p�K����rl��R���Q���n���n�!�N���@Q�%�W����%+�N�0<"�y��WhL�J@�2V!�(=�� �*wQ��q�f�_^�Vg���-��A�������_�������!�Ǩħu�C��0"����2]n�k[7h�ZQ�g���xӷ�TlqB� �ZiqِX�n�dtr�y�@�T(�#�zCO�0xU��*}�t�-���V���$�O��ONH�h�,��#���摫����~�d�boGx�QI :���1�/�.�h��陠Fg�-�E,P|�/�4�9z<���ęr���TU�\��(".��b+��Ǽ��Ix�^uY���g���dž2����Vx���4�J��CŞ���:F���$8@ ��d|�~m%� �-EƂB\]džg d��ׅ��vh���ߡ�Fe��#1���e{cW���:�=���gؚ��,�gz8�*��Ys�FpNS�YvO�D�W�a�W�Rp��Ӊ�]<����~�?�t��������ɯ��H]y�����u�zYHB��!Y�5�CV-�w�Ik�l.�J���x���@$d���P/"W1��!W�U��jp�~s{�M��C�/~&h��vh'��yk�H����#��l�ٛ������#θ�����0�=��n���SO��R;�������Ϣ�:�_g�I1m��e`~�eE��Ab������;����h���>�e�+sM�){��`&���B��|z���Gtֵ�ݔ�ص�q~� Ix�����Ԩl�q9�_�n��k>Ez� �l5��T&�D���EQ߅`��3Փ��;e������i���[��Ϡ!x�h'���/�^TԲB㳱8�e9g ����,4K^�g�B�S� ��������V�ϋ��Ȧ�J��g�-؞8f=yᖵ^��^������A���+N���]�ѾԶ�n˗�(}�<�F�a����&��=��:��n�;���o,��-g��$�.?T�'c�wJ�}V��_�p|�)<9��$��ʇ�֏���_e�{qۋ���&�7�"�?iU�����*ij�rـP����\g�E��#,n�������H��͔���`�}���3��s�i8ۙ*9{�C�!)��۔��4��CZ�7`��9_���y�E=���w{�Cͺ\Z�n�Nx1���h�w�����8��T�˷:_M����S�<� #�ω�#p�q�+�.;�ra�e�\[�����kIb�0U%걧Im5�Ѫц���5�V��4�0�����M� )z�%Q �����4��g��t����Wō=X���-]�%�Q�(�Q���,����h�i���,喠��t1�٢\VS���ia$bz���0π �j�$o��� Ym�3�ݳ�0I:ɝt7�a��eueoXغ�DE��ԛ��q���l���I^i4�� *�k%=��m�9`h� ڠ5k\�&�A�����J����A(��5+ 9��/z�T��>��D����"����e�S��!}���[ֺ��QY�`G)%J�����T�0�/�$�|Q��})`�'���|�7-�|)�(��r�ii�����qf���w��e�}��M=�%&�禗4��^�����u�� ҎB=ы/�7�?�w�΅��"��k�e�@��A{�����G������)��7O����H7�K.Q*m�!i�|���g�_�ݥ���� .5�H�G�?L}�DH4�I�B� ���Ʀ����c�Ml�XY�B���O���r�@�e�� �e�َG@Je�c X |�!� �� igm����"O$b>�G���zE�F�(������{�;5�����Tk#��V9�������}��@��k@T�>�W�*�ⅹȴ��f2xN��wK�v[{�S�Ch�>��nS_V�Rg2��g�"GP�O0�`:��Q;HcJ�;���b��q�k�*E�J'�z�-�}�qO��W���i��'��W�����ݟ��������ɍ1���3CB���d�A�OS�[ �ZI�CjT����R3�$է�l~������i�l����{��C��+�v��k���n�Yz���[��-B�&�D�����/��n��{��b}��7�Y�a1v�j���(���笢J;|��ⵠ��b3���N�鸹Z��X�VH�&~Q�p���|�C����jP͗^`;�!�G|��� ����>L!�|}�6�S�ӏ��5�i�X/��,h����P@��k�!P��x��x|&, :^:���XE�0/���TqV&Ѽ��ߴ�H���D��a��f0�;���!`'Z�'�Y�/9��>R*��A���#PP0�=Vț��/�(,{� 0�*�����CjYi�����?i/^֖���D��}�ҷQ�#�>T �Sʯ[vT�x\��T��p�vތ �r�<@5�����kծ�`��x���/%�̯���ȇѫ�2��v;3J��+e��gձ���% ٞa36�?bg�|�u�C�'Z�f����s���?�aKqo^%��1��C������X���6ų�"���wo|��?mJ/�;�:��|�|k�Fx�НGD���"�o�HZ��.��X�x���T7wo(�~-��;� Z��ק��4�P=h,=�*�Ɂ�68,������� �67�������6�`�Fz�_�8wǹ{@q�0I�c�����Xc+�"��� 2���m���v���:��7I7���Ԯ��3���f��ÒZ��$ӓ������z�< W�`�-�o����@^��(�0�_��z�z��,M �I�$�}�ȟ�"zu� )c@��mm @�=�Y>'��n��M�!w���Q.�u�� �K�@8~��Ӫ�)�3�=>',�x&CY���T.fw�i�&�{Kk&SAw��4g547�Kk��np����<�D���qj�� �����.�{kF���4��� n��G >�p?F��_����TV�K5�)a�ty�W>��&j[[�m^݁9{dD�C=+��8$�I�Ѷ�DT_�y�����SN X@�o��u��c�6}�䠢=k�lH�9�ma��=����b*��c���
Static task
static1
Behavioral task
behavioral1
Sample
fb9d80250414dd812070d35bdaaaca4e71ab7d5c238a23be0427b29afe60bf92.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fb9d80250414dd812070d35bdaaaca4e71ab7d5c238a23be0427b29afe60bf92.exe
Resource
win10v2004-20220812-en
General
-
Target
fb9d80250414dd812070d35bdaaaca4e71ab7d5c238a23be0427b29afe60bf92
-
Size
5.3MB
-
MD5
9452b28abc35962c4f554d72c9b3c015
-
SHA1
e5772487a46c9c158a38ee1bc4ee93a2bf0dfa49
-
SHA256
fb9d80250414dd812070d35bdaaaca4e71ab7d5c238a23be0427b29afe60bf92
-
SHA512
5e92fce38df2d6e170168737f6ce15477d96d5036cbefe68f3e984f597844d94d96b157224d55d37d80b8789d69157366e7cb7797ba93c8904cf46307dd4132e
-
SSDEEP
98304:oIFpQFP3aZT4MGKiFaEqy7VQdSU36TDDzze71WVAVaVShB5m:oIEoZVGhQUTX+iAVaVyB5m
Malware Config
Signatures
Files
-
fb9d80250414dd812070d35bdaaaca4e71ab7d5c238a23be0427b29afe60bf92.exe windows x86
3aec256ee8f6fe1b504e5a0852cbd96e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetLBound
advapi32
RegCreateKeyExA
user32
GetFocus
kernel32
GetVersion
GetVersionExA
HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
ExcludeClipRect
version
GetFileVersionInfoSizeA
ole32
OleDraw
comctl32
ImageList_SetBkColor
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1006KB - Virtual size: 1006KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ