3�^9bhɚ ���_�G7Gr�v��hn�Ӹ24� �a�$iJ*Z����Y�"�:���!��x�++�������9,��`5��s�5���m<y��nh5n�Ά���H�N����I�\��l�2�g�5����7���X�^#��{uM��&Q��V� �p�A��3r]�O%C��$��/.��-����+�e�*b0֤��O*������h�P7>V�S�2#?A��G�\F����,A|Dv^���R�H�bs��W 흎�a,���.~��0}�'{O���N.?���[Z�@����%M�A�]�e�tz�+�7�Y���r��w�v~V[�Tc��:�+`( ��L�*���,�AI��/��~A�~)P�kx�tU���|��8��y�q��6��Kv���At����.u㣼Uu�d��[��E��j^�F��7��H��IvX5���m���сEb¹-��G�l�2a�iڻ�ɋ1�Ym�|��P;���ga�[��V���&�� �( ��yڪ"Pam=:&�ϱ�����šs�kI_9�����טⱱJz�A̗A�A�����0C�����t���¾焛[�.G�uC�f���k�~-}n��"����f�I��ykZ"L-��0Hd �.�Y�yY ��P��SO/�SJ��Bz�蠕A��䆧IL�A�G�P��v�?,����UT�f>l�L�/������Ϫ�z��I�rQ%��) ��� ��nބv�@q���F��א�I^6��� ��-��H�����s��X�%P8��dd�w���fM y��Ц>u<�sH� � W�y��L,�Ρ�����I��%:QhG���@�Ȼ�h�&t���<� �v�����u����x�J�_�(H�2|�I��c�U�nz{���:�ya�}CLG-��t�d��ɯ6���Y��S�Lr`� �jsț���Q�*�7LM��ۓR�܂��EΝq�Pǐ+KC�OW �3��\"^�A�ˌQ+J���d3o*Y]J:�M��Ĺ�i��Q"o����D��8�sU�Oɏ!�A;S�G�$;@q�ᶗ�;�v+���ckf���5���>,a1��)%�%��f�̮�;\�h�&v��!x���� ��]���^V�\R��X��K���"W�7K X�נ� ���h�¶.5�!>�j}�%�s/���<�Kd���Bm�N~��9��� ͼU�58��Lm?�����{���XkL2. Gi}��Ԏ�g�?�Ңf����e��bҒQ�a����'��h(�"3L�3$�~���9b#�6 X�q�]�� Zn 0GG����2�azNSM� J$��Ed��S�`d��i]ܕ Yx�� ���raBmw_x��r^0��Uz����4��p�'�ߕ�2���mq�:9IATwk��6Tͻ8K���(�^F��R�� j3�Sͣ��1 ��g1S��ySIx�+.�`O[���Te�6�� Ǭ�h�m�:7�(*�<������"ZX#�!���^�U�M��;�� B�< rF�ȢDE��t��O�[m��R!�O���]>����t�ӱ3���xm�KQ�� ����}f#b0ϊ�Np�Z i �K���![g��I� ������c��>��\��������;�����XbcK.��`�9��7s�빹 {�fg�gV�^������08G*��ѫߕ�z2�5�+��ԑ������k��5�n��D�oquĐ�W�qQ�`�N�� �/ �F�yZ���9��kF�dC�}'��.�WEN����hh�+ ���X�6�ШJߺ�3�\sJr#-�)��C��AR��u�Qs����W!�]w�?��s��/���735�g��=�j������"Mf�������xH���"���Uy��6�Fl�(ZA�]�SR_�DB��*H�Nʼ�����3��/2�@k���������Jt�.:�8b��b"!�r�9�`���� Ft�C̀��� 5�T��������v�2k�h�������V�59�l#�����1�ʅ�a�궨�<s���߬����>V�x�-����k�Zo���X�l������n�EG%����u�y�?��%����N�A2��[e*��HP!�lp���ŲܳJU1or����� ��;����I����<c����YCᣬԻ�?���Zy��}�Y!�O*��Y��1�+.�0�5F��S�e �ݴ��~WF���1�0js?e���V���c1/DX�x��4ɾ�Z���E�=)�AĈ�ϗ�s=��{��Y�\q��j�,Y��9����'��J=�������J˳у�wc�����יFE���$��j�9e ������X�Q���O:�]��ϕN�nݚ�X�#r��V4����j�֨�&1f>Qs��v���n��]ֶ�� G�r��O$]Ɇ�=�NM!`��U6��7�Ci�w���tl��-vbp-���p7�y�a�dx�Ʊ�c�݀ a"� 5����Vh*c9�hS9FwK�����\g^�� �)��u�YƝ9L����g�<)�K�j#~��LOXr]�M�b�_$!�0���˺����������L��F�T�&�(|j��5Y�@�d/�O�O��}�w|����h��.������Qc��`���x,���e��.�x1��T�jbεyٸν���dG#4xB�'L�R���qZF�(�X�;4�@��o�o�!������� �^��!�R��$N{��b�?Y���.�&�cJL� [��n����Ix-sO��*;���ίWY��4P�k$aZ�NT�Zܲ�bd���"l[:�(K�fи�値�EP�ZR���`-�'��ANwc^q6��Чw*ɵ��3;�����ԯ��m̚2�x��ǎ�����37QUN��=���>)�����A�"#T;�{��0�l�҉j�i��-�w:�P���[?n�w�k`����~\lIc�N���[H��=� ݃P��(a f�+��&���s�2���!u}l����J����(�dC��Ē��GDE�t�TX?4�2�;s��*{�A�tBai���Im5�4����\��6�%���Є���G
Static task
static1
Behavioral task
behavioral1
Sample
be86f8e5200c1fc0dbd8aa516122fe2c7592e4416334ecbb94a14f90165a5560.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
be86f8e5200c1fc0dbd8aa516122fe2c7592e4416334ecbb94a14f90165a5560.exe
Resource
win10v2004-20220901-en
General
-
Target
be86f8e5200c1fc0dbd8aa516122fe2c7592e4416334ecbb94a14f90165a5560
-
Size
2.2MB
-
MD5
90ac1b1b8f4d525e61207210e945f359
-
SHA1
a3439ad42d12f3bc4ff23f218b1b111ab4896ebe
-
SHA256
be86f8e5200c1fc0dbd8aa516122fe2c7592e4416334ecbb94a14f90165a5560
-
SHA512
460d171f6c4abe3ea5c5d2c10571667b7ef927d638a3e87eb4e9159af9c77ca8fa2e464bc5b53811cf69b539f2ca4950a7a3398e718971d4730a6ac6a19ffce0
-
SSDEEP
49152:COnGAAMDn/qvAawBCdTUnB7ER7jpFXuwRxsjNFBM7oJ115L:CO0Yn/9sTS7ylpuw/YMS1j
Malware Config
Signatures
Files
-
be86f8e5200c1fc0dbd8aa516122fe2c7592e4416334ecbb94a14f90165a5560.exe windows x86
6ecf99f9bd219cccae3f57dd76429704
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetTimeZoneInformation
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassLongA
gdi32
CreatePolygonRgn
winmm
waveOutClose
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
LHashValOfNameSys
comctl32
ImageList_Destroy
ws2_32
htonl
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 799KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yuexia0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yuexia1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ