�@�&m��rEKK��,����k�B9��-�vC?&^�q'G|%C�x>�����L� ���i5�a�B����[��S ��=@��跧�I���j-I�s��5�mդ�#���J+�>�d?�wk<�vv��<�Ř�K"�8+���n�F��A�V�s� '<znq6Y�����<>;=���_t5�BY!�k���z��L��u^_Y��>���0�ʞ�g��1��-�_�/��_`>�ؽ;�E�O,����iAd���0r*-s��_7�/n�}1�!� �$��K��dF= Es�}��Y�@a� 6eH ,��wrOt��Iռ�v�E<?��I�v��s;+��������{ڳ8��hI�_����3��u���e���#�� }\M��U� ���r֍�D���p���~*�ݳ���n�S��1�n��w�F:���O:%�Ѥ}X�ӎ�$� k fq�iX"��.^A�JB�:�HvC�L�egP�0]X���'��y�z�"�9 ���J>>)m����h�D}�������MD�M.}վ��'i���,�wpuZZ��S7�<�u]G�ɹ�s]�S ~����-�,�}�BQ��H%q� ��\ȩ+].��~�.V;�aJ��xD}K4�-9܈̓�Q�9R�����8�EOVn�]���T����ü�M���\j>7,Vmf��gutD�O̱��-����\c*�p7�s����Tğ�>Y<����u�4��Rb{�}y銏�;����1j����4����8��� G��uj^r5�j��0Ñ�Ap?u���� ��}��{xBec��+'��-a��}��Ro���W �r|8�E��,T������w�,������l �� Azm�s��"݁�s�j4^��A6��t��y���Zu�2�(T�p��q��;��M�u��G`j?Z�f�6��G�c{��h�\E�{<���`-; �B~��DA<�3H16 y��}w�y)[�~%�rlا�,�|I��֏Q��Z҅�(莡A[���?����Q���9�6QMH�@�o��1;�f^G������v+�6>�h����?�����»LMd��g�+�p�3u��J��M��t�u�f����o *�rS�A����`'3��r�������'V���~�i0m��|O,��d0��m�P-�yH��ws1^��ZJ��S$���1ŭ髙/z�����j���4��NF�6dv��hpOA�Ƅ[ݥ$�}�;�e������"ĠE��_pη�im3B��xy�r��W�KZ�Xf�5ۥޤ+47n�����O��*1���r�uB�3�%y )���Y�Wӫ�7�{ctV�)��B�h��Ӓ���7bZ����x�`z����<3'��v�>�#*V�Q�����&jD_A��K] e�T<���sU �\m���Xmu*�d�3B9XQ3 ��c�P�����k�d�.$1��hɏx;;iJ#&�H��loU��a����m�c۩�UZ�V˶�)M�����$s-H4vG�:��z��F�p�8�)�^ [��� f3�BN��#-}��}x��g c�� da��ܛQ�8ܢ�o���GM���{��&D#f�({��2RF��$��p �����պV=^��"� 2pP%�~��3�+�;� �]����� �{�Օ�>�f-��� ���om+�� �"Ĵk�[�o��U���/Y��͞j�mP�q������w^��9P����"A�m�V=��ٚ?�s���H#��18��20c�����l���P�X�V�j���� �b؋�Y :��`��zYE�����z_��0�ȴ0��^����To�dW�Q�� �����bD��ȍ����4��E7������0r��%�1Qw�u�z��(qEs��s��^��>��R��ټ7^�m %Iv�(��.-��`�*�.���o�Y��̉t�<.�[DY�ܷ>Bس��-�c��N��gh���9JČ>�FB�[O�:}?���i��US�;��Y3>cj�ȝj2�Ğ�9GÍ��)C� �����I�Y���8&�c�.1{��<�A�����7�榒���M���C�����fg)~Ƅ�:�8��w��o��[���{F����>伦���1���Lq�ؚ5>v]|��5p�'�(0+��T-���j�س�����~8;�v���6[Ж�C�*�tH�^5f�?>�0��\;Џy�����?M�7zF�<���k���@4?��n���rr����&皥b��� Ϲ���_��M;�v�s�E��Mvr���o}��D��r�gjd��@�;����h�G�t����E��9�nd;7<��8|��t���ٳ��K0N�g�ⓘ���5r�H!�E�c���I$�}X>�X���V�AY�P�e@�7S� !�ޭ}s�o|i _�r�z��^��OGy�Dc2@a2�#̋�W�d��Lrcf�����ć�'��O��~�[�k�!��!����TgD�����,�|ܼة�]��x�_���[�r�P�{�O� ��C:��� bu�XA�ڠ8e�O� t���&I���N3��]?cHYz���� d�����m�&Yn۽���L�g늃�^�L�a?�S�E���o�4\��M�౦܅6Ρ�O�ՑZZy�JD,�>Y�f<�t�!E�O�q���__�k�������Y@�Nn���b�0 e�lƓЦ���3i���2��2��Ъ@�!��9����#��5K!"̀�b�����_QI,�B2�>A����J�E�G:�*�_�\f{����)�bdqU�_#��T)i-����Ƣ��Cy���JNq����"��{�j1�7��|�Xxt=�f���s}�?��"���rfm5�^��\q� ���W������cڰ^�ډ���yq�v�u�sX��u/S�zaB�i�#���t }���<��Oj��m���ZpC�(qൻ=���]m�\�9��~d.�1K8���_��,~���rSP]�h��a2���h���B9v���[�7�4�_�4��!�Z�t��@&���'Vl��z[�+
Static task
static1
Behavioral task
behavioral1
Sample
ab99f5f62213c37e991b0cfa812db2e0a7e8d44d1799cb597f75632f29f42e84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab99f5f62213c37e991b0cfa812db2e0a7e8d44d1799cb597f75632f29f42e84.exe
Resource
win10v2004-20220812-en
General
-
Target
ab99f5f62213c37e991b0cfa812db2e0a7e8d44d1799cb597f75632f29f42e84
-
Size
8.0MB
-
MD5
def1bd11e20c4a9dbc7e2852c5acce1d
-
SHA1
6268ab2bec9f96fb367ec7f45b1e7748527fd6e2
-
SHA256
ab99f5f62213c37e991b0cfa812db2e0a7e8d44d1799cb597f75632f29f42e84
-
SHA512
a3bb166b5f159babacce5e288ac453179ad6703e5f1f05154fc5e1ad904a891065e477f92a04822af230a6b939593e505f6b44b11ec895afe3fca0fd85596fe0
-
SSDEEP
196608:9CotVQ+xliJ0A0ceLhInBHd9dbSO4ILFXrvQmwfkYs/rp:9CoZNOBHd3FXDQmwMh/rp
Malware Config
Signatures
Files
-
ab99f5f62213c37e991b0cfa812db2e0a7e8d44d1799cb597f75632f29f42e84.exe windows x86
f3bc4d4d7e12baf222f2baf83961bbc2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
AdjustTokenPrivileges
shlwapi
PathFileExistsW
Exports
Exports
Sections
.text Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tsl0 Size: - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tsl1 Size: 635KB - Virtual size: 634KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 186KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ