Nn�b���ds�g`m-m�`U�G�����߭��&Za�9)��4�x�Փ3Õ�9ꘈ��5x�Ͽ]���%�S���0�2ӊ��1`��B����m��Y��AF�~M�2T~v|��q����W�5�N�KW�,�#��1L����δQ�ã $�6MP��m��ƣ�iS�H�%@u�����Ar�j�<����1��j���~H� �ϡ{a�K��F��������x�ۯ�CM�� �ǰZ�jk_�t++<��*r��b��K}י������ţ����g��hE�jf���y`��� t F=�ڐ�&g!�]�%�bQ��4�aZY���V�w>_g��t���l�C��`��rxu�y��"}""eT_�������A������WML�g���R{�g�N6+�������tb�<_�3o?G�A>:bml<R.���nÉIqꙛ�=�3Ֆ�O���� r3�l���̾d����7 ��7�B��y��uH{.e��'�C^&���x�?뮩��N>z��Y��u��q���tKvS�Q:~�R}��Wy0H�����+�U~R����;;��O��4=ov͎�=��M����X8E�\aD���Q���7b�!1��i���ؑ��?�� �2LiV�TK��q�����Hu�%�[C��}���hP� �&RL,�;]��B�hQ9�2�Θ����.�At��v�[ U�R��l��#�����N6�uN�B㇔P�n�v�Ћ����98q���P��mC�$r�[��u#����_�C� ZEN���9')w���oJ��w@��3�4�)<A�3���v� [���v ����Z�Ovg�ưl�hK{,�F���7�Pf�� 6| R��2��5ѣ��#�ޭ�>!�rd�ἬN����q@�����)��K^�F���R�� ���<5Vop]q"O\�����J� ?M�pY]�b�$��fRq��O��U�u��p~3߄����}���1��fI���~�V�L�ƧI v2�Գ@�6�!�T��F�]��O�Jl���)���]7#e�F,T^�$,��)j�_���0����`�AyO :n����l�m��>VTC�v���c��gu�r5/��j�A_�2����c����.O~?\x�{��+�:�/ﴎ�u�o���EY��M���������U��~kg�A�V�����N�^���W<Ws�8�M2=1H;9���'�F<�����C�Z��b��?����I(�T��a�Fz͚B�6� �u�K�-�#��ք���F���Q�6#�a�f�i�x�BxIzA����|.���hK�TD٭�����Vp H�bn�7��x�#��&�s�KY|���+��9���O�o�����5�+��wc��,������?�@@�$�lI�`���>�z�'(�>.�����fb�h���`y �+7���9�I����0"����/B]�����V�6&����3����.�q��\��h����/IP3Q��*iC�[�&{���{l�u�]�]�H��嵇x�+�WGR߅����A�_>h�n�Q�0�$|�1�v7 ��$����D��� ��O)2�T(m}��af�8~����xC&��]� ��ږ�9엃����7~����d��-���F,|y9=�Eܓ���(U��*?���MM�v����x ���e�k'�-W�a��Y�:o��o�^f�'_�rֶ��%F3�ɩ쏻�T�2;_�a��2��=7�EcZX-�s�����@�,F*m�sK����� p�gq�^U����}7�ϒ�4=����f�.9>:%.�0h�nJ.c��;�&�eSlQ$��Ŵ�I��hB9}�r8Ar\�}�n���ϛR��ƺ�yh}�0"�Sgb��u��k}!*��H�2sr����Nn�2��a3�����Ps48��L'�.{�g�DO�H�� K�pb�\�:Ga+��,�~��߸n`c#1��2u�\��P�J���`$Ov:�S�i�cوؼ N� \%�2�/ �֫<��R�G���uw������Q�ؽJ�g�D �U���"�S;n%�����(Kn�� �*`�����Z���oyTʊ�y�D�u&r�����[��ײ��J7�����v^�y#�>��0�1=�F (P���y�7��B����JM��w'�������~�"v�&�I[^��>5)�X�ɕh#�;����F*�J����̡PQӞ��ƞ��X�!�`.;�Z����x�b�:ğk��x���A���k#!��J�^�Ī3I���ϲal|k�Þ�rV����ҥ������T��f��]7-ҹ>��7)dJ9�r9��P�A�_�BtIPjh�?Ɨ�5 X��� O�mH�$���c=Υ5 �I�e�Q�y�͟�/aV֩P���!&�������`�`$H��`�D�욝{��pQ������_Q����ڸW�� si�y=B������DŽ���W&���UGϊ0�e��7ӹ�����Xaњ���_�K�Ou����PY7�`BVG͐oᘔ�*ɋ�Y���?� ���m�% G�qұ�%M����(Q�l�9E7�SH�PE���<m �._áj�(ni�Ds��"��ߟ��L̐f�曕x��6����.�/"`�Pe�+Zk�N����ӎ�1��,.��g�F3�Z�q�c����M�e��ARr��%�{u��h"z�uP9(y �1Y�4P̈GyS��Ƌe(�<�8}�o�^�RFoI��)p�&�v=��!�=�1�D*�58���+��:���+���Mi�E9�Z��ޯ2��Qn{h0ڪEG�[����;��B�2� �9hT�G�tS�����B��x�:����$�>j*�O��PW�(���V��T3�H�Ip�ߪZu��/(�X�H�-������h�<���e �FR���D��������]��E����qi�%�<3���U"��C]5+�q�{�pj9v�l����2ʹ� �p��� ~fd���6�O [^��лKd����V~9*�y��=�!8V���}c{�~x�pLR$ݧ��p��ex���W�
Static task
static1
Behavioral task
behavioral1
Sample
06aadc164bf9470baf90b148b0b65896f2364a18621987d64e113da9db31f8e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
06aadc164bf9470baf90b148b0b65896f2364a18621987d64e113da9db31f8e6.exe
Resource
win10v2004-20220812-en
General
-
Target
06aadc164bf9470baf90b148b0b65896f2364a18621987d64e113da9db31f8e6
-
Size
1.3MB
-
MD5
83ff625924b21b7296aaf0f4e351eaeb
-
SHA1
25e1db90d2fb02b2fad9d8525754b93356206c5f
-
SHA256
06aadc164bf9470baf90b148b0b65896f2364a18621987d64e113da9db31f8e6
-
SHA512
41a249bef1b39f2b4b29bb2e0ae3e4a3128ec01a8b983381c7047f71ea475d854a2ee9ab38044d292ea0916e97a9bed2c7e776556ac9f631fa0edd46a346f23c
-
SSDEEP
24576:9hTuCEaQ+6bkOM/Xj6bZpTwOEwjPQLS+qMjj4INsVtAm1D7z8CIR:9hKzV+27Ewj/Vp
Malware Config
Signatures
Files
-
06aadc164bf9470baf90b148b0b65896f2364a18621987d64e113da9db31f8e6.exe windows x86
f5799fd4dcf863605b818e3a4c571a93
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
comdlg32
GetOpenFileNameA
wsock32
WSACleanup
Exports
Exports
Sections
CODE Size: - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Mir20 Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 688KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Mir21 Size: - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Mir22 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ