�B�.�J�U�QB�m�A�"�7�9��4�5�W�ta,��Mv���ؼ�kֵ�7[S�|%Va���㳖3�5���V��=��W�m ��f�Ja� ���a8B_#=�ōA�J�#�=�ݷN�x ?b�����l����R"��H�������4L�C2��m[yA^�)^A_sZ�.��X订?�Hw�^����Q��)���Y�Z �0��D�lg����LWdՍ�ۀ�*�N4�I�Î��1b�x�-}����RͿ�����b���/�4�I�%�L$MA�� �=۸�Nj�"c����6��aD�o)�X�q�o� ������W��`�����rҪCVr1�{��ja\s��_������:�i/���]l2v���m����q�2-����0�Ԥt���q������s������a�[���j�u4:�^�\�0;[<�Dб�N� zj|��9�=Fȁ�n0Og��^`���ϕ� Ý�w��1 � ��v�8NGݳ�Zh�D{��Q�Y��zL�]�pa��Eɦ)W��?1h�%�=0>�h��)1_�P��l*��]jr&����6���ى-��ڝw7��Q}��. �����MS�k�k�Mո���eh�!�uAW�W�)�l zt�ŗ��8r�2A��©1f��n��8� ���@]�{�NPE3X��7`�����F`����x'�{<7U� ����'��C��tM��ĥY�Z+"�KK��.�u�J)g{����T��eƃ\��$����ߎ�U�V.���M�X��-*�uv��oWp��-*ο1쭷��w��!���%S���!�T~��~�L���s�V�6�%O2�e_G���!�Pe���*��7 � i园!)�B�n ���!��������[7V�xDB ���rL��0_b}�`, =b�[+GU�[�w�����v�g���q�]�,K�<t������ Q���?������Z��?�l�H�q����� �g�"Ă�!rT>��~͚Nh�� �ٙ��mήk���p��e;V����m�Vv�E�("X�k˶u9!�5�ڽ����$�]����YOA����Xn�L��υB�M�s�6�H^ߟ��b@�� @^�KF�yωo��j���c�V;�Bd�����&��ǖ�{�ыV�g;9Y��VE\3��)� �����z��X�4dy�Qm�;I��Qd���40<���N%��MYk���a!�� ��ə��iU>�B��d���g��gEd�8�I�1�sv<�?�����Bm�7���~�Y'.�c����Q��y�.�\RO�F��w���K,ozs=Հ���� h�P��+�|(*��B^(��lFR����r�z���} �����2���\���\9 �;e��z̫��h`�n^�P^��A>�#P̹�n�jՋ�:���ѩ�6�F-v�J1c0G=d�h�xf�>�3�=�nf�����ї~kOlb�'B�횝�����/�>���֗� ��d6�9BA^߯�X[j�t��=O��� a�"��ε�n�ō��gd��Ə��'�9JI �h�NUl����=�TX&)?��A�-�U2Ȏ!�?��Ԓ)�Z���m��Z:wL������Kb�QF:Ⅺ˛@�)!���z��6\D�*pz�����:\t'@Cf� -p#π�6jq����9��<H��E�\R��L����A�`� *7�36�z�"z�L���:/��V,����\�>� ���;�w�����l�,$ہ����uɑĿ�������b�; z:(�X�?qk�F�FQ���֚��GK�;�H��G��8�t?�&�Ҝ`{��ۊ��{֘XX�aa�&���p���$I~�T@�H�yYR��G#{5�J4Q�-� �g�^7Ç���8w�1 'E���̡����3Z_S���'�i�N߫�x���z��d�ܴ��J����c� !:�P��1)���a�Y��k<��;�_h�Kï��1V/*V�_��A������"E��O٬�u��^���F�����@���]�al��r��.�p�������w7R�[��9w��M��lL��[� ��ˠ��-,ŏ��<̍���(���]Z��q���R�$�|d��4'nW��M�,��C��ɪ8bZ,QJ�|���Dl�����F�G력ѕDr =�_���a�Z_'*$)6��������DG��)�z������e;��/ ��7���ENU(-p���o=�G�Z-���3"�h�./@ϯ�bGw��&�w?�#��|�l��E��פ���`꾀�_jAX纶��\��,��@P�,�6�n��j��_��"'�W�r2��?����o�2��]��x��:�]�6���i�\wi��g�3����vp�B�~�oV���a&z��^�}��T:����%��s�i+$@�P�1흴 �& C�jm2���}�V�9��c!�4��{ʵB��G�"PU�v�� 9X��=a*.�Տ�ҭ}��k���O��mg��H;��J'<)q�]�� �-r�S� .g�B�$�,B������ivt�aR<>@jc�;�Cj2�<��=� A���A�N�9 ����@c����('r��\9Ø�9Ј��L�Ȍ�=�ި&[$9�ۃ,�2�K$�H㼓� �sk����sX_� ��2;1(��~���6X�X�8��f�W �t9��������|~>�,��6��#+�I�TC�؈�O�����!��qH`��Ka~#�aGA��--��|��1@�����)�<��kʓ�N .C{m����q�7>`�i��+�s��V|�Ӣ�O��:�����N9������k���ӕ�|]Up�������E��=����ט�.Gi������9 ��L�%��[-|#ɟ���-f�Ëo^w����5x���%'������bx�O���� ����[�l�w��ӥ�t�Ln`����b���R'DT��r���f�CE�`������Ҟ��� �aaہ��r�O�՞�EUiՙ'x�W��� gv�n\yDp��~����IW�x�|M���@�l��o�B���ÃX����$�6�.��0U
Static task
static1
Behavioral task
behavioral1
Sample
af1b72619921d65b960cd0aa98e67cc211689a46b0064238a18b261163e3f5b8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
af1b72619921d65b960cd0aa98e67cc211689a46b0064238a18b261163e3f5b8.exe
Resource
win10v2004-20220901-en
General
-
Target
af1b72619921d65b960cd0aa98e67cc211689a46b0064238a18b261163e3f5b8
-
Size
1.1MB
-
MD5
01f4a3dc180fc1bb3a7448c55393ada2
-
SHA1
09b537585388003b5b85b9c6502242e60c1fe814
-
SHA256
af1b72619921d65b960cd0aa98e67cc211689a46b0064238a18b261163e3f5b8
-
SHA512
a5a419e79d91be58dc5a01750c4638074f1c587cd3dd86c0b31ca0799c4c5024199eb43143c9e48068908b9770871a28cbe9ff03223ecd5119baefe9e55306de
-
SSDEEP
24576:WRcMRosX5M+r4S39vM4d8Qz3g3Gc8qkTPVZhv0dc:WR5RD5dr42dL3gv8qkJZhvgc
Malware Config
Signatures
Files
-
af1b72619921d65b960cd0aa98e67cc211689a46b0064238a18b261163e3f5b8.exe windows x86
59eaf97a7c6c6c162fd38c9a8da9583d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegOpenKeyExA
user32
UnhookWindowsHookEx
MessageBoxA
kernel32
GetFileType
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleDC
version
VerQueryValueA
ole32
IsAccelerator
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ