���AN�L��C��x����Ts�as�͐�EF:lb Яy��#S���hU&�!�,��Q�N�+�@�6��qF�+����_�hO�v�/��Kdp��Damlg���F�G4��L+�Cȵ��o�����&N���껫p�9����)�T̰!���g�,!IY��_|[����3���G��r�5����P�������CC��� @�A�J[N�Y�t�A�2�ĒP��)� nhAI�rź�n)�R����b5V�l�{�-O*w��ίp��Bn�f����?`��n��J�2~�WJ���ۃXn��*�+��hGұ﨑�x�ˉ��,nd�e�4��X>�~r���x� (LT��0Itޚ<Y054Avܐ��X Um��ݮ�"nꩽs��=����(���/&�28�l����m ��:����An����q?�0���s&d����^�7������&_���w��`���DD��ϭ�p����|���$��!eQ�9�5��5=uՁ�Z�|9 �۫Z��^?�x1�4�(�8�j���w����g�Zd���C48��)!o.M�i�37�Ǧ�y%�Y��fC�.eu��mXz���ܺ0abP����m�7}����@�4�5Um>�N�ť�:T|�8��9�g��Ԗ�� �Nh�m�ڃףYքU9����C�5�ιO�$ts��9�r|S�p��t/A��MS��yd=��M� �v;��х��� ����3�R׀g�\5Bi;^O&n��h"k.��y#��yL?��+~ �n S�����d�<Ŕ2�7���F�?;���:$�v�0j�]Hu���-^*�1,:$�J41�e�(x�8�q* �'�/Ac�Ͻ/>��!C�G 7K�S�5M�^�+��f)�)�@"_����L�g��H�:��ǂx�>� �:�k)|H���f����q6�&��Kn�Alm������[9� �`+�d�x{�K �a)�ow�� 7t7����OYx8�X��1!�z&�F�ĭT���B�)�ً�}��N{�@�S_������%"��+�l��&�f�!�6�|��0�Cu���s��\2�G�D(��:փ�π����\E »�N��F�Xg JY��kK5[�E�|?�^$�T"W3\A��I ���������S���7��V6�}"�%x�����M�sF�Yئ�H� �(x[U)�_00lN-���G̕�� �?,u��T\@n�Jd�"�tq��+ FҒ~L �Pv���7H�AE�0tĂ��uV-�p]G֘'T�s� ��d?5�S��x�ܶ�}�3�vP��)uE.?��SZ�lݾ�|�恖S������i@Y:a��v�0Z� EQ���ڔ=]�A���/����c'��xDB��M*�H쌩�Q��D;^�a���7�ü;�3���q���Ȝ������E~B�߳�����h*_�>hO� .���s^��B�g� ���p*��C�7������f{U�� �`�#����Wu�>D�߬�1<7ɯ��ըf�B�j�*��7/FŻ�m�V?��M=LSTs����q�a��A����'2FO�V��Q�7�z�>��Y�gCm�'�\��M�2�X���2�%��B\��s>$U���V��U���3�إG�P^k���=gf���&97h�-Mr���w^F��� w�q�PW�8���a@E�`v�W�3�Ix?0b�5�P�ƩCsԟ���)P�aʦ"R��\���'_zU�����M�bΪ���n�f���b �y��+�颙��d�5��q$]��fi{�~-*g���<}����-|���]r�iC�V�-��������p�:��V,��t0mp1���탾���A��/��n�wk����Vr-70Y�D�a�O�1���~ψ�,ws#���͖�Lǘ !SX��Ԃ6��h���9P��_�4L+����no�`'q�'��RFvQ`���V ���<�;]=���CXȡ� �֥4f��J�g?�Ɗ����<գ|����04���(6�D��%d�^c�i|��v�s��ЌhRKK �=�W��_'n�'��=l���P�(��Z{,��Ec�?�X�(ݓ�����V���S���pqof5l�rVU��m.I8&Pk�����L�X0ʓV��w����[��-T�����9�AA#�y8�3����h(z����`k����N �iN�:�=�y�a�IF������g���0t!X��-��z�@/��=?� �1j�e�%qg}�yt���z� PVt<�JJ-��zc�$�̯c�����+N=j/~��Q�=!�\:G��vA5�Q�oB�(=:�1Au��5��=�sa�2��9��l8]]���gV��Cg۲^]}Vg�Y+�m��Wȏ�a)�Z�><��_��$RqH����ˆg��_�L�c$�\o����� r��1��M�����c(R= mHeq}L�d��Vt�2� �*H��^�:+��f!٬ȴv�0Z�!������ʯ37(v������ u����(ڹu�-�����Xo�8��Q��(�!�PZu�u��jg�(4���H�u; ����{n�r?�h{+y6:��X"�)��8��W)RG���$���ک��K���0��%.+��`����4�����j6��D�]FƳtgXz�d���m�6���o%�>�*�8�ė��ۊm�n��AvyJ�ٱj][����~�%�$��;*��m��g����ȋ��S�����X��y�by�-���U⾂�B������4����:o�a�(�H�d�7��6����ϐU蔖�����[}�T����ά+�5��3�-L�>O��y,)sM��4�w��i��*WW���C��F�#{���9!$��Tؤ�4��q�_i�<��� O 5k��_�Q9;JQ�3�F���O0������`���Z&�f��~@AH��}3%VM�v�S�íW�B�T2�$����tw=�if,��=�<k�{�j��oҋ��ͬ �oÿU�ʪ�~h]O����2Iq Kc�5��w�f�5��z�~���~M�����L�Iꤧ�^�T�����u�|R5��3����
Static task
static1
Behavioral task
behavioral1
Sample
aed3f8fa4ecbd2356b9d87266c6958944dca5ff8fbee8237b3581e9c68c699c9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
aed3f8fa4ecbd2356b9d87266c6958944dca5ff8fbee8237b3581e9c68c699c9.exe
Resource
win10v2004-20220812-en
General
-
Target
aed3f8fa4ecbd2356b9d87266c6958944dca5ff8fbee8237b3581e9c68c699c9
-
Size
2.8MB
-
MD5
c510304221315440453d5382751d6717
-
SHA1
1b4bb7bdd320dc7985fd644f4578781587972b4d
-
SHA256
aed3f8fa4ecbd2356b9d87266c6958944dca5ff8fbee8237b3581e9c68c699c9
-
SHA512
493da4e931aadcc2a82557b5f92b58a71727dbc9d7d36a3d24f57a390f72de72ba00050b453428799e0702beadc68922a2bbd5e0f7ae6f11bb38b450b3242689
-
SSDEEP
49152:3zryqWwnZf588CIJ+9yQFPO3rfYox/0EH/P9iRODBCzvKsvK0G0hi8nLZPbzeYoI:DuD6ZSIo9yQFiEc/0AP9iRRvKXDf81z3
Malware Config
Signatures
Files
-
aed3f8fa4ecbd2356b9d87266c6958944dca5ff8fbee8237b3581e9c68c699c9.exe windows x86
86b931d34efcfe56a7366b93dc8f7c16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaResume
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TFZ2000 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TFZ2001 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ