2��ZE������%�W��z�F�[:_��/��O]�E#���we��=x�s��̷=?��%���][%��a���:�48W�ܕ�� :��p�]������.%d�y3����|��?ӂĴKȴ�!�;��H,ӠAg�VT��%9��0�� g�]�j#�+ 5�[cu�f@�k�����w���������B/����L�{��q�rY1�|ŕn��K�9#��ܔ�W����k��z�6V�ɚ|>�Ӛ.�jfl��_��-�_P$�~���&�ƺE��b!K�X��A�����gȽz�8T ���{M1S|8�3��.�Zv��~�r����ɧ�T��|��Q�ICðk�"\}�}�)��|��$eu ���]�U�ɮ?�s������6t-��� ��c���"!���v����5���A|5��^m� �>��s���;a^<�9g��V����>Էqfw��n�EfH�W�w`���9�s_�j�D� ��ɴ��.-a��^?Ig�p$/�&]�SP2����m����}7Hu+pn�xAБ�]���v�"h��5Bt��i}��G�+�Z�����r�1�v$�)�6�*'�X*y���!w���j�X�n�Bn�M6�Lňu�Z�R=J0��ъ_��g��,:��s,�H{�j�e�)�H:.^�0��N��4Q�����y{_����BqC�-#E�w�l�|��.���0�-7/� ���ҵ�_?����b̵8�.�R��C�uȠ�/9���N�\'m�r��-��^�@1;n�21A7��>9Dmx�.hIs��|#�Ɓ��ݢn�"��(�_=���7�[j�ӣ���Y��q����٩Y�Ȁ�g��A|<k0���G�$Jh]��%�z3��̎l�P��*qw ����+��'y���Sɓ��m"�z��Y�1��\A|��O�BV��ˬ��G�vh�|H�� ��)Ĉ��C�Z�����C��Ս#`h�0�m<��'����*2idk#L�� J�\F��6� �.���Jѩ��FC)a\9��_�$ktJ� K��qDB]�<1¶���n%俹w!�a����L$���^�:��O�+�/kr���S���-��Br՚+�\����]�J���.d�WUSo�Б�e�+<��d���'���ҨI,�-G��A���"E�ͪ�\;.*��]BF4�M��/�[z�OB�:��a�I����|}V1MM���E�P��r��دf_��tԶ|P�ʚ[�.�G���� �9,� '&�g�g�K�99$�=G}�>�@h���鯸�����0��� `����=����G��݂�,�K��b�A><Ȼ�����Y�kAIͫ0��y�@��_��//P.����n����6a��o[���9��`)��jy4��3�}6Ly�h*C`�:�e���\����]��H��qA,��R��C��Ǟ���o����w�����&<%��cc�49:z(��t8T���Y��܂��}���B����̢�!*c�c3�������˓pxfk�#�s�H�!�_c7�g�ࢃ�şo.돸mDS#�|@J����ob��"}^'ZK���I:��6II��f��G��=�Ԗ$������f�CP�)��x��@LM��w��}�p�Z�x8�;��b�Lҋ���"磆�o���1����x��L��<�H�I�j��� �u&u�$�q1���c%ulD�Y�_�����%R(�A�F6rg�F�$�z���E���Vy���A #O��11�����"k�-��6���pE$2ʷ$�و6SWP�sApG6�^.ZFܭ�A�<�g�{�y=Y�G�����\�����HORr��-ٱ�nN;puwq��T/v}F�Fo���r��n�~5^R���Z|<����ƶ�kt3����|��A*�LQ�f)E-�0�EX��-&/�O��Ww�3�d!.yU��� ���яXY��n�8ɡ��3�g�ң���Q�--����Յ�� qT!&�ȅ�N�"Ɩ9����� >��^d �@$<�Zi)�^��1��yK�|t��؇��D�k��U�w��l��iut���r}��L���eFy���Q{��}a�rs��;hڣ�4жG?��Cq�H�Q�%'B�3��fka��I,u�}f<=�B�O~I���P����وlҠq�C��m�NA�^Ȫ�wtI�8*-P��h�[Թ�f�5� a)�-k$��gV��?=�6G%� ���N����!ة��&�:�����.�cT���O�C.��B�v7:��K���#�V��7P�9�jeN��a2-#ȷU�~[I0!^�P-��ٌ(����UŐs��#���L�$p^s4٥o�{� ��u|z,��ojutJ��p���;��S��0�W1Z��}�"2��k���ϳ�������F�I#��ū�gv�%�GREeSs��j`H��O�_��pTY�V%������M��!����t�B�7��ƀ\�p끜Z`N�,r��=�$�ɝ��B�B1����5sw����З��(��=�k���Y�+' �λ���������D�ʍ%M}���<��/2�Y_���cP��`f)ڼ)�Kv]������AE�\���!�GV]�9ʮx(j���gH�ƁK��!` q�7%�� ����/[b���ק8�4MXo=�e������'�J�H�� ��G��1&��p�~<͙{i�� �=)�Y��B"@��9�4�e���&������\|�3h(�3EP^ԃk{�L`K�W�pzή���J���g�_1G���4����f[�_�t-�p�QZ�|{"*��I��<���FvZ�{������3f��?��xD�:C�2.��G�i1Y�������5��&Y��/lW+��"���e��jD2��MG=1 ��Kp���ϑ���G;^��Ů/v��6�[�i��ސ���L'͝3�,dI�=�&�����ģ����x��2�M���%�I���/�����D�����^��^���Gx���ϻ�q�����M����������Ί�᜴ �Թ;k���_+7BHGp]��?z�NJ�{3<c�~e��4��F:��_<-�C���~$H�P[+
Behavioral task
behavioral1
Sample
b0a826be10a0c4897772ea455529b12111edaa24a8dd66d90ca4ce5fbf739b43.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0a826be10a0c4897772ea455529b12111edaa24a8dd66d90ca4ce5fbf739b43.exe
Resource
win10v2004-20220901-en
General
-
Target
b0a826be10a0c4897772ea455529b12111edaa24a8dd66d90ca4ce5fbf739b43
-
Size
284KB
-
MD5
7b0b9f35b755be6ba93ebb5d2076a1b7
-
SHA1
58f1aa6e5edff6387f8ba6c94c0cda5984f64e52
-
SHA256
b0a826be10a0c4897772ea455529b12111edaa24a8dd66d90ca4ce5fbf739b43
-
SHA512
f2447a22805422d19b3caf59212d63e250faeda6af77c9bb58e30ef918041975eca8d8bf5b64c3cfaa3585fa0fc72ea7612cd94be2cb2f1aa918e300c2af565f
-
SSDEEP
6144:uOBn3SCAK1CUYEYVcGQfCzU0L6IwCQFR2:t1p51f0c6zU0L+r32
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b0a826be10a0c4897772ea455529b12111edaa24a8dd66d90ca4ce5fbf739b43.exe windows x86
f9d412090f6e5b7203878a9a9666ea96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord526
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ