H�1N���N���r=r��a�q)~������z�8/���@{����-p����,E�!p��\@���%�~��R&ِR�e��b^����nl~��?�&Vu�r�?/8b�j����r�G���-��~g��g:w����#]�P�pĒ�t�luB@�S<&��� ����£z��*��H{���"�y�X�#C����u�h���V�.g��zy� &�dE���m�^��P���s��h�Q�H��a�f\Xh cI��W��ă�Ɋ�Y��(���݀gI��\Lu��rm@�w��Y�5$z/1��<�i1���I�U�W�~�Q�Ml�*��}������[`�@<<������!���:}�![YX�DV������Xz���@��E�Ub�����H[��鲍4ѪS�:�����>j p�����s���A�^kI3����_8ޤM�]_�� cq�R2�W!o����Z�F�����3[N���/�FMc2��CF�0�&>URD }���>�H��lbZ�������U���-�o��`�n�� .�%3�&n@T ,��w� M����D�'���{ۢ)��ZS�I�د�£S��oY�>�,3ו@_Z�c��2%�偰�J�BNL�?��@#�Kb���%�+�'h��PfOH�yו�u=4Q�=;�@��z~K���41���6#`�C����(J#��6|8� �,�E�k��(��7=������4�J�+�0R���YM�>:���R���h��<�3:UEA?�����KuG�A�y5����}��b0��G���υ��ux`�y�D��%<�M�F+�s`A�AR�T�����Z�V�=��yY��4���!&���!�CI�w�Ψnj�Q/����j�;j��+����a��<l��b�[�,V�&;�5 �+�ZhtՃ6��������ҽl�+�ζ%��@3͇���O���ex�}��-�~�F�Oe�a�z��X�gS�K-��Y��Hj,��\+F��,�03,o[�̢�@R��Us�r.�dnL\s�ٔ�:�7PJe��:��\S�y�*���?w�ڸu��*�g��Q^>Wמ��oǦ2���8�0U�ل�����V8�>?�@�dO۴>���,�)i����>��&0n�����a.�ļ��{�9�>����Zљ#�4����1$@���7���fk]@V�:)����n�,ɫ����W� ���+�'֮�W�۩3_%ȳ��~�����/S.s�T��J�is� ����+lk!�G����{E=�)��7p�� �gN+J�Ǵe���ˮς�2_���$�f;�z������������+6u���W��f*��&���^�C`$9�o�x���+Gڃ�$=�5�u4�"]���/�E�w0�G*�DI�f(Ѳʾ�|�~���$H�b�8ЭJUf�9K�+��RKI� �r7�#K�=��i7};��/�:��'�����T��$�rSS�ՠPdH���z���vyg��60ќ6�VQ�IW�?r2<���(0r��45-��&�v�I�6��y�� |tk� U�+f��꜔�N�kvI��B.A��+�� 8��9�[z��2�B:&����%����B�磍����ѷJ���D#EZ�5�[��?k�Z&hI�O�w̰�.�i&}����˒���}7��R ��+m���pH��D�-�S�.�L��n�O�q�}F/����=�~����V�A��]�o�#K���N\:[�tT�@�$����B��[����R�OSP�uy��/]��~��Z�}�0q�*>����}M�5k��6�f|6o:+������d�f����wĈ�!��8f�:`,ƍ�4��-��m���,�Q�5xА���('��6ݔy93�<8�g��V�zIg����@��ahB:o�\�4���+�w;3�ϐ>�\� :0l��s�������]��F���%����0��!U��kg7��cC7;��|��m�!��I�����J��������g��|��� ./�/.�R}ъgH����V��W&ɞ�W�T����F��a��6=�u"���� �бٲE[�uf�q��C$9 ��*b+����Q�P�JW2�N���E��K��!��<�:t��ʔ��eh��B�i0$h4�����P7�' ��~�&u���]w��ᛙk�>��G����oi�Fh�v�T�@Sa6>��^ �G����M<%e�zm�)�@;�oz?��d��=��j��5wy^~�� ����ΰc�jT,���������?�t����-6h�ܴ �; ��̍L�,d�������J��v!�_����AZ�'��N(Ŵ6́���X�bB�B�r��+����^��0)�t4���Ʊ#��1dAh��"���5$)�,�t?��`�F!�f�����H\&Uj��gP ;=�~�k���LO&|�`�<������-��\�t&�,�D�3k��z��&�*[�hNg�G�:�҅jq�~I�/�W�xʒ?��>��g�����~������;J� Ng�&��b�M���*q{.W�ko�1���m.w�V1�)$�K�C|�?���V($���Z6$�Q�[> x"ɦS�?������P����,���(�/�5��t^TP��nD�Z ���k/���+�ט��<(<0�a���:�'�|�D�$��dLؤ��� N�x�U������ݍQ[���r�����s����*u���$+]kYv���Q�G�}b%6x�t�>4�b���Z5�{T��Y���(��&�����P���(�]=I�§9�)��K|X`��#�~ԣR[ &�T�rK336��QX�>�B��8�7��Y����*eT�ʹ0{�}>�=s� FiĦd݀^z/��4����o՛[_͊���h���ᕑ<�C�G<=�?���� �4ʞ�%n����M����h�LO�sq����,!gR/�)��f��n�W�yY5�mA~GieQ>f����_���8�WLj����p�Az�w�]������Q<aK��a`��>�%o�H�/�I�,�?�Q瓨di_��ވ<ق-d�2�� M��r��0xnիyc�)ش��� i����vS������r�~�*�Ʈ�nD�1x��$ռ@lI�)�r�B�p\�r�&u�n�®��_"�����j�IX��Q��Q�o�̾}b���l��붂��AP����+��� !�Q� ��@و��`�p1[��ҟ�K�6bbLռ���l�.E'$Z!������齘e�c��(_�;�P�(��qل�y{�=g"t����C�'���]��-/��:l�=��Z��3��j��o.F��2�Z_F{x9 ,d�IZ�Oߨ�Ca�=�_���M�9p�>���Z�¢:����>n��6
Static task
static1
Behavioral task
behavioral1
Sample
c36ff363736c48bdbcba4ece62ac0719992d908f78b728fbcfa57288b431e3b8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c36ff363736c48bdbcba4ece62ac0719992d908f78b728fbcfa57288b431e3b8.exe
Resource
win10v2004-20220812-en
General
-
Target
c36ff363736c48bdbcba4ece62ac0719992d908f78b728fbcfa57288b431e3b8
-
Size
1.2MB
-
MD5
5de271a3195275c4d11e2db56930c74d
-
SHA1
17cca111144a4058a4014cfa7a5b7cf26f28da7f
-
SHA256
c36ff363736c48bdbcba4ece62ac0719992d908f78b728fbcfa57288b431e3b8
-
SHA512
0e17d99a3fe377aa47fcf7f7a8f334539b7a7c24dd9c7065f99def577074c61a5cc615267ced12abe1d5a47956a5827a70ca7a6517547b9c5a29d51b2d3613db
-
SSDEEP
24576:1XCOonA3PL+MX23aNYju+1cD1zoPe8YG/YF5Z1rjLdPOsWHvLaSXKH:1vkSasGu+1a1zmkG/YF5Hrws6a+K
Malware Config
Signatures
Files
-
c36ff363736c48bdbcba4ece62ac0719992d908f78b728fbcfa57288b431e3b8.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 166KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE