��l��õ��C�����A� �|r?%������<q75;Z���w���� �;@m�ջq��!~f6 p�E��(���r# �Rc�p�4�l2'����cӒ��&{��g<�?J篛[b��y�3:��Ӂp�bb��e�� �^T�Ȝa� 5��n��@���Ǵ������5;w�k�[?���A�x *h�����}sX��ntT��k�&ȝ� ��F�mUh�ޣ�6Z6<��p���� ����� )&�Lq��V�&; B8G��㬬<xy�/# q\a�9�EEX%�f_B'p�K�m�� ��%)o��N"�) �sJ�7��و�6�7���H�T��\\��Y�L�f]��L��Z<�$���+�w�w7�X5e�*`�7�:=Zm^�#ݎ`K�벫�j������!T��˗�'��[� tI�〼SI4��2�tg�+^���W�O�fг �l���m���tS����$yY{��,����g�6���8h<��T�xR���K8�����!��-l��W5%�t��ȃ�I �G�M��&�ߛl����+b�������j�U~#��������A�������yF<�9����n_��JdbM��Wx�����M��i�6��*g2���):Ly�/#a/P���CsL��(��K�r�ӊ��0���Ԃ�R"��V9��f���o�2fj~XK��O�[Y�e���*x�Ş�������"�/W��XIL�E2�8s��W#�hL�*Nc!%U�+t@ϟL��������p���y�b_��~=�g��JE������b=���U�B<N�xZ�'Kko7�YhŠ��2��̑����2)D�x��/�;�O~7�e�F|�4*.2%$���do3 l�!�꠱6�{/�Qw�xM����V�_U�D��R��Q:��|�}�C5͵ә}��o?��JB���h��lf���T_ٿBĂv������WHR0i��%�Q���QL��+l����Y?���E�9z`�?��к���~.,��v/↿m�W[���2��6{�����p[q�S���K���}���"��MLvf�k�Dj ������U�ź��;E�҉�W\9ҹQ0%R ��RuiБ�9���6M�Vq�M�y�y�j�����q����������ݟ�~Q�s�:6�D%Rm~T��t0b�W@=-�q��rF�Y��8|Y��/K�>&x�5������=a��iv;hN��>�����^R���,w���?��h���'$j=rJ�^}�"�F�ȴ�����47��h������L�Ԝy邵��G�@r���~lڜ*˩�O�%���d�H� l�v��qւ�s~�xp���Tg��ӑ��Fk��B�>���Fw�#{7�I���D1��O�41<�\/��������(\�:ɻ�=rq�o�v�Q���I��B�4��]6Z8P����� ;0���]�>�1ǭ��/�tZ���E@� �U.v�����٘�n�H����K4��5>�M�����6!P��d_��҉�72�U00�0d�5�˭9�38��(�u�w����-��U��1����~����'6��%eI⽴�F��lh\�܌��'?tb[���~���Gog6�� t���Pgж ��}��e��M$3{�#�����w�-?������c!�~�$�ӑ�c�u�����ړb�3�h��2e�+\�R����B�.^����$��n�_��l�6U�����3g�Z������M�8�N(Y����7��g�@)n�6{�;�nfFoz����8�pn�ϑ�b���,�ҶJ���7�(�W84#g����< s)��"���|����n^QR�FO�~���k��$�~h[E��l�����{��1߉!��x!{�9.�a�LRq�Z���Dd��ͼ}���;wZ��t�4#�h]"��S��=$�r�"x;c0��g�d�}�y�^�sј�Jo-�Th����x�?�Rz�su�Cѷ�����Kh^N=:8_i��+�:#C�����Z{P�NF}�[h�E����4�bɑ�� ��ƫ�I�_��Ur*�N�)����+�z��1���6�������*�2����_H�M{��fX?��{��I8�AS�e���<��*+:0��W\�.ie���z����K89�V�]L����^p�E��,�t/1� q��)m�ҟ�-$IӳrUg��)�Ԗ}�������>���#��)f��Bz��`$]�A���2�+/�#����L�O����է$�de����2��(cJ�J?$����î����M��f��it:?dl� &������9�R�}9]&c�q �H%��h����̲WS �Jrb�F��<�7���1ʼ&)�p��0��� r�O�������hF9��<pL��5� �m %����`�/�,�፻P�����X�c������e�)���54����x��l�6��*+2�.9}�s$17��ǼQ��t����h�QM�y��ōnF�L��IԈ B]C��J0;.�cQl1#��Rh&��lp� ������������b��fy1))���a�7ex�Z�<��oT@�˻/��`2R�u�|�4�ݙ�D��XÝ�Aa�dA��1|�.�+Cq��������)@0�]w;���{Rt*����c�-��aܽKq@m6�V�����/��VY���";���?]!��f[i�1:��L�:ke_���\2�t�T8���mNq��U�A{�'��o�ӆs��v�9����5� C�DI��+1�� ��q�eJU!$�ݛ��Pttda����5$�h��hȦn)K!=?������ڀ��3ކ�t�Uc7����:�blԈ��'o�R�a����u��̻������[I��3�J/f�~����Qح=OZ��l��:@Z���$L�mL���TS��n�E�����.W��]�s���*��&��.�A?����Z���y���g5e��IiÁL��.73*�C���S�|�h�Uy0�r/�� �V��t�\�AF���u�̝�r�mZ�G���
Static task
static1
Behavioral task
behavioral1
Sample
6a94e8c26108d6aa2e2236724d215c121098ab03c703df417db7a27a15f57649.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a94e8c26108d6aa2e2236724d215c121098ab03c703df417db7a27a15f57649.exe
Resource
win10v2004-20220812-en
General
-
Target
6a94e8c26108d6aa2e2236724d215c121098ab03c703df417db7a27a15f57649
-
Size
5.1MB
-
MD5
2f948993241908bbecba30544fdbe749
-
SHA1
817304640f5cc4e36f7b0fd2238e41ec79dd3d83
-
SHA256
6a94e8c26108d6aa2e2236724d215c121098ab03c703df417db7a27a15f57649
-
SHA512
193a5db07260f63d262211f9bd5797510b1bc84ad1e9ee1b362085265a52dd6a3367ccac466692bb35b8bf86d1a61f10451831846fac1f241b61dd15a7c25930
-
SSDEEP
98304:17FpQFP3aFKYfHAgR/QAoNluUGiwQ0uAcz4O0sNXzRN48sfy2+SDGbHuY338iIzH:17EoF5hCfNpGiwWAcz4O0sNXzRN48sfr
Malware Config
Signatures
Files
-
6a94e8c26108d6aa2e2236724d215c121098ab03c703df417db7a27a15f57649.exe windows x86
c0504d5308ed5673f921e8a4d04e5e61
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
IsZoomed
kernel32
GetVersion
GetVersionExA
InterlockedIncrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
BitBlt
version
GetFileVersionInfoA
ole32
CoGetClassObject
comctl32
ImageList_DragLeave
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 173KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ