��B' it��_#�i��w��:�o�9_�`���r��/�\�Q���}�H�@-m�W�lV�1�g�=:�V^���Ԑ�u����{�n��j�=����̖�XjWfBJoE����y�5�J�̽@Y�Ъ&��4mǭE�U����$�ަtݘj������$���: �I���D����P��d� 2� ���c���Af?cȡ���뫅�@�v \�!�Y����KLt5�)�LT�Z��#.7}�ȂԘ��o��Y�,.���5,M�f0�:�]�y~Ma���oܞ�����H]����v���H� D::�u��k�ɽv���7��1�JXo���r�V����>���P(��F^�Vt�B�uW&�(�9ٗt��U'c$/���pf��hx�����Y ��a�����=��Y��NA���!�˻&J��3R��*8�0���fw[5���3U?+�n�D��t������RANn-D��UJ�q�%�N��Y�~��ǃ��zľ�I��g��s���B������r&�7�<�����l�&�?�%�ߘ���b8��� !�n���H(�"ρ�Q�:�p�@�Ҥ����K���t�[>�?�)�+٭��"(������^/���m?��@^ٴ�n��l��{A�tM�Bi�U�L���U;�uY1L��V��q�J :���+d����[/�ۭ�Ϻ�#m0?{k;��h� n�Sf��E�#���궎l1X�4���-�F�[��;�g���5�ۧ�n��i=H0���l��+%�"Yt�)0�ly��1�� pϭ��eWn����3|!F�������k}PQ9g�1����a�0���N��#�v��5 :�[�ǂISŚ>s��,AIw�w#N0P�yW�gb���a�f&3�C���Y�9DZ��"�QIQ�A ]CrGV������:���I�I�� �T���78P�W���h���7�A�u�ڟ�����ly���k�ƻ����)~t�g��u7�㨾�X�� �Fl�D(O�L�W|�����ू�\uQ����6+W+��z(|�Hk�>��N������PJ"���t����5�k�5�eH�Dl�Ư0�AE����fG}P�Y_��V��-Y�;s\ j��0-��9�H���N��f�PD��?|���; ���s��R����n����4�m����A5s �K�Ỳ��3�͡'����Jj��D%�.��'R��䎛e�� Y����1��ͯ���YGҠ������$d凳-j��}��E}|�n��p��m�� B���_P hG���m>��p����#(������vc�k�7 ���d�y����ۃoB�W��n����lM:���~\P�5���yΟX3F��z��s`�����:� ���(c��v����V����uP�;�>obJ� �S��U�"L�_tgUU[�p�)(�3#Ǔ�sQt�kv�#b�!з[�5vn���.����93�I��̟ɱ��r�}��]�60�����!�ߟ#.q9����UhcHg�m]}tJ�n�.B�Eƃ`��B)�7���<�,۟F�SN�z��F���;�]EL3����'������x���Y�&;>��*���JX�.Z�������:�� g7�����D���˛��E��j�[�.ɳ#�WJm��X"��~�����:��aS����B�{�"d<����Ǹ�V�FlӀE�q�B�mVt�8��zI,��W����)W7 h��1��ߓHLPs����b�_\orm[����љ�Z�Z;�����!��M�m���Uh��(ĕ��8�Ҙ!�0�U�j1gG������Գ�ڶ�}gs �q�̦�U]q�f �Bl��mdtG�; �X��F�p@�1~��C�-���_������#��FYSK�f[��i��cf<��6����;I;aD&��¡滼p̱��HƸ-��A���w�\��zx��x<� �U���~�m"Fn` {��y����`bRÅ�b�NZ+��3}D��a�Z�-���������v�\r�3�R��fcA�.���/a��ood9 ������i��6���+�z�K�+�UN�]�:���!���P9����*LezGoz~��70qr��̚�6��ے�u��#^Gw�8DL�3(i�2��(���7�JH�Bf@�zH�[ܣ�d���n��Q&�˒L�j���%[�(�ꛛQ�/ �$<M��nb��-^1�A朼E����K0tn(�M�3Flt#�<�{L�br�y*�8�a����h쑽��pK]�c�����,���@��z��D�U�WFU'T�wV��) ���s��d�pD>6 `-�<���D�'��H�������Wm.J�+�bE-����, c58���8�N ]8#�)&��^�T�C�-IZ[���|&#�`\���>y=�~�_x��Ek�-5H��|�GQ�]�&��E�R�+���!�Nń��$����a�zi � rݣ�%lG/*��Օn��!)y�Y�[����"�l��oxi�`x\��8��u����������V���0@>��.k�L12���!v��n���� ��g��l���ݩ�c��$�u���Rc�%�ʻqGX��ϭe)�S$�B��i�T_{�N睐���yŻ�0`���$m��Lo{� \8����N]!�H}��?��ʔ6�h)W�.�������j��xkj�zk�e��*j\,D<�Z��(�ڟ�%F��&&����ԉ�/�e�g�7�9b�t��1�<Z�G��ڮ Tq%xN�|���/�>[��'\!4rM?H�u�ĭ[Y�g�!)��l�[�g������L����I5�(�y�'RO��z�����\+�-�SɀI��}��t��u y�,[�)1��hǘ�*� ux�o��Q{�L)#l�I?��䮲8ԞE(�����% �q��9!�!��GJ� dVc y(1JV�4n�y��dT_�<)S3����<B�3}~���c��[{]����h6�gd��T�>ՐM1`��'�&Ay�y�n/ׂ�$��J�2��.���&�u�}��
Static task
static1
Behavioral task
behavioral1
Sample
4f99c975f01acbd2a49ac9ab7a9f09bcd791002a3a62711710be1c827c35b41c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4f99c975f01acbd2a49ac9ab7a9f09bcd791002a3a62711710be1c827c35b41c.exe
Resource
win10v2004-20220901-en
General
-
Target
4f99c975f01acbd2a49ac9ab7a9f09bcd791002a3a62711710be1c827c35b41c
-
Size
7.2MB
-
MD5
493b1c5d689bd825e93cbfa141358825
-
SHA1
0df6a6c12c334a2f908ad0cf411de8b2e06f0c6d
-
SHA256
4f99c975f01acbd2a49ac9ab7a9f09bcd791002a3a62711710be1c827c35b41c
-
SHA512
4630d5782b2d641eff9d6213827067b94e8b10cb369bb8819c62939b8b361ff5edfe0c3d7354accbf607fea5bfca759f36c941f3dbe54ba28ea8e8dd408cbe0a
-
SSDEEP
196608:2HbUckBRNXp641XGZqbctp4MKbHEv/8F7:M47RNXp/12S44MiEsF7
Malware Config
Signatures
Files
-
4f99c975f01acbd2a49ac9ab7a9f09bcd791002a3a62711710be1c827c35b41c.exe windows x64
838e882b3a0e9e884a145c265f311f82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
WSACleanup
crypt32
CertEnumSystemStore
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: - Virtual size: 4KB
.voltbl Size: - Virtual size: 4KB
_RDATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_sysc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{NU Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nU_ Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.PO' Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ