�m\� �3�V��,�I�*�#�!�ދ��B�q�@9������K��wM�8���Z�/=م�OL����|!rk-: r7.�����?[K� �l���N`{��0����ܩ�D��_hX,Q��7�e�z��UQu�w�̈a˨+)h!gkh���XsfkLL)��^>�ک�V�d�x���Z{������`Z=�!.^���"�u`i�1��<��z2%��ʱ��ܾ��N�@�������8�������X������/ ��� �r:��Kf$s�/��_��!�~�~La0ǩ�ƲG�MbI�^���&����YP��:˓���GJ�چ�������Y� �V,B@�� �б9��>�e���b�cI*?+������)0��ߥ)zrҪ�/�#��: v�*��WC�˕�{k^� ���H}���.eVFgu+cR��'祈v �x��0�1�[ailt:Y�=�������|�T�� m�)2���쎸G4d7%<�@�L�q���=6je|�a�O�Y�N{����^P� 3KX(t�p��D��A���7*���O�T���o���!Њ{�r8L��T|5Ds����8��Ԑt�&(�$VV.�b�?Ɣ5���$~g0��i���=��?3J�����А��j�m;}9 �V�?C�-���$!��&d�f���iA����bl� ��|Ҥ�p�y�S��NQ�fƴ�c��ZZ��N�?�G�c��ƴ�{����Β�0�1�=E�A�z���e���f��g��)�#�$���ˌqFe�V�ܵ��"�v ��r�*�� ��))�A�r���X��ۖ���ڬ�}�l�psL'���k/ZT}�y�������3��\D �vK�#�*"��r�_��ϣY��1X�c�I�F�ʏ펬�X�S`7 ��V@��r�{]^;�A#���V�|j�i�ѳ�^6�n|�w��2�>M�\���WȪoD���tu�W�7&�]hg�)}���&��~���z��5���T4����TR �����~9���6�" �C`�h�bK[��w�L���c%��U[J����B�@�ɤ�KD�D�֒�8��R��2�Ch���&rk� ��g�7H��́ΎYD�gc�(/t��fE�N���$�3f)��q�==�������x����E����A���x���N�H(f�*|���Bď�;G�����Uٮ �� �e�&�+�OzC�G��Лx`�� ��i��O h����9 t��r�ס_L<����4�����M�U����@�b5�i��:�d{mH��ќr)L^�k�&Ã���[ǰ��ZY ����`U�2�*��{�{%m�ٛ��Z�ZG�j��9[m�0����� S�t�q��*�(O��k(�z�N[]l�~�b쮵|Z?�і��cԳ��_Ĥ�u�W���4����jx/k���� 3<[ロ$1=c��=�;�>�z����ƴcz����9|�ۢ��8]�(��k�c�J�֞�EL��O6*�!"�3��Mv�L��1�*�sޭ�.P��to���ΐ$�*?k_Z)W��i����9)+b�H���[�+غk� �UKG���y&m�վ'@����?��> �|��|ȸz�C,6O��+{{�p�v���8�z�|dK߫�����Ŕɖ[��a�D�ԂJ�^��U9o�Z���)!���!��XRW�m�W�d�����{11/RгW���Z+�����W���EĹ��h۔%Kʿg/������B}[q��s�� +i�Udqv+�����a| ���ƋO���e~$��96�o���?䧗�89�u'۴Y�{���%DTPt[���»T��,{EU���0E�"��Z���7�/�M`k�ZJ1 �dH�ܕ�\lq�E~cy�?���:՟.я��i[5L��Q�c�Wg\�ȝ��6��4��Z��q�2Å��sWP��;�g�[��%�}�A.���wQ:���0�Ĕ����SݶEM߁�%+cd�ѥ�,��i D-���n@0ʦdIki�H�������>�m���XT�!@q7�/��,a��mx�tPf=m��';�ZZyo$(�lY�N�L1�+����a�uK�S�l:H��câ�h��>���ʂ�>E������̧�W�Ȣ�h*O��E<���苳<P]طG�%0�S���-7u�� p�8��j&�l�"z(ǣ�6@i$%�ą�`��q|6"���1�XK��9�� ��"$�8Y�l}ژz� ۺ�� P�R�G�����-�k�?�!���Z��}�g�oKk��i�o� �s���fr�#b�J�sM}Y`;<-Ŋ�?�e����3���-kgi�;�������h}\WAb�8f#a��^��pN�x��-�X����P�����`�2�??R;.���P�'D0��c�⾄�7�5?vs���;ih��z"2��Xb>>�[1I���̆��Fm� $F,Ħ�-S���o���S��� O^Nr���Q�+&�J+�g�u�ܱU�O*}#S�D���ֿ���0���n�#�λ���)�����n����k쟔��eKw�x/z��3��f柰^�����5�3����5%�WR�!��2��Ը%o�ʧ��d��[���岓��p/��Z�N�v�!��H��'Ĕ=���@Y��0��f��r��R���օ}V#��O������ g�"6��<��"%��D�${zO�~���&���`Yp��I��8���#��9�O�������2|ư'�|��S_�A��Y�f��{c�yaQκ�3�Q��w7D&Ĵ�'~��+�:����@���5�.�8���TV:��� K�WU��\�{����B"�>h�| Z�gљ�� 4oy=mnjmcJ���/���,�pb�=� ��ޚ!�g�V+B?`˒����p. ��7ޤI���������5"L�J����������\lz�9,{���%m@�}I�g ��;���y�TT��E�^(��wl�W��c����ҝ�w��)�jTY�;�l��3b��pH��y4tuP���C��E����R�ɨ!qn*��k�κ����\gZ��ĿU,
Static task
static1
Behavioral task
behavioral1
Sample
ca6443b9568023dc4cfae14c2f461ce431517e003ffaf46dd05c08b07bb7caea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca6443b9568023dc4cfae14c2f461ce431517e003ffaf46dd05c08b07bb7caea.exe
Resource
win10v2004-20220901-en
General
-
Target
ca6443b9568023dc4cfae14c2f461ce431517e003ffaf46dd05c08b07bb7caea
-
Size
110KB
-
MD5
058085dffe768503bcb63c29f0649c76
-
SHA1
ec023572ced551a268392522b91faed927d814a2
-
SHA256
ca6443b9568023dc4cfae14c2f461ce431517e003ffaf46dd05c08b07bb7caea
-
SHA512
6e593ebeedde05a6e9577812df83d287ef18b6f71b48506ecec9978cb3c0da6ad826076376da416873eb25796b37fa4e286e541b68b6769adf842c86202d4f21
-
SSDEEP
3072:IiqPgUEPHnpXu9JNguI8mfGJKgHK9bOzvICM7:nqPgUEPHpXu9JNHiGw9Og7
Malware Config
Signatures
Files
-
ca6443b9568023dc4cfae14c2f461ce431517e003ffaf46dd05c08b07bb7caea.exe windows x86
69151f2ee6ff82aee09b496871622efd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
WinExec
GetTempPathA
SetFileAttributesA
CloseHandle
ReleaseMutex
CopyFileA
OpenMutexA
WaitForSingleObject
GlobalMemoryStatusEx
GetComputerNameA
GetSystemDefaultUILanguage
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA
CreateThread
CreateProcessA
TerminateProcess
ExitThread
Sleep
GetSystemDirectoryA
lstrcatA
lstrcpyA
GetLastError
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
GetDesktopWindow
advapi32
RegQueryValueExA
OpenServiceA
DeleteService
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
OpenSCManagerA
shell32
ShellExecuteA
ws2_32
select
__WSAFDIsSet
WSAIoctl
htonl
recv
WSASocketA
WSAStartup
send
setsockopt
sendto
inet_addr
socket
htons
connect
closesocket
gethostbyname
msvcrt
strcpy
strstr
strcspn
strncpy
_controlfp
atoi
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
time
rand
strlen
memset
memcpy
sprintf
malloc
exit
_except_handler3
strcat
??2@YAPAXI@Z
localtime
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccc0 Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccc1 Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ