Rܥ#�l�+�f�Y�v�}fD'�Z{��b��-t+������?�-n����ү��9H>ȏ�9\S�ɠ&��-5%��h���! `��nsǹEjv[���Ԛ�w�y�9�zwq�Nx|`���@�8H�[���<.����튈��ɍ℮k��X��!H��k!�u[=�-c�e�b����|D�tP�^ ����"=�*Ԕ۬ޔ♧d�D��n���C�<�k��s@J�� �k�Y-�dz`G����y���Z�$_��?�});�l�'�Ҏ��<#3�#}��v�8�� ��6��q8�-,���T<ƙb��{p�c|1�Њ�h:���'p�rsc��6�|�'����Ov��y�X��#�,�����l0�'���u��ҹ�4D5D��Mz^�Al�����3t����`_�%q �}Z�3���K)dW�{Q���_����+�nXq�������������!\���e�;�>YL�,�7p�)��{j#S��% �>i*�SS�A��ٽ�i;�l�LόR�)��A����%��O��Z����S�ҹ�9A���/e@��Hk;��1�U00'��5;}N�2�����G��MG�����m���K��'�u��SR�,�GH�z�/*|K��&u�v].� ����;�"��q:6�4hh.�o1n����ʲ�Ckw��D�.�{�.��1Ỏ�R$l*|iA�S[ �t3[0���ߠ(�k`���mgKo ��Ҟ��Y�`���J�t�m�'�ޜ1����߂�ڀ��� �H1��b�t��}>�^�VV��* �qsy;F@�� ��ˏ��Dm%}�zҘ����0֍�Q����!�d;�_����ı=i�H?��ӑ x�OFܥ��1T�#�Pɂ:g$�Nu]�?��\0O��M4~M_�����** �ۙ!�bй�Tm��6&G�� �ͪ��5&$����u�yr�������=�����\����y^�K� �����z�<�~$��a� �m��� ���>Jj9,�r���e�oz*�K�R�lǂNd�f��]�/}Bu$ο���Uf�*7��[�|�TU_����w�d�8���։��Q�����~�V^��TC�S��.�L�f��=}Z�U�uU,�0�m�����f������(��,>� h�]��9��������Ь�.[��Գ3*X��Yi�*�bl6�����WƼ�;a�F�n���� �j�wޝ��t$�nO�'����!��Y=�}��@�(�tk����P����>+�q�k��;̓� ���V]-��Q|2_�.4���+�+ONk�;���T�ouo��������@T�<�I��'�@�Dab"?��8qY��K��A���*��J��f��AB������Ö}�-/�~6�Η4�iĎ�Dw�:�� X|� �ݍm`���x��fE���]W�w��⬐�$��,��X����Y��#5�H��e����7;ͭ��9]Ȏ���ه��3��v����+_�.lJ�����"UlP�D���3���6s��к��T����p��Y����¥V�kM)/��$}*�l ��2�Dž��Ì1�n;5���L���ٖ�:�->�m�Ӌ.4��QZ[!�P��k�u�=�['\��JB8wRC+�:|��^���T��t^ �8������"G3,%���F�����:�c�m�Yz�Fd���Ȝ)��:�^2q�&t�\�*=\��"�Q��뎫Pߞ�ì�Aq겙r�ayӔ��l���a�rY� �R��ZGFC�|,�`���s��ha��[�Mn��Nd9�L�zp)_��=(2Lj��]���j A-� ��I��Mu�p� �.� u����X���`$�� �g/�^Y0��u��Q�����y�zYM�#�j�`���~#�����Otf��M��1PZ!ȂP��ĭ)$��k�C�U��3; �f0������j���A�CL��F%�W|�����5#�|�fJ�+�[ ��͝���BVF��->�����H��w]�2,��W0�=)��}{� ��i���i$؇�,F���sl^Wg��N%�9�7-�g[Pl����xUb��|��>5����M�VU;z���"����WFdX�F���Z�35<Z����)�����,.�Pl��r�<���4�����l�w' �}�eRE9H�g�ؿ�#�����������i�Ssp��)1Nu������ޟv�b� ��&��xnjz<I���e�|n���`te8��-1T�ુz <��:�p���b<z"�$����r�T �[$K�� ^Y+�b�_\^�ɴ���vOO��c��u����cB�&��K�T��R ��|�IB�N]��J]Q�y�������u�/����fG��ԳIOE1��=�2H��ah!fKr�J���J���6SP��p��wR �M��� ��ȇ5n7O'��ZT-������k�{,-st �!��̋��a���L�-�pI��d��`�C,����S�D4-�^�v~�e�+�]�mȒ�qx_���"w���Րs�Ũ��+���4˱��}f�pW&��� ��k����wn��f�(|��#��*Q2;p�~�U����Qw�y�j�,&':�B]+~,���!o����G�e�^�����f��{�)IR�+�o�P��Xg9�z���Q��ys�e_���&���\����4�����C���çXN�M�mz4;�N�B`��,�,&�Z8��e�}�cK?6�)8M��(�������Ô�����}ݔf���B�⍆��(IyS�s���K�H`������I�[�4�`k��mP����v��H17���kͥ��Aߏ�?�|O�;�V��*��"b6�����ť8��Ae���?����^I��h��C�RδD���ڍ�<�;4'h'�^�0�0���I���ا�Q�f���nf�p��c�Po}iR��7��j]�M;�(A�6g��Lz&/(�w�;K�3a�������h���:C+={��omz�����KjƄ��A�����~ �C�Q�.��o����x[��ɀ ?
Static task
static1
Behavioral task
behavioral1
Sample
d2f8be759d15045adfdbc545d8272e4d9b07bb6878cb12492c1b2e03a07c79f0.exe
Resource
win7-20220901-en
General
-
Target
d2f8be759d15045adfdbc545d8272e4d9b07bb6878cb12492c1b2e03a07c79f0
-
Size
996KB
-
MD5
3a02eafd977ddf9e672c9cf40ebf96eb
-
SHA1
07450159d56c5f7580056b405df097faf9421f20
-
SHA256
d2f8be759d15045adfdbc545d8272e4d9b07bb6878cb12492c1b2e03a07c79f0
-
SHA512
d46f3fe7cb32cb61ddcac4f3ab4e5ccabd34f4be2231edebf594ad2c3c09ef6e302a46787204ffaf9b97f89060fef0cf7317aea3de9e987c31426250a83c55b6
-
SSDEEP
12288:rocklb1VDO4akMrVPuahtA1UI3s7ABKDJ2UtwGfbQtdTft7Cwv35CI5:8buOMhPztS3stDLwddJCO315
Malware Config
Signatures
Files
-
d2f8be759d15045adfdbc545d8272e4d9b07bb6878cb12492c1b2e03a07c79f0.exe windows x86
51e649ae3cd363d9611d97ece283bb12
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2614
msvcrt
_except_handler3
kernel32
SetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
gdi32
CreatePalette
advapi32
RegDeleteValueA
shell32
ShellExecuteA
wsock32
WSASetLastError
wininet
InternetGetConnectedState
dnsapi
DnsQuery_A
imagehlp
MakeSureDirectoryPathExists
shlwapi
SHDeleteKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.asp0 Size: - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp1 Size: 984KB - Virtual size: 980KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE