q����e�i9"H��/A}�C�VF�Vc�Ua��ط�H��_�� ���Q���|�yZz9}ή��.������^�De���$�wPFyd���S�}��� �������ЍuEī��~���+��a���gla�w�Y�a�Į;�{�TB�`�,��m���v��K�W��;{��t𡑲�(¨��k��R�W�1ୠ�h� F��À|(������$�RúqL�*.f��� ��i��a]9_��+/ŏ��y���0��u ��Ώ_��\�;������o:�ӿv�8}9��aMjY����5�8Y�?�"EK,9�-]j �p7R"�!����I�A2��9 �OH���R��:�R��k�L���@���m�y���SC���İb���������eq1��e�4���~o�����4_�����ty�����. �NAk�Ʊa��T��af�}����8sC�� ��$M�"xx��SiQ~l�k������ �o��hmS|1je��������{y�6���� �"���ٔy��~ 0���y"T{OB�h�u��v$��O���+��3�Q�N ��������@�$����bQMW�{͍bCeZ3gއ@3�ԝd�?,��7wi�|�P�.ggK�J�8��Өp�6n��j<_�+F@�`���؋0��u$�e�1����p���z.����3�c_R2�f3�sy����������'���u�W�G} �{��ҥ%%�$o�sïw2V�������M��j��ׁ�bѺ���fuC��ھ:�?�i�����]z���[���]�7�x�H�}䜋�ڼ������~�ojȔ�/����l�:9 ,��Q6g��gTJ%1��REdjԈc�#���{��y-�1����WI?�ٵ���4�6������ʽ�O3���7+:;� 7�R���Lb��\��Q~|�F~�$%F�?9[(M��Ƿ��Z*xn���r��yq����-hC�Mb0���f��dO�_�"u�2Ե�်�pu�f�.�ǰ/���9'�e�h�A��R�iG�Y�t���_Sk���'*�!����5�q[O>�����-������������F�_�����������:N���G� hՑ%zm���$��z�n]R<M�����Y|�Pᩄ!��M��[��ϊ5W[��� %�%[yH�pX��۲ʈ��)-�°�f8q������f�+�f��&F�[�6����+�jI�F@u�@�?o�r,�3����XqR���t/�5v��N��%�L}1�Kc����|�HP�s���r��jIv��hy�R~������E��aw��Qi�!K���Èul�q˹�I8���9�A3��A5}�����M`�s'D:N�w�q��c0����2��WA�<7�% �^��ɫ5��F�ݤ*�u��[YE|��jN=|ć�>>�1�B>uW�{�$؝�0T�f����/��//q�]�O�gj�:O�&�Ĥ��oE?�Q�=��K�����`��v_o_����3.�ڐ�# N�"�H�� \̮B���@OnOKy7#av%������ ���{%�����L�ä5��N�z��(�d�8�8'��d���^?�Q>bE�D&(��9M&ҧ�����i���y�"DH����\̳i%&0I�Y�V T��"k�qn��5<��@�m�5�Y t���ba�p�I�g���4Kè�{�9��%c�mm���U�]�v������^�v�=�EiƬ��y�F�G��Fۂ���-2~�p<�/�Ă{'�f�����Yp���ZG����WM;���]���Ğ1��i��v�)�>Q��bm�Ǝ�T\�"������� ��y���>��28�>0����*�'p����S[���^a�4�j�Øh�wJM�d ��"����w2r�̮M�8~x/�::�:�P���=��g?��*[-#����Z�e#�)�����E�6m�<�g���]��*��s!�#1��2U�����/�h����J��>�������&k�3�h��7g���E'��O�M����Ǎ���P��@�}G�n#��a�����PL3���=);��wS����ӑ��֥�JBy���K���j����v��҅J��J,�%���!7���ǵ�c���ßT�5(I>E"�e:{k��7��(Q���2r<��I�%Gi��ɲv.x"�j���zMN�����*Q�d�||Z��D�JY�Mc�!7���k�S8�9�u�c�N�-�t|l�#Ҝ��!ݢ����*��@� ���/����7�M=�mw�(�G�U4����ا��M,q��ʈ��4#�[2:|�DIX��^�\]5��-nP9څ�zc=�-m�*n����z5½=?[�M���0������b:��8z��m�,x舖�y��M����Y��y��o�Q��M����?�ڊ�X �> �`�2��}"W���g�b>�[��-���̈�uVS>��m4^�g�Q�/��Z�$n�H�PH�[K����R��r0�E�9I��+2I�c�mDy1�����0��2��ʄ�R���x��d�xR�R�)s�� �ʵ �ڻ������{���i�A�>��L�&��<`�����,��V�<"�3���_Ǵf �p$�z�+�>ҟ��H�l��?r7-����f�uB���zp�4bZ�(?�>ܤ�3=3����#-���N��������:���J�'��4���D��G)��]/r ��#�hD���[��g���4,(I��B����!�L� 9Ӂ�ޣA���ַu��ke�.�$n�X`ha�ie��d�'%R�4K�����N6�ZY��<шX²L pi\�%����:i��b��zW��Hu_�-CJ\U�i�Fm�K���_JS��J��.�Kute� � !G����ڥ�+�p�������vw��f�T?�� H�a�踉;�R�p��O��8�?��m���d�x��L���_����k����1����uu;� �|4� PHB�r��k@V]�X��&��R4��Ő^v�/����D�6S�>B�3@Ҡ�@[^�R6�Ȟkƛ"����8fN�9�
Static task
static1
Behavioral task
behavioral1
Sample
6571af8793ee1c62a38b68aaec3a3a7eb531a359e8358c07b5b82b3e119904ef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6571af8793ee1c62a38b68aaec3a3a7eb531a359e8358c07b5b82b3e119904ef.exe
Resource
win10v2004-20220812-en
General
-
Target
6571af8793ee1c62a38b68aaec3a3a7eb531a359e8358c07b5b82b3e119904ef
-
Size
4.6MB
-
MD5
95644b93c57bad6396d3162258dd07b2
-
SHA1
e4ffb88d5714f2e99b6c4135429489b0345914b7
-
SHA256
6571af8793ee1c62a38b68aaec3a3a7eb531a359e8358c07b5b82b3e119904ef
-
SHA512
268498d5637d9643c7520d29a1aaf84400ee10ba82fdd0987e96e97150ffb1432e131ced365b08458d2afa623a9e6ce589c076aa769b0bdab8bf962ac47eed99
-
SSDEEP
98304:J6FpQFP3a/E1xzz8d6n9O0tiH8h5Bg+fea:J6EoK2d6n9O0t88h5Bg+Ga
Malware Config
Signatures
Files
-
6571af8793ee1c62a38b68aaec3a3a7eb531a359e8358c07b5b82b3e119904ef.exe windows x86
acc0681e5672f3ea43d03beab7d89526
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantCopy
advapi32
RegQueryValueExA
user32
CheckMenuItem
kernel32
GetVersion
GetVersionExA
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetEnhMetaFileHeader
version
GetFileVersionInfoSizeA
ole32
ProgIDFromCLSID
comctl32
ImageList_DragMove
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1017KB - Virtual size: 1017KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ