K����jDG�#���h���.�,O�T��u YX��T����s����L͈�u�Aw@��2���v0f"�&�|�����H���/Oj 8PN\�u�I����O�c!*�� %��M���y�O�%$�um5�̋-ǜS/�#KZLH�S���1)���l���Ćр���=�Qq'^h�9cT��B��G���>�"�k[-�n I|����-�����*f���F�cO�3�Au1Gȷ�P�~���G5�Ib�%��������t��S #L�������E6^>0�w�M�w���n�{e�ʭگ럠���+��[G�%Z��t�X�w������ˏ��Y%^�CY� @b����h�L���֏Z��Y�B�;�\��9u�Y�hHݫ�7�"��!-�=��書�PŁ�o�&Φ����m歱�g�:ԍ�����>��:ٿ39�N�)��t3���Dh�� �����yM��y���l���KmQ���>M��Mߢ��_t���3���鴶��p{�~L��x���%'8�MV-��BhT�'"�����Vޙ��l� �+u�Ca���o��%i�@��ٻ�g��$�vO₶F�S����[�� Z@���������ƴ��E�/�H������D����������t�h 6�@�XM�9������I�����h'�M��-i�� z��4K�T������t`�Eƌ�[����9�!�"+��JT� Ǖ���l���9V]&�5��k�A�;�zR�كL����@ {�Fb�TآNa��7�!W|lG�*ƹ>Щ�$pW�I�����:Y� 4����v�r���N.��䩏B���c���|��ß7{��s:WU0"��̧^v��@ ��N���u�_�R��QO] �PUQ��^��6B�e�5���(��Y�gu���B���)�^&��>%��Ѻ��J^�)����QT�K]]`U6$N�+ �9�Q��>�a5�V~��Gi�wp��-$lk\�a'p�#x����8V�f�s_������S̋D��K�+O��E���X-��8\$.H��,�h_���=�i�D ?<��%(�\U�'�(��n�3b�.M��+[`��W/�Z1�N�'>�eiJXo��w�\���e���{��9�(&�|�gr�o�p�SBl�H��PĻ1+{��e��'Cg�o}��Τ�1�"�)��P3�S��+�^�+�ѥ. ;D��JD��*�j�)9�h3j���Dg�*�6�3����1_�-� ������xB���!7OL�3F�Lb��-��c�{Kb,�����/8ejf�2۔���FV�\������]�K�(@l��Z��D/"�%i(ka�� ����������/���;|��T!�5��ʖ�8� ƴ��dg_�n-X� �iȽ���r7����2�g"d�6�-���v!ظ��Θo&~�]A���.zF�IO��Ϋ��@` n|�q�'�n�Gm@2� ��xs� �&�2}�k�]�"�<������(���x��h�5Ec"��������4�/����h��A� >�6/����"���VR�ny��}����m��KO��z��_~@���_0�����̢�uG1=�ؔ��R�n57\A7r��`��(u����b�&��"T@��=�>E۸xhx,�����ƪ?��7��ݤ�Z��X�~zDH�(5ri��h�2l�R�2"�����f�؍8]�X��<2�c�J5(������5��-��9u"Z�2£Z� x�.��&i W��ϲ�o`rr��ͦ��T������?8�s%@Uzp�ҥH��cn�7O��_�F�m��ŝE�TBtd�ux��������%����e-o�9.���ҭv�d��]HK�������=*(F9����~�]�T���2��C�B;�!���oIs���#^�U��&!j�[����D7��'��e��5��õ�'4J1���T�D����>>��Uj��:�D"���!zK�01����~Y�9�{�$?�N��~n��5���F������;@��k_��md �:����M�L�fn��Jʙm�����e��k� ф�t�I.���U�q��y�8��e��wj]�<S�������Om�x4-��>�^�~��/WF��R�z��z{���:�q�{]��|)x�=u1)v Y�fC@�t5_d�0��,$�c�/�8�˓2x���f���P,�SP�]���&��ƕ��0����֑�r@¬�����WoV%����BT���j�W�q��m7I��e����fJf��x)0�K�V�e�o���ER��Vi����v�AA��$=�rc[+���#����9�a�d�#�����sbYN���a�,��v?iM.˨o��������D����:J|Uw��衣(��N˲�����a�����N�Á�*U8���2K�9�$g8P�71�M�@�ч����)T�Z6��1�6θ��+���E�������x��@�AlT���.��~���_ �ۑ����s�+��p�{���V����'V��R�����G���Mc��Φ��F{���n��L��9�����6[�����k��Sֈ��yczĭ ���a��Y:�V��0�$��P�w�?�]j��l���i9踭��G��i�؎<;׃��r�w��.QY���܇V��o����}��֟��(ea������9'����4��f2/2#Ǯ{��G����������}hu0�ˇ���G��KU�F�u�x��in���Ϫ�k������jx���f�;JU �z Y������������){�O\ƶ%��b_��C�l�0��tl��6�jj���/����&���B q�|�TPǢM���Dy8G)vQI��y���UIj{�]�X�pd�OJ�'�~����n�P^y��o^�v��M�E����4�A �"���\������=� �D V�}��������YD����Y����@��,����nJ�m]�l��#t��wi2IZ ��� ���#�bT'���(i@��%�ֆ㋃[J��`�m4u��4��N=N�T���
Static task
static1
Behavioral task
behavioral1
Sample
5f31deb026e695b202d0c941f60460327c37f2c4a53baa14146fb6a5a4514984.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5f31deb026e695b202d0c941f60460327c37f2c4a53baa14146fb6a5a4514984.exe
Resource
win10v2004-20220812-en
General
-
Target
5f31deb026e695b202d0c941f60460327c37f2c4a53baa14146fb6a5a4514984
-
Size
869KB
-
MD5
81df69fec63c551f878e3c72c310fc8c
-
SHA1
2ebf19b17d6c126b7458774ca68939500952dbe9
-
SHA256
5f31deb026e695b202d0c941f60460327c37f2c4a53baa14146fb6a5a4514984
-
SHA512
23fb9bd7320f58f7cc7ede9eebc2fa4760a63ad3338742565541c2a059b52d81421edd9760aecd4f2cd8fd5ea6f39f075140bf1f342e81c373503eff1b009e03
-
SSDEEP
12288:sflDRbixy+Cb9Cit7Yf0dRvrSfe7xyxeS927QkAPfgOtJVHv5mpwxxaiKTQvjH:cichb9CiVDXS2VgUURVt35bxai5H
Malware Config
Signatures
Files
-
5f31deb026e695b202d0c941f60460327c37f2c4a53baa14146fb6a5a4514984.exe windows x86
152de4602c185c0f62aa077a340ae07b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetEndOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
advapi32
RegOpenKeyExA
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoSizeA
gdi32
RealizePalette
ole32
StringFromCLSID
comctl32
ImageList_GetBkColor
shell32
ExtractAssociatedIconA
wininet
InternetCheckConnectionA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto1 Size: - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.viotto2 Size: 852KB - Virtual size: 852KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ