H1}/ے�����N'{bY{(��ߚ}2GǯXz�d<l�<�I#�#�7�-�t�' 6����J�ԵlV����+�[���}pUx:2o;�0��X�� n` �]�7:��qö������M㛎 Rs���x<��ŕ��]�p�sB>k�H٥i�l��>,���&�u�Dl�~��f:�!�wX�>_-C������ �ar�;��O�տ��|>�����qLI��9�7K��c�����s�� �C@�}���N��O��?�O{�w��i��Fz�k��'߰����l�˷ˇ�J�_a��O[!g��}`�<�Fp��BK�4�2�,��%�UJ�7���$@���6��nɟd�|_!�S��0�><��I�E��ÿ����rց��`x1�xᄤy��>�+}�@�����B��'�����q��c���4�C�@Z�G'��b����f�ȓ�J����������������q>�^x�#3=@zw���(d�.�95�Z���0]&L��cJ�\��|�i+۵��o�8��Q4O�n���>@�P��/��{iT�=#1���}�S�A"��ϲ��������4$�*X�&W�E&�����M��<-^��b���R�Cg ��S�uΓ�f�J���;���K��Ѽ`�p�C#S����6؋�#l�!$������>x�p8cC(� {�)�K��84�m��ڀ�9�|��~��o�����̟�"?�Ի(y�t�s;����)�p�*o3Y���y�B�-?���+���Vo� ��X$<�.RL^C�p��f�,_��c�O�\�,�5�c�� �ֲ:��f�d�VbH�����#'�NC'�~��xB��O�*hP@fgps_��Ȧ�9����k��<dM '���x�s�'q�>�j�n���:2�m�_�p���&��ս��nj��\�cě�hs�6;M�c͊(Ӯd\�p��%��Ųj�P:��QS���6����/g�?%�^���q�L��ݜ�Qg�� � H�gM�$l���$M������92��?VN?2?�~��$��s`H3 ?ij�����ii��3������H��m# 1���8Uɉn�n�(�M_ �0 �+�!�A���e����u�v ���w�b^tT��I��*&����3��Z��k0�0�cZ>�4�;�����@�&[���".�59+U7�cn%�����!��>%�0����B �8M��t�{ɽ7����x��a��+��Ji�ؔ�P�DZ���oM��J�9'�*1���������Zd�[I6������O�@�y�(z�<2�K ��?l�i�]ο��7@"����=p� [���_���נ�� �*�O��G; �\Lbd�Sgэ������8�azV�7�]�A��C���p��T��+�!FP՞�[\+��??��,������2T�8���2%�r0I��V������'vsD�k���^���W���:o�~wL ��0��B���,�k;���>JH��Gr!AT�HT�ݞ���p������Yv����q�����?�S_�$Jd�ԍL��� ����g�n�����2"tZ*-_@����k��^���wX��A��Q t���ր����<�P�p� ��`+�� ��+M���^���>�e��ze?\z��T�?��el��P��[�2�B����of+�����ab-�*O�Ó= ��/9�CQ.��,m��V�X�ԙ \z�C s�<���J|̜N`��?U4���$��s�?[�7ߟV� ����ٞ�@���=�X��˽���bl�c�.-�>z��N ��Eo���l0e�Q�jj���ᜭ2pާ�����QS} :e���nZ�ks��Y��|=�n7;� H(3��lvƀAv��}c�.�(��14��������rDJ!�u����u���>�I#'�A�Ig�.������(TcV����A��C��g(x��� s9����\��O5ƨ����ݛ�3E�0������C �P��k�E������U,F�ز�u�p'k�̺g�}���� ��V��L��br�Ac�~Љљ)?�f��3��q_M���Ύ:�W=i:[@��j��{�������/1�z�s�9��g|�aK��dj�T�g������/�_��¦� ���;&!��IRի6o��� Y�x�ژ�pmEm^1�7<�d�M��1�q�F�BQd��6��l����\w��i�be��?�(���'���3������^#_�C����%X��!Te���`�����ܗI�1>�)��W(ߊ�{6R�&:/m_=�s���B\�qbC�q#�K�[�4� k�������e��_^�]�~�\x;�E75�4x�>K��Z�2z�'%Q�'����B��OF��s��BZu��Y��ca��ְT�*�T�LCf:�g�;��E������V F���*Q���[���\N�^6N�`�.��f����!��펲�8e�u˲ ��ca�5������G����j� ���k�*HJ�OfAp���t�Og��S�ë|�]�[�Jw�y��;���}X�aB���7���"'-h� ��đ��� �>�d�~|�����AZ��˹к�U�cJM�l�c���g�*��2!��-������|��QP��A��+�Ń�)�qL�YI"YR�G*Y��w�TD8V!C��fOK�p�"���{=���wۃ�/0$NI��$7A?��<e4��E���������\�H�$i�gF~囎C���5�k���Pa����n�!F6��O<���ע�b�r>���N9���7��S�:�ݵp�W�����_�����^U�<��C�a����1)>�N�cހ�<���R�lF��:.�g���E��ŏ^�2�?M9i��/|ε��1cՅ�26�����f�����S�!��T�2�i]��)����#�K����s�YJM��ȼ��E���犡3N����~tx�Y�}�ƛ�qΨ��]�˱�.� ��n��5C��L�'Ƽ����5�E��(����܁��$X� 91�Um�
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp
-
Size
6.9MB
-
MD5
9f442a9d6e1a09d3bd339286a3f346b3
-
SHA1
e43b76837e5546bee251d11554eb12173b306437
-
SHA256
3669f718a2095e72ae3f05edf05c540267212f64eaeb524ea3484d3523087082
-
SHA512
f3d6fdfe052d6aa1801bcceef7e750634aef2376a949a0b15e04ef39eacf557b284e3eeb67391ae8793ce1ced3e5b76f42dbc612c13a7e47841085ba3dfe234a
-
SSDEEP
98304:iweGwZXdu+0qmhNQuegPlJUX3hFo/Z2rx4YGW3s2v3CC:iFGwZXUj7QKl6U/gyYV3x
Malware Config
Signatures
Files
-
tmp.exe windows x64
e1442d01c963d2122e5a2c1fee98289b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bhyy Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BsmenRt Size: - Virtual size: 872KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BsmenRt Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ