"�G�����4d"��o���5��-�@�K�N����t��_@���� ��`��yy3�l$�T`���1�+�Ƹ`����vX��P W�K���_�K��^^ � .�3�|�Z�v���=��&��[�_]G�zb��n}6�H����:=C�ܸ���9��ЕiD!@���Z����1�\�E��F�Э���������O�9��o}o*�����OhQ���Q���}ʒ ��>��.$���s��*�\�}�Mv}�%��[������|m^=3���3+���&�� ^W�|�ٵK��x��a�C㫫����XY#�?�w���'�5���t2X|�Q�݅�Q��7�� ���?���$J�Z��KZ�{���"2��������ۡ����~��H�5����^/:�>�/��T(z�EcZ~�����g��5����v���|�X>H ��l��s�����Ͼ�$Y*C��֤���I� �U&����NxRϺ�]G^h�矞&���5F���ݧG�W�eD�R��v�ˉ�<�(N�������y��X��g��N�m����H���@����:B�b��]�r�����q��fs���������Ԡ�^���BR���u������nIR[���\c�����:�u8�_%9�R�����!��<��:v���႞��Ag��V�SS��>1��z��"P(T��"���G�)����|���`�2qY�Ίظ-�<y#|eh��f?/����O� i������%4|1z�I�Ȝ����OӋB��xbu��ځ�1��`N�9��:ct,y�0��I��/��0����Qtޫ2p�Iծh� ��c�$���g��Z�<\ CX�����w:W������ *�d��A{���тA`�V}�G9�s�Z��$�r�-����G?�r���I�Z�>�S�ț��R��:]zehǽ�t��jj�t�:8o�����A�J;:���|}FSM�p�zȓ����}wGsyo�[+���gR�X|(���Q$ސ{���^������sB��;�7������\!e��D��f��|VV�A�_,a���#d�����L5~�l��w� ��|":z��pb���g�)1���;C��-+�[���X5K�������9�o?���Er`!���X����M�t �5�)Pwg�@�s�'��Ev�NK��eY�<U� /j�J-��+��7�g\�QZ�O�]�5�jMQ!�q���Q�シ�WA9����Ų�<� *y5����/��P�F�O�C��������2&�hv���b+����4E��kf��k�n�$n�o�z��h�mK�)��*�s�/:j �+��̩Pf5�K~��LWIֶ��5aj`#����G�z=��i���D�>-2�}�c��fx�ب˨3�>$�}J&��n �,�e��z��~W�Ђ��I�ﬕr�� ��3[�i�,��^rd�\���i��yRs�l&�&V�K� o��_�[��=��͕��s�/=�������e�m"O����q�=rV��{%��W�Mۻ�?��4�*^{(1�(T��O��#� -M�[�K�c,#A+��C,��9�d�oni�0�K���f��f���۬������G��Wf�w� �l�^h�,�y�P���#��bBS�Vw5�>ed��:�<�(^��]�6Ap"2Їs� 6@�l)4�"��f��Yv{�.��Dv���Dul'u���v�7��o��`ɋ�2[�fYJȃt��fv�[/����04"z��"5K��R�(-De���a�!�7�d�s���Tw١z^&�z���e�`�{��Qi�1���Q=�xRiN���ac,�W��g'�O�_�lo]秺`>�a�&��Zد-�/U¡P������G�ެc��-9�eL^�����M1�S9HKv��M� n��/�Pv�:t ����P%�y�;!Nc�D����Y����4j'1i��k�c(����^�M�6�@��,� $�������S��é���]X�_�3��ETf�d��-�~�yLn�5���\=pn��ܧG% ��9��T|����m�Y�v4���(�hS$����H������������"��9� ��\b@�&%�.��k���vO����2��H��D���A�w^B%�&n^�v$}J(>�@�SO��&0q�WsiX��������a}� ����&dj�0)bn�;�2�HO�>W*�i�G�F4 ���[�۱��b9�(�y�S�y�������jy�o�@ħ~X��۽ِ8����;�MĔW���ą����N>��m���������S�$�&��+�No�V��m9I?����� ��\�T�m����)�����Y4��oJԚ��b�)l�il`�� 6)��Ss�P���|B�l��,�s�>����3�}~*��P&�ӑ���'���Θ�B����#j��~Y�ƻ�^���k���0U8D9@���;��I���b�@LZ��P�Y��Q�+b��I��7s/t�m��_���ΛgM��j���H���V#���Uc;e���������J%��,/��Yw*����"p>�*r�'��0��=s%�hXR�~�;��|U���cK���;���㣡��O��2��H��CR�s�8k�Ҋ]���:M��mjB�7�*ɨ����r#dt�|<}s�z4���K�ƒ=�^�p�m}6���@L���);�,� 2~�w�S趢���l����He3��C�ջ��$�&v��U�/S�2�+)�큹��m��V�_���#7����xP�A��J�=C��1���6��ak���5;{�0�����4�"��B�;�OY�E���y=��M *�����G�Q����h��\r����d=��J��l��x�ap��!T|1�%Z��z�/?H��v����δW���t\����&�T��CU��#锟z��VUbkn��I&��T@� _��0?Y��qsf.���?�� c�ƄDS����B׃"���f\*=���� ڈc9�!��(�c����a��8K��A��h�N����I��4
Static task
static1
Behavioral task
behavioral1
Sample
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
Resource
win10v2004-20221111-en
General
-
Target
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633
-
Size
2.8MB
-
MD5
a2c9ee7419369ada4d8a41ef14d642a4
-
SHA1
bbeee886e192b807097c22bbaf79483659242d11
-
SHA256
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633
-
SHA512
0f14717a83583b92ec472c7557cd1d81a95bc66507089aa0cfc785e575a11406aae172f3c95dec61426cbe6848f8a4e4a3e99b9183f351c6bbd5379657a337e1
-
SSDEEP
49152:etQ81S566MD++BLuh7BFQEuQsk9RxsmHpAJr/EnPUk151Fy7b3mAn0JxRvyGoU+T:etQ81ZpD++Buh7L/rxxHpAJCNZYH26x3
Malware Config
Signatures
Files
-
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe windows x86
ac1fc4619c0448ab6a105c472c825712
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
inet_ntoa
kernel32
GetVersionExA
GetVersion
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TabbedTextOutA
gdi32
GetTextColor
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.EXZ0 Size: - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.EXZ1 Size: 2.8MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ