>,{3�����c�Ed??w�V0�kB������+� ���U�y��I�O����L�N R��OSJ7�p�`��]�=q�]2�@)!"�,���I).Y���2��_8vh¹GO/d'd&���(�]m�b/1�a���-�Q�r� ��r{��H�q�Y��~�P���������Q�����X�!�8X�)e����(>:Pb�s2SϬȶDFay ������>��SX��4�u/i���q�x�K4Q4��ی�:V~��}j���x�@Hπ���s{k rVi`���iZ\M��}U��5��F=�c"���?�DZ)_o�J�-`�ږ4�UQ��@q�.Ȅ"pRL���LH�Pᡉ�5��h���\��!hTfs�)7�%�B<�/�>05X���[VjC�Ic=;������/�w l��|���V�����o���*`�&%�0�Ӎa?*�`�0M�v>j3��F����U�r,b�hrZ/"�7�C0����U]�_�P�y���-�����퇿�-Pd#%����6�]*��_�&r2*LV2V � ��ڿ�4���~��@N,�����!廹F桄cߚ0'il��e�(�-��CҴ�4����I ��ݙ��]p����^���WE�T&`!�D�(&��⢵$��2h��q3z�Q����-{Б�j���v�@29���7��c �vH��$�_�E�4l-Ɠڟ�T���[����q�a��=����n�ȁ:ɒf��S2-���x$���쯔G���¼�dᱏe6� �7I�C�Sと��W�^d��g�:]d&:�Vpp&~��+�X/1���AT)�tor ���Y���^�W��)�%�Ut�H�nM�����a�������;~5�ǑoX�F,��)P94�������hU�I"���q �qC 7v�I/v��W���e��ElޯI�/<��uB9��|�lj��[�!+��,�E!��c�hсs���Dn`�_B�h8�4�.冥r���Y ֕������Y��pI����l��ku�e1/�6�Ǿ�M��J�d�7y���p!М�'������8@I��ˑ���]�H���L�����-�o�)Q��@�!���,��ِ��(���SO��+n�m�&�ܞhl+}9�"�E/��X!���Т( ��٦Z�>yKX�dx�#<�x`e1���nh��X�M����t�-��`ڝ�m�Ý��2�ف$��: cõϘ6�Lᶁ{�j�Ea�W�uN�.�HǟШ��Jj�d�����z�V���%�@]g��R%�R�A�%��ozWU��$7�Q�"j79��+��'�5�c9���#%�[σ/�M&��'�2T�@[�I�VN4�T��������O!��a.(pk���ow����w�Ľ��B�~���"��t\v�/��HP�_�)B�1<��W65��@���di�����لq#;y�e�Ta%3��#���UR��S�{#��"#�Ǜ��V;�9ʰ��:-����~�C���.���<Rh|# Y~��&`�w !*LH6Y��M�68���Y�Ioz��s@i,j�ݦ��u��LmJ]k��]�V,������o"u�*D�8}�4�O���hM�\-�!t������lb���V M2���A�v��۽yg�l݂�����ʩDUP{s��8���%\�O���1� 1��ǰg�k������)T�X�7�;� Y��;zkw�r�ƥ_�D23(�/m۽. ����ԟ[L�4�����*���ť�S���]=��h��B�U"Ô��?��dؖ"�W�if�k����;E���X7�4C�D?�nk5���G`�c X��`G��b`����<���<~o���@� �������c�(��1B�EAU��O~Rhf�+<r/�܄�%�� kT�&bzXStO��������!I�"�c$[2ԋ�˚o.�8N+�����<Rq��2>�y�e ����r`�,KF�tK�eO�^�.�;"ן��J�&>����-{e\"Ku�]�?�Br�[��)��)_�u*{�b�D��d>���������p ,е�qzN-/�B�Q�?�����,+Ti�Id�&��� ��m}�O�s���kY�CC�E@���'}���.�MgI����ú�c%n1�a�eyr����v�@�ʐ�#v�O��gB_a����)�@:�f�����u�<Ip�oD�P >� ���K�].��2�o�\�d"��҅�0��P�5�����G)�U;���27Ι�~�l{G�����w�_0ɶ�����`� ����W�y�M8t��ӥ�:]S��`&���rn���#ީ#L���>wA��N��ה?([����D-l^ƣ�=�LGi��:��9ی��p��]e��۞�=���������=P:�)��.��&wG�����b�%�Q��BT����Q����Lw^�ɟ#�i�?WlX��� ��O����0Ơ�L�����r�����U����&� ��� �i�naq�7!�LW�'c>:Z�DKQb)H�wK���U��Ϧ|Bs2��I��+ b��*)X�r�1�o��~����/"d�Eq��GY��>���3:�q�遖��c�imG���(*"1 $�: @� ��~���hz�T ���.�Ga����ꎇ ۢ�6�m��b}��_�>��i%�I H*i��,���<�[2���� �V��Pb�7��ao� G���'���A�G�h@KSz4��6�j��3}�ּ=_S�ȃ'v���}I����������y�0��2�E^�7�N{X�kcxI4柴����XN�٢���zdH}���b����|(�12f�0�g����}OO�a�����}S]�P�a��B��g������Ԕ k���x�J�(R����q7o(�(Z� ���O�Rf�cm��PBaD��0�͝!�c��3�/HC���nƽ׀j ��(1�����.�&��L��U�U&�����w��m�����(����A�Ȓ�F���@pxx�IV0/߅&5û}준W�|+��'*� ��b�+q��rJ_+��P������5&'�0u���W�v���A/G}ڟ��
Static task
static1
Behavioral task
behavioral1
Sample
58ab164530a5835fd4c8ef3aff4f1d12c2fca4e63f2b8d07c28df48055142b32.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
58ab164530a5835fd4c8ef3aff4f1d12c2fca4e63f2b8d07c28df48055142b32.exe
Resource
win10v2004-20220812-en
General
-
Target
58ab164530a5835fd4c8ef3aff4f1d12c2fca4e63f2b8d07c28df48055142b32
-
Size
768KB
-
MD5
0905114401adca2d542bb147de69cf36
-
SHA1
391b3f25250d5cad4efbad8dab1f5bbe3c2b9c51
-
SHA256
58ab164530a5835fd4c8ef3aff4f1d12c2fca4e63f2b8d07c28df48055142b32
-
SHA512
f60ae10658d1b4d0fd07da4e333d4dbcd2929552e8e8718f325abd351e862c05c488e52750b17a596a0e1dc2e63d9e549730c20b3a1d715fb11a63b78dc677c3
-
SSDEEP
12288:MoakyYIAvFGMTQzZr6VI5VaAGnA7wU23USvzf1zSjwpVkZCvDIhYdVytF3Npf/B7:FBII4r6VKaAaA7T2k81fkFYdVaFfpyiB
Malware Config
Signatures
Files
-
58ab164530a5835fd4c8ef3aff4f1d12c2fca4e63f2b8d07c28df48055142b32.exe windows x86
5afa538de053709c95a08ec4f3953b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
gdi32
GetTextColor
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathStripToRootA
oledlg
ord8
ole32
CoRevokeClassObject
oleaut32
VariantChangeType
psapi
EnumProcessModules
Exports
Exports
Sections
.text Size: - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sz0 Size: - Virtual size: 459KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sz1 Size: 724KB - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE