J�"HM�^���^r��F�c,�K$�c|��� mi�P�E�M4D�6��z:ж��7W�*[����VxQ���5l����^=���"~���������đ�H�U��œ�*�W��� ����va����&?9 �t���~��wM�4���(E���=8�p����:b�D�����3�:�HNR��\mZ��nj���[���U���0����A��Zw�Ɠ�Ƒ���*=��L|�aV���Z��ޙ�r�����,��I.��E�8� ����I������b3&ҝ͛�eTEJ&I���Iۣ����� �,����%�@��:����1��@�:<K���'��k�c�%�{�*��#�씽Tk_���V��i���'1Z���E +���m����N����=ڐ��/s�"��j�D���v�q]�Lcl��M����M��,Q�\ێ��� ��g��+]�ޟ�:�4uN.G��W�?����p�z�}��}����_H�a�!F=�4P@�y��%�*�ur�ڝ0 ��$�~�����ʬ#RӾ ���j��O��m!9{PǷMo�0���'A��>�������|��F;�>�E *�̙W8ڭnY��F wXm��K�Jh6��BJ@n����j���0��ce }4G�;�UլE�؇��0Z��]��n㺬�ߨ��B�^l�뜶CbQ��"9��b����s@�C�]�A��Ю������ &�e4����÷�E�7���h����v9�r4�1��od��~��-�f��GK�tf�]3(J[1��i�Ɵ�H��86�/@�ώ�>���鍀!��:��t��0 �\ka����r3�^����� P�U��鲳�4?���FlT? ]�j#O=��#�`�'�_P��o��_����{|�e���� X4Y"��\�q's���w�}xo_�BE�n�*.�A���Z�*f���>����-��>͜���X�k֡�zvT�k�A�bR�E��i���Zn���du��E���cB���<D�^f��F��=�4������W��Jr��߬I��|�k�t�9SF�j�� 6��룲uҡ ו���gm-b����R�z=�<��r3O� ����@T@���R�P/�Ek�J�C.�0[}�nc�&�� ��ߙ�8�>{�C���{�n��ő#0��+��mh��y�r�{��s�Pm��81*�e��&Ou���4������:X�:+�3�4�C}�Ew{��t�;�bU��4� E�� ���%�z����B-���� x|������ˈR�ֹ�zo�T9O�9$�Yx\(�(��o��(k@E�|���:��e9��ы�&Z.�����~��!� d�$�Cގ?\#��^&J�$�� ���c ����p���J �j�B}��y��+8����E����$ڻЀ����&����uCƼ��?ה���/�`Jl�4�j��E���sV�U�T�+����N�Rs�W���U��)q�F#`�cF"]A��u�;rp�}(䆩�@�x0��+Mж�f��ہ�E�Jy#� ���Fq�5i-�c��8z�!&d�q}���44GK�#�Y���w.�%� N�&~�=P�]z�`E==�Mmʠ����U0a6O��|iyXK�S1���n*q@�����g�-���܀t��D�,]��g�H�TKլV������12E�H~��� ��k��Xc^��N0��`@��ע�n��������w~�O�NO�X���o�1&괁�g�U�aºX����RG��|G�{p�6l� ��rW����f2�5a8�Ƣ�`��6~ȮNr�_�^�)�q�y2B4<�� ?nus��di U�@��\�Bg���ժ�OsS�y�fȖ��� ���ytd����"}��bP/�����y�0�Nݗv�9��U����l?!~�,QN�� ��P2N�����ᅍ�Ky=g*ϰ�K@�%v|�Kؓ�1Ԝ�����n�T����H�)O�}�-��J�UIoVK�����(��R��|��{EQ��R��*G�0��r�4������P������1��4~��Lr�����8��&����r�e�����UsS��j�$��OYm�e3)�3Z�x5�|�2��~!)�o|S��J�B :Q�6��ܭ�h�]=t�U�O(�T�J��2��ڸ�q�Y��81�A�A�>����-���&xF5s���| �Y��y?���;��ٖ#��TN��2��rv�Ya%�y����q��B�yx�:�?,E���ַ~�~���M��IPjݦ�]�U_����!t n�\wR� ����"&υ���* �?� �3ڗi��&�?�ӵ�T�e=iS��g�wO�֨�(R��<e^J���.]�z��bUȢ*�V�kNJ��- 9u�ߡd�'�����f�� lY$t����F�N�9G�bMA�wĤ��6��;�Y��à ��&Y�x���+�,aO�~�F�����E�㟖N�9�ڙDkX_���^u$��ޅ��;��r-�YY߮]1��Ӡ��3 K� nϾnqpU����n��bgf�A?!;���Sb�1g��jFa��e�/�]d2=��~�8'��g���&����`&�e��<彟5 ������kb��������P8{��� ��"����Vy�녠�a�ԣ�\�y��8F�ě��F`X�������f����l��*-$X��H�3�� �Ծ��| �RШ]�@i�ʻ\�I��yS��T>F�R����`�Xw2�,/������.Mv�8`�֭N���/��@��*�����UܵVƌ�q��=3�Y����}�(X�X�����\�M����;j���`�}/�Y���"�Щ�M�� M��y�k�!3Z�_x��_��y�&i+o��[���� ��A�=?�ZX�W���*�����V�\ ���]z��G�r$�Hq�o���F�A�y��ē��[����+�u �|���+�qx���w����L�R�0 �'ݘxε0T 0U�)��:9ל�|n��A�5��م�Ζ�]�I���iA����]��@��w
Static task
static1
Behavioral task
behavioral1
Sample
72ba2d3d84f24e589734af2ab0d1929cb82c4ebfa46770479edbfd26233ce2c9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
72ba2d3d84f24e589734af2ab0d1929cb82c4ebfa46770479edbfd26233ce2c9.exe
Resource
win10v2004-20220812-en
General
-
Target
72ba2d3d84f24e589734af2ab0d1929cb82c4ebfa46770479edbfd26233ce2c9
-
Size
4.7MB
-
MD5
1a36385e9f811d44214ff526e0f29e29
-
SHA1
dc63a9639950e46463ea963b0f4eaa504293fbfd
-
SHA256
72ba2d3d84f24e589734af2ab0d1929cb82c4ebfa46770479edbfd26233ce2c9
-
SHA512
a5607bbef0865d3766533150197a28de3383f087f083ac31ecc789defb9ab318277a50ca96a276f2a092002c6e3b101a076604d8a7f6d78720c3dc3cf65af078
-
SSDEEP
98304:09FpQFP3aulBP90eQA2RGJxIEIykyvHpClwwG2hg/uHp/NrO2e+DQ:09Eoulx90TArxdkyvJCllG8HpJSP
Malware Config
Signatures
Files
-
72ba2d3d84f24e589734af2ab0d1929cb82c4ebfa46770479edbfd26233ce2c9.exe windows x86
dc3ff5c361e8b057b53d2971ee55fde7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysReAllocStringLen
advapi32
RegCloseKey
user32
GetWindowThreadProcessId
kernel32
GetVersion
GetVersionExA
SetEndOfFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetStretchBltMode
version
GetFileVersionInfoSizeA
ole32
IsEqualGUID
comctl32
ImageList_EndDrag
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ