�sK�K��_�}3���A�nR�9�X9u�#�Ą!����8A�DA�X�I�5͒Pl��X���L�[!�eMrj���Y�/�$K��#-̇&��v��ey�S��Xzy���M�.��7[�3'��/����j��F�9�a�%a�\U��*���d&A9'5�L/dV IV�@�$B/�����m����;��tB��˘��-�yG�t��L1ixͥ�����!�$�+�\kRKu���Q�v7��`�����T�>��Ǒ`a����}o��D�e֟���,���|c��aʴ�WI�C7�����q�b,fPCX���˗6��,̓�:��Q��ǣ^��f�7$�N?�Yذ�V�qTy ��c�-�ڭ�h�R��1]��z��\F���K�ǎ�[{�#���YV�әHT!�q�]Y��^�`n��m�b�����[Sf���L��Uw�X΄����fg��U�?�AGS����?&y�uЯ��l�:�� �k� �.��ݱ��맛�A s�C�`��9�_`A�Ұ��:g蒗)��k��vP�B�0f���8Ġ��X$�cmS�qN�ߧ�� w���Rɏtg +ٻ��#蘡�%�!@LXo�6*���Z��I��C�S�w=k7ݜ�:�(�#P=�ۢ=��`(8)VE4U-1�!='����y�'�w(�dLYH �PH���� D��`2����C/ ��z�L�O.gFל搳����Lgv����-��]�NR��e����Ǡd��cY�zl�5%i�>,i<v�X�)���o�M���b��\�c�N����;�������w����xaC�͑ �5��;9��!!��n��|�#���pʌμ{w����}�)R�Vm\)��R%���@Z^���}��:����2���u�]����������L E>��S�ڽ��(�ò�O�z�{�;o?�p�����2ɒ�x�Ey�������UA��ZV�!r�/�J�OJ&7�@� b�Ai�o�*��ڂT��Y��y��'��'~݄��~5k�P��og��hۣ���֓V�9XԼXc-�|�m��йڛ���6��� s���Hۺ�rھ���|3rh��&��z>���`)��l�q������v�4�:V�o��rT��4�v�]0�f��QM�h�C�����<���tܝG"OF�5�Ra}�:;����A�G6�����9�}.Xe��8�ٸK���#*ޖ�|X��ٝ�t\���7�@����3�U-��W��]��y,l��MTm�u��IZp-�F�/z��L�4�ky�vP�|ݡL!�:Z��m�Y���e��W�� Y�������}J�w�A=VJ�ʱ!� *b�_Fs�> ��O��A�T�U�V4ז�ʎf�U�7�b��9u� �lh�з�I�=��I��xD�hk��T��t��I��XL<�4���wt����`����1P�����`�?1��,����C拏zP� ���iv�w�=����5fQ*�Źq̎?\,�)��LZ���3���ypFp��p�M���}#��3P�2���{hv�p���\��jC��! $h�k�# �hQ~��[7�j���&B��7d��ʝ�=��*��W4�<TF���:�M���Źh�v�ՒU ��Ck��yR}ԡ����q�<݄<BWɵ,���������Q+սO���}$��6vE%��T�i�y��ϟ��œ�u����E2���p|m*c[N��ֺ�I_s��B���(��6��k�8 !�O̙I�"����¹Usn��]J��џ��{�Ǥ��*�����1�j� ��� Vak.�_D��ϙl�m�[��=��/�m4���Gг|7��?�� [��J��Kv�nV�m����8�b���+����0�*�ۘj�}��R�.�a��ϣ$��5&9�+��}�!��qI�]�3ϳ����������Zw��L&AVU��9������,����l+0P[R�ý/x���fH_�I�����7�����w$`|����՜�����u�����z/��_�o�K�JУ��V�v0�e��s"�9���B]�1Q��dPb�[���1oֳ�R�b�9��j��_!��e�O��;�3&�l��)6ι�Ԡꙟ����t�c~����xﲼ�zlnMu��xP�}�u���{) c'� �#�2e3���Q��"�I��G+��_�7D�n!Q��}�{O,��$F#��� `z�M������T�N=3��C��9�n���n�����mV�H�K�������Ot�w%�? ��ow=������ɜ �N���<`��s�2+*8`��Mհ�����e���*�x�10*h�n^!���wY��#*K=�?�����Eg�S�A�C#��YoF���@�x�"ȪN�?H�)�6� ꇜm��t���mЛ���TP_����h�sy�_�Ή�#c�w��4�@FqPlÔ:�87�@&S���� ba��Ah�P���y<���e��w���-�bm����-' H��v���^��N���9�z]�_5~�y+�2t(����]=����ͩt�Z�܁uo�p�j�@���0�T�_2�aW��4j��_��֢\՝N�E��&=����Ɂ�s����+��C��؎����E�^\I�g��{uM��q� ���)o�3-Q��W���Lz������>ƫ�\S��G\��\u*�sHoB�88�G y�1t��5pP�C���8��1k߬.��z��e�e��Ϝ+`��@~������M�<���s�QJٲ�:nV ��NsK��j�Q�2������u�x��/#���aJ(�K)���Xz�P�Tł�~g���Zkjy�����K�j��o#��h��^�~�z*I�8\��p����FC�0�grbg��>�X��%��J��Ϳ�ΔM�8�b�E�4 �n�*j;u��tZa�9�ݬ���1��&�+��<Z����$�'�R!�t�@'���l��}�"a:���o�z���Z� ����A����<���Ⰼ�p7�9�Eo�E$���Sfn�G���jv"D��D�"�+=��ܲ�������tߙ���
Static task
static1
Behavioral task
behavioral1
Sample
cc0cc8b13b442d03492676bed66b5caa094b387d90f1dc6cc42d1f52f51e6040.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cc0cc8b13b442d03492676bed66b5caa094b387d90f1dc6cc42d1f52f51e6040.exe
Resource
win10v2004-20220812-en
General
-
Target
cc0cc8b13b442d03492676bed66b5caa094b387d90f1dc6cc42d1f52f51e6040
-
Size
4.7MB
-
MD5
55e7b1d249e0152689a7b63b6c0411aa
-
SHA1
99b49073e2a5a2694e52b49b1646841d320e2227
-
SHA256
cc0cc8b13b442d03492676bed66b5caa094b387d90f1dc6cc42d1f52f51e6040
-
SHA512
38cc574b3e2551d0e3c638ace8dde394fe407f328245d3d66482a81d2d366b1ba132f3b56146c273f27a624cbf8bdcf81c54dd11ad17dd40e7a3ea7c3c537c7e
-
SSDEEP
49152:SmjsF7PN3taRHFP3clnBowIcs8j+sShmCpT4dCxZcVgB0ITZyS57VlXF8D/QL5jN:SnFpQFP3aAcd0pY8ugB0IgSRVcD/Qdt
Malware Config
Signatures
Files
-
cc0cc8b13b442d03492676bed66b5caa094b387d90f1dc6cc42d1f52f51e6040.exe windows x86
b58a442a3ace379182d49afde566fe8e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayCreate
advapi32
RegQueryValueExA
user32
IsZoomed
kernel32
GetVersion
GetVersionExA
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetDIBColorTable
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
ImageList_DragEnter
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 171KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ