$���KK��L����oO��d�\�aI?����� 2��j�n����`D�"�o%�N��@7P`;\˂�Y�B�˦'-��ٱ��8aA�k� �01{����Y�ݶB��o�j��=�;�]��ef<�d�t��WT/堮�K,:[�sS<���ڀ�L��F�ȗ )���;�I�l.�x�[����C�Fm�F�Y�j�?_�QUtZ��2��Nt� �B!v�A�\�Q��gSv�X�s�[BoE��b~�X�6��ܝ�G��l��_\+`{�$93YHhg8%��]+��'B?ʾ}�%)�C��ȮZ �O������CXD��kޜJ����̖ �L=�l��u�k�~�A(뺙��B7�����I.߷��'��o��&|:�� �s������Y�y���}YSΚ��oX2�I��(K��"���9�������|5ԡ`�� �r��l��a�Q��I���056�Jg���^J,c\a'*pd�m���rC7��0�f=��BH��z�t�8��#Zô� ����'���{~���ֻ� @[W+��Mk�c�js�j ~�P9��S����˾C���8�S6���I¾��� ������e2��t��������n@JQ��>u�vF���>���2{��9�e\+ ;ѡ����s��x1d�\~�;*�R�:�����m�|J[|rԊ�˭`�1�Q�Bl@"�!���:�1�s�W����r!�v�/cRdڽg �H���=�����j'J��{StW0��H�a�~�|f�g����_�3�C���"Q�-a< -��&[��e��+��c��Պ��R��!�,{������At[��ߒ�$���;m����J��M�ya�vӏ��?�W��i)��n��Ռ8IU7H���Fm�%g�p��N'�ۓ�ܬ����}֯B�Xw����H����k;�B�8��%��H8 ��CÀK�n&ʂ�a�S�}�bA/���\sP��<���|2Hʕ[&MS j�N�}��� ��Ї��o騟�M�o+G��ΙԮ;�0�9>���-� ��aT�6�Mw�X LtC�P�y汄U9V3�����Mf��xĹ�*�Lw�[�g�1�N�I@Ѡ�Q�����x+ P�1��q��Q(ب�]�����_�J)I�0�-�bm���V�����da�I%���T�bO�`G��@ˌ�p�c���F���y['=����ps��y�+��Hb�e��-Hßp�0h�� ~�{dr1�E=��w��>�����8�Ls���@D��R��o#Д��T��ʉ.!�� �<x������SC���U�)��p?�K�kEh�*����t����oe��[�����!ѵ�WC�ܨ�9�z��>n�Q]SN9ʫ�!7��/�֩���O���䏬�В�C'��4�F�`V��9�b;@}����l�N\��|nCf�>Zڇ��i��լ�@ؤL
Static task
static1
Behavioral task
behavioral1
Sample
41003633134a9aeb5ae244173346823bde505194a95c38f42d084ea793642cd7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
41003633134a9aeb5ae244173346823bde505194a95c38f42d084ea793642cd7.exe
Resource
win10v2004-20220812-en
General
-
Target
41003633134a9aeb5ae244173346823bde505194a95c38f42d084ea793642cd7
-
Size
4.5MB
-
MD5
72a9976cf587e66ca657ce92e92a3340
-
SHA1
5d4027e15397f658e39f63681937b4ef061ada4c
-
SHA256
41003633134a9aeb5ae244173346823bde505194a95c38f42d084ea793642cd7
-
SHA512
c677cb74e52c4ad95548ea783c587d427704b19764a5d70746a4fd4af717e05b90f4e67cfb504c3966091de09aacb71765355feef1a2d3d3f384a0880d766c9f
-
SSDEEP
49152:3ih0F7PN3taRHFP3clnBowezkBqvXpdQVs7TCxRquuYSpEJcDKz+jjC19UwDxORW:3RFpQFP3aQkqqfTSpEmoBuNtSv
Malware Config
Signatures
Files
-
41003633134a9aeb5ae244173346823bde505194a95c38f42d084ea793642cd7.exe windows x86
04247e55d3c7aab8ca55c5d1c19c6ad1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegOpenKeyExA
user32
OemToCharA
kernel32
GetVersion
GetVersionExA
LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetBkColor
version
GetFileVersionInfoSizeA
ole32
ProgIDFromCLSID
comctl32
ImageList_Read
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ