E�����k�(B�?�8�c� "d�,Q3�T�C��U���08�s�Vu��E���/��q�SְR���J��e[/5��{lR�8$����0 ���ri蘒/fŋa�e�_��n���s#�9A� ��2ܲ����8@� �����ku�G,��>���x�s��>o�ٌU��8�7b���f��V�;"���A@���"Q*��c����y`��]M���bgt��M������frQE*����Dɭ;6�ē<�w�kƼ��P��=HdH#�=B���U����!��)���Y ��!`�����B節?�I%��E� ��H,pS,�v| �UW��y����\�I���ֲ�� ��7��WD��5ʻ����xJ�{,���+T`R�!��w���k�_�q�=�~z98o%���oL7tEyt��/QcC����.F��h�va�o8Nf���_1��8uY�H"(���]^�A����3��9&�zmI�+;[jE�� 3���;$;�??q��g�4p�Ѱ�嶾u�%E����q7���x�WQXD�e�9�E��T���f���Q����g�[�6Ӛr�N���*T��2m*�I���E0�r�:9&gG��&� Y�+�v��U������|�'�"C�M"1�I�H���;m±x�&9<���^���N��2W�ƲI2b��;��9��4L�y)Ɨ>�Ծ��g+�+��`ѭe�]��z@r5'�U�@~,ZZ�M�d����i_����R��=y<�#n����*���Hk ;@��g��5;N��wTw�����M��!Wt�=P��Z�Ru�N*�x���n��%֨�'����$`a���S"�Ҵ�e=�:�Љ�]�@[z�"e/�M}Ύ ����&�����`R�}�jy&D"W8�����������p�ڎMb0�+�J��U��'��#��#������۬9`�.]O.z��E�<�`l%/l�?��S��D���K-��֘�����`S�����,S���iE�y�L��� �m�<,/r�B���Q���F1��G�+՜Dr���g�z�.�L�4������L��;���u]��RLIs���@o�H� y�%�5S+0����k�2b����X��mC�\p���)�c��8�@�Qw�o��]��<���0m� �^<Fe ��Ӹܲ%���~s������\�9�|�o(/��suv���.�r m�蓍O��&G~%+ϐR��k��!t�BEb���b��K��g1 ����1�t�g�DB�hT���k�H8��Z�F�dK&��1�U��ܢ��϶Mm��n{��+`RqS ��Q�6c�J�4�C8�2ϼ�x��_�qU��{��,�#r~�|mC�ռ��+>�f�]��jQ-(h���~BL���?�%&.���9AZMŃr(��m��ZZs�&�`]�&ү#���1.�ju��5>�=2����x=��x�N!|w�Gr�u�t*����"T[`�pԓ���S���@�C������M:��l$��k��}q�MW-���1�1�S�~�4�,-�k-�nt�4�ٛ8��۔<���[�T����O�Xϋ0�=�r����"w�!����U��JP}e��%���n�(b-�$P�Db�.� �����ш�P�f�,����p$�`R�`3Ե�u���"?�G�-�c.qN�X�x�m�V&U��O ��[��u1˫^ɢ*����w��U�g�Mo;K�;��c��B��i�:��4P{� O��oY��,�z����_On�&�H�ښ�˚?���$b^�c�[0�j�{p����g����0�#�ȯ�ee���ƴø�L��5��`���9-]|��>��9NJ��@ �p}\�IL��S���)O�P7�G=��y����o�T� ;q¡#��K���tw���%��� � �|���������h�,�r<����L���l���œ`I(�{��}�-$g����<t-��uQն�TbO�r4YwQ��oB�*����)ƅ9�aR�f������(�Ap�p�-QQh�Bg�%�G�q�k�s�f1����I�XwMЦG�a��Ed��Tf���&�~}����-O3��%�LU�g3^�Kgz�T�1�Q���>�t�Duw�� �ۥ��DW{p�^��HۃO[���q��j�I��g�g~1�A=�Z��[�����?1�)���KR�)����d��ƫ���$�I�Z����%D�����P��+����� 6�_�/�6q�)��\����|#�6զd�� ��l�m/�l��y������H�'�k��x�Q0�|�z�ȓ��L@�. 5�� i8n8Ej��"K�T�J2��vF�\/e����9�b�u��H5�'4�(��#t^ZQ��Ԗ��y~�lC��A�A�6&~8�ۉJ���?+�&�����ô�ߓA2Fו�62f_��N��7��4�A��N=m��`���~}!��t2����H��YPg������u���ʓ�h\�����/<�J'���u���D���@�U�h�Þ���̕;�+/+>P2��Y?�e�d{��x� �wC�ǒ؍r��P��~����cx:���g+۪�������5�6�� 5��G�Qɣ��'�;H^��U$y�0%� �che��i&=��'�jy%>�v% �7:�� �ɾ���7?�����3����7��z��� �F�C��|%�������,�����@�p�)r�;��8p������=��D�;�����`���N})��"��<Sk���N��5����U��E*�T��b����B`c�����m�{� )�,��̀c-] �}Rx�^���!ƢR�����y��ם�h��H8vv��p� ����W��H~�q��Y�f�'�W��㕿40^a"}L��~g'�*-�k��0!���vq��6�������U;�*mC�Ы�z�t �����R˙��m�:n�b@P%>� �.F����}��b�q� ����4/����oU��D�~��.W���W$d�>��#�:����dW@ Hu�V��>�{)�>X�#)���I�[����.9����5�eu� ���i�
Static task
static1
Behavioral task
behavioral1
Sample
16f9921a04faf26fec14f3bf4d43611880dcf06718dc0733182ba207ab717e52.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
16f9921a04faf26fec14f3bf4d43611880dcf06718dc0733182ba207ab717e52.exe
Resource
win10v2004-20221111-en
General
-
Target
16f9921a04faf26fec14f3bf4d43611880dcf06718dc0733182ba207ab717e52
-
Size
2.2MB
-
MD5
556743c10926297a80c7b97703044789
-
SHA1
3e48d017893a25ce0b5025a673b2b271c314631a
-
SHA256
16f9921a04faf26fec14f3bf4d43611880dcf06718dc0733182ba207ab717e52
-
SHA512
1757593b2a948ffc95e91249c06958c4b6e466e173214c64bb4f62c011b919c360a2dd89692a8b69abd293eb88bf42c50c5cf7989c8a6a2877dd8110a995ea89
-
SSDEEP
49152:FfvYhXRbUcyQhxUtN3O3ghB7Ow5qDEZzHplcm4BdklvP:Bvgg+m9O3ghB7Ow5qkz3cL8l3
Malware Config
Signatures
Files
-
16f9921a04faf26fec14f3bf4d43611880dcf06718dc0733182ba207ab717e52.exe windows x86
35068bcce43c9d1e142bba1157fa3292
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryLock
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE