��T�f�p�ꘑHp�� �o�v3�)O%�W�1��At(;�LYR~�����0��m&¾-�;���Y'��<�4���AƘK$����<6�4O�[R%�p�����%����e��h`W��.!w�o���M��#��N���Q�$��|�/�<c�}�g�D��I���F*9yZ�:*$'c p�]79I��{�ܡel&��թ�~�徬j��g���4�z(�Z�a5��-���M��ྚ���`���C{S��j:Y��Y�~&��Wsp(aoAf=�����dhB�](�B��{o_ �=l�Q�ڳ8se�?�yy���m߷�����C�#�tJ�o���*��� .��L7�y�y����������a�ns�s֮����v�@=P���t��!֚,4PݵZ�o��Q�9 v�@���OmY�i�+)�"H���M)_tEZн���T_GG P,'�>�i���l���0 \*�a�Q ��5FpB, k<f1c�~ɮ���:h]G�D�^�94��q��2/C�&@��H(��E`��t�I:���*�$C�{'�G���8����g���HH�t��jU��&�~[z���h�!����)���j����euۖ�+�v�1N�}ƙ%���to���J���j�����a���N�N�4�����;���ξ�.y�!8�Ӓ^E���l�R}0X˔#_f�~( P����������;����y�C�Ӹ�������ߺ� ������.r���i���w�������݁V���T�D!߭ap��*��ڃf�`���Ҁ�N9��>~L��bD-E�V�� OE��������N%�����m�/�i&���F��4<��¹��(Vj���C��<�������>R�̈́< lP�\�u���n٘� 1�����)�D4!��d��x(�� ��l�.7�Y�2���UƩ�M�J�a'11 �JNIH���a�[i��?�|`O�{��d8��ֽ��Z 3����tF��㽟L�~1+�����[��Q���N�O�O�1}���}0��z�&����J�T?��(j�B+c�3�ʏ>�ԥU!��&7��@�_��ԔM@���q�[��,�G�rJόˁ�_*����ʀ�.[ c�ZtX�ܣ-�H߅�K��G6�6NL�<X�zu��<J��������R��3 !�L�����#��0YcI ,����v.��u�:O�����[��8\�$~"�W�I�2�����1����pqݘ���<j�kZ��%(���mN��C�����9v;b�}�?�����Nr��{�j�֝5Qʼn砀e��/3�B|}�v]��郗�uR�h8�: 2~�V��!De�10"�����{�"k}�'�25 �1�6S$tRvd��S �@&uO?z��P�)�9�w�C�T۰�-��)����F�;��=�MiEϲ�b1B�+@��m�fnx@3��,aZUb����>���A��<�o��������hx�F�v�̗�� �?�c�Χ�:"wg�+&x��9��4U+�!���t3r��T[�*U�<��Q4��'�͓D���\S� ��}���g��?�c^�xČ���sLr�<��:UT�E4�l�m+��4:�fN��bU�����rG�Q� �M9�mm�����-�D8g�ۙa{����g�������I�,��9�ځ�~,��i�nx�l3d^�?h2��Qr��n� {#��=�i�D���&��`�H�x�Pt�䒫ާ�c��;����J����}�~�pA�]3�T6�� ��ϭMpE�ˤu�JX�zjw��>ƛ�A��5��̃��"2����)�S=%�g� �-�����R(�� ʹƨc��i��[�<���5OM:���'�����g�ӆ��5�A��8�\�9(|���!���^N�ȣ�θ[+�E�O ��g�Qz�A@���$�բ�V�G��0��L>���F�R@�q���(���*NRI������V�������bl���̎Z�ӡ�)~����,�*LM��FH�1I���/�����+sfG"��ya���q�D�����"zm-�<N�aK�NJ�x��RC��}ЃD���ّ3���#���qܔ���=�_��|Z@�[�/_>�� �XpW�0���� .�����>�ڶ���DᙤW���e��tY#.���@ǾU���fM�A��,���Ե3���iU/�ĺ���yX2Y��Vg;kʭ4$��`Th6�����ٰ�R�G��5O������-� ���C��O���U���!"�mڳ��!�RA8:D�L���J�`��c9� 7=���*+]bIV��Ei�sQ��?%�H�N���g AvQw,���&'����&��p�� �/ZD^<��N�4�L����?Qͷ�[`��Dߡ�rY���s4M���k�"��v�q�u�DG%��M�1}�b������<�X\G�W��� ����r�j�i��)ʙ�����lH4^� ��Gl��T���/��T!%�!e�96�Y�U��~��DL5���Gc�pS8a�c��pD������◮k�m�cU�D��:�#|��/K�m��*B�:S�Ag���Q�)Iӂז_v�����#�V 5�քka��u��e�u�����1kڸ���\BLسf��1�~��^��G�?U+3��I�d���F��� ZR��s5����,��"���FO�>~��B��A^�*%h!��OXݮ���p�F�B��<����< �O���/�����O�@�E�����5������`R!λ����ׄ2�j��ER@ӏUCK�E��eY;A�۟�zg��>%�_�V�w�����j[5kQޙ��Խ�[J�RXj�t� -�$D:����Q���!\<R]�M?�h����ƕR��R��|�JC�������y��5Wl�3->�C�d��\O������_���҄����3��Z�Q��a����/3Ə��v'�T�C>]��FX�1����f�B�A�7b[�j�/�cM�Fڑ���`�/QbU�����R��m��3�c�3��˷-<;�g�D���[��25�ՅuƦ
Static task
static1
Behavioral task
behavioral1
Sample
b0b4de99111c385f09e7df106a2c713f0ab9706ce5304ae803d598c2cf703cbe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b0b4de99111c385f09e7df106a2c713f0ab9706ce5304ae803d598c2cf703cbe.exe
Resource
win10v2004-20221111-en
General
-
Target
b0b4de99111c385f09e7df106a2c713f0ab9706ce5304ae803d598c2cf703cbe
-
Size
143KB
-
MD5
42bc48144c26e0b51b0669b0713cb8e8
-
SHA1
303d7e7b29e69e3cc61538e384305c546fde7252
-
SHA256
b0b4de99111c385f09e7df106a2c713f0ab9706ce5304ae803d598c2cf703cbe
-
SHA512
c14e832f052551c4835347159474dd39b6b376f518b38b8840958e30302210c055ac1fabe5d7690119e6e9c740d0c7394cbeb82a7df888b62a102e475ba566c7
-
SSDEEP
3072:mEzQL4Nbui8yTce+zOmfHr7E+/zLT084T2Qn8bKfUH1VfPgYpC5BhI:mEzQL4NP1Tce8OeXb/3Q8UnHfUnPCvh
Malware Config
Signatures
Files
-
b0b4de99111c385f09e7df106a2c713f0ab9706ce5304ae803d598c2cf703cbe.exe windows x86
bc3daf18aca064e0b4ab9cfecf560000
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
advapi32
OpenSCManagerA
shell32
ShellExecuteA
ws2_32
__WSAFDIsSet
msvcrt
strstr
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sef0 Size: - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sef1 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ