I�s7�`�+UF��`3�V�t�d4l�(�W��(+��ׄ{��<�N�t��s'�.�D* �}1R�e���!��)���*�ďoңv�H:ஃ���M,���4U Bx���Z�5��$�,-���6^-!�3�1盙|d��êB.1�r�ٮ�7�"�ʊl#��&I�&S�^L�9H�a�\��l"/{�����t�OŐJ Gz㣈'S���$��f�����ܝ�PA��������ˣh翎�ؑ��w{�#Ґ1��w��R`ܣ�J�t{�DE���o��^G�=��f�Q��b�4>��:��=���n�*%ʡ2?�H�,��dV��X�!�?���=�kpv&P������ΞD��������/J��*�H�M~����o��y%�H�P�F�ʃ�C��ۦL�O�R�O4O$�?�ת��6���K����� �K�4��Y��h��8��ޜF�vvϪ��25~���tO��%�i�ѽN�퍰�C�Վa_�W�vۊ~p�3u�&ݙ*(�Ցa�����U�Qp�=ϩ�k�}���67_yF! ~A����zG����`eMc�9�Y���}�(G�� b�6����s��f��Z���������1��n�3o�H��Gq�u/r`u���@GDe�aI2�K:���S���O�� �ȵ�� �]����b���J��ְ�(�2���sR�7��Yٍz����W*����H/rF1ȼI�����qL#�S[����ː��bD]�a;Z�3��ۂ�Ŭ�NTyq�%��d\��@<�f��8��?��*��ç�T|n9�G;7�?\e�S��v��4���:�Jص^�֝Q�1%~S�3�G�,d���S�Sy�8�Y[J��h��[�sy]6���)دcg=�ZC��m�����j�D�}dM��=/Tm]ӈ$]n�?M��J~_��p��\mR�u ,�-�tW����- *P� `���C:[H�/�[#+�\����!�u$����7M$b�9s�E�m�k�T��(��M��y�������Q��_��������DГ,��������*vJcxR��Vv��ِ���w/q�)s٥x�m��jkdjQ�Gg֯�{�@��;��O��F�Q���!& �_�j,�,6J���<�X�~�:]� 0Z*_���� /渣��ɰ��i��\6��A]���O��.��OH!��4 ��:��٨�1ց�I�b���er�.!���Q�*�*��@φ��$�u����}:/ɡ�jc-������.B��r�;1zL:z�j���4nd6�҉JZ�qq4�P$P��?�~�f ��Kf�D�D����s��$# o����}��+�[z��4z��>�����1@ޤ�?X�/ϼ�r��l�����42A��R�ʨ/hXnXz`=��(V���D1��$����)T�0R3��,0�#����N�0�zz]���������lSUV��T��E R�g{w����>%p��E�*q��v����q� �����z"������W��-3��WJ�������X�X��i�]b��w,��-Zy�[>;�ҳ�I&���Ѧ��c!�t��PrB�kj�����= 2�U%�%%;�����D�ǎ����xZh��\���@hGE�N��2�N�h�J��لJd���7Q��2���Ąೇ��]`�o1~���m�N��[5����n:�ʊ�����]�!����{SU� �9�|�CC�I4t��8�}����k��Rv��/:�QҔ�؆���((�Gfs�Ҥh�4�fZ8ҽo���j��gԬ��I��O��0$�|3f�w@��.m�Sk����x��V�d��S�v/�z�.(����ehf7���;/^�Fꪚ���=& ����E��yAy�a xA�@������sc��wy���+�#6ШREM��S{���As���:��4oW5lo���ɭ�u?)��N�݃�Z��hvh+��T<���7�.*�ã�Q12�s���5�X���.�"̓![�DrM{��YS,���R�Q��|1^����E1a�K�o��5�t ���Î��,�GwLQS@53I����8�ΕY�لq�븕+m�-��I�{B���O�"�*����o�:�\�-����4QNw�j^��T��զ����E�]B0�rn�����C��ut�=C����%�5��2=����&D�u�� w�c�kvE��ڨ'��5�d�$�7V:�ɹ�4�I��{ ��M����[������`#���G��(�T��}o�����~#���[�:�霷��S���T��j��_�ZNU���+�3�;�vv������B��$r�kC%q��[�k�z)�ʂ��ٹ���R@جO�12�ҡ�����a'���s�,�P�M+nט�;q%ni�s�_�����O?��ƀ<�1SL0h��M!S�p ���^g��0��^��g�2��e���f�3��,f� ���%r��)Ep%[Q�)M��7��.y��*����n�O/R+�������t��6�A`g�ȭ~ߚ�qE��g5�;���&���b�� Dt��!!� ��*�E�N��ә���LZ��! ��Z������T�h� 1��A�fD��Q������M������!�U��+�p f4�:��{���m<U��(�a�D[W�� ��dۯz� ͤ;���in�!��V%�*3<���BK�h�3c>�z搸�o-�Bʥ$�C�v����m�mEo\� �*�4�Y|�Ȋ��a�T|���8�`�8<=�|�yM^Ě��;�_�O�"p�@� ]�{�]?N�}��; ���O��T�R;5�h�[��0��P�=NZ10�K�����;���SR s����Ͳ �ڂ#K�ps���˒{�=ѐ�����R�}s���܍51�$�O� ��Nv��U�h���x ��F�$!�|�&*1�>���K2�t��DmQ���Ε���w�WjgA�p:��lަ�Ⱥ��cٹ��A|[�ś2E�d�n�y��^̸*��7}����P�eJ�x�A9y�Ģ��Q�f}�;� � �+�oO��������]�����g�L!�S�)|���njô?�V`Kq]LJ�{Dž���y�LRNw
Static task
static1
Behavioral task
behavioral1
Sample
6c8bf893a56a333d8385b33a54d505caca051cf0c01cfec950d99336aea5b9ed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6c8bf893a56a333d8385b33a54d505caca051cf0c01cfec950d99336aea5b9ed.exe
Resource
win10v2004-20220901-en
General
-
Target
6c8bf893a56a333d8385b33a54d505caca051cf0c01cfec950d99336aea5b9ed
-
Size
564KB
-
MD5
93bcdc9cac2f08d6e8aadb631ff73aa0
-
SHA1
7e3b214918f4b811b35baf2ed4921c3bd992261b
-
SHA256
6c8bf893a56a333d8385b33a54d505caca051cf0c01cfec950d99336aea5b9ed
-
SHA512
297b90008cd3fed002c27465e465a714a4c42a1ba6ac2080e60773942180b4db007ec2011b5c21001b78bf1ecb11b3ef9162c45c8eb13adfd85ecb6cd94b415f
-
SSDEEP
6144:ibxFEZI2YcV2r1toQrrdUlQjVlTkqiNsqqE4r+3O7MdPL/dYhESm7g+:ibW9qrrdUlQplLFY3vdxjz7g
Malware Config
Signatures
Files
-
6c8bf893a56a333d8385b33a54d505caca051cf0c01cfec950d99336aea5b9ed.exe windows x86
d8a583e593d53b10f35228b83b0f759c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
ord693
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
__vbaStrVarMove
__vbaLenBstr
__vbaVarIdiv
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord626
ord519
ord629
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
ord593
__vbaExitProc
ord594
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord520
__vbaRefVarAry
__vbaBoolVarNull
__vbaVargVar
_CIsin
__vbaErase
ord525
ord632
__vbaVargVarMove
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
ord562
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
__vbaUI1ErrVar
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaStr2Vec
__vbaExceptHandler
ord711
__vbaPrintFile
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord607
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
ord537
ord644
ord645
_CIlog
__vbaFileOpen
__vbaVar2Vec
ord648
ord570
__vbaR8Str
__vbaVarLateMemCallLdRf
__vbaNew2
__vbaInStr
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord689
__vbaVarAdd
__vbaAryLock
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarMod
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaVarLateMemCallLd
__vbaFpI4
ord617
__vbaLateMemCallLd
__vbaRecDestructAnsi
_CIatan
__vbaStrMove
__vbaCastObj
__vbaAryCopy
ord619
__vbaStrVarCopy
__vbaForEachVar
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 436KB - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ghh0 Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ghh1 Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE