~W�ň�`�P{v�|eL�M�"3�������@s� bT� #�t+�as ���9;��V��ǻ�2�0z�ϒz���D��"�T%��pg�G�"ǘ`�J�d̈�~N8�F�z�T2,�L���f��H����q���H���l��$g]�J���{{��&Fd�����RNsq\��{� ��b���8�[�D9�ֵ���N�{9ci�q2~�Z��J/��:k���pK$�@�9.-�ʴ���I�y�rw|�G��$��L���V\�~(~/�ܒ������e�l�o� �*0��#��������h�� iC#�ؗ����$��p�v�i䃍�m��M���R�s3�dQ���X�gFKx`���'a�s�������!����86�w�<�Q��Y���[`Ȇ�IЏ�r�|jA=A��&K��I�M���zLg�s��3dYv��#�tz�j�5r��P�O����'��)қ�KY�R� l����h�,�2?���R�y��U�v�k1#N��ˌ��Z������@��X�2�d��F=�Ji�����:ω���n����R�:��������F��&y����� I�]��ZR�0�Þ�_�8�N�B�ǥ<�4x=���(�/R������pދ��H�.��� ��bH �ڀ*�YB��T��B����`Y��s`+���¯���RT �zӧ^@�}������)|��0R-�3N�{�}:�B�J-��b�eC�_hc��]�9:�&>w��`e���Nb_�yE�|HcL���c�Q9��_�3�e��6άF�Jo zR9.����p��,R �Q��'S��-`��K��!H�;<e,ߟD�x<t7cq��,�%�0v�T-��;E�� �_�'��x������J j���*�Mv��x�c�R�h��cƗ�wu�X�S�V�թ:XpB�ѣ���S���1 4K�^A�~�I�Fӽq�įYk�+�cS���ҼeBj�5�C�,�˂iG��O��� ���W��P\,u!��C�w�A�F��]�DU��e��[t��x!K��SC�� � 6-�:}��C�4�;4-���B��2=W �;.��q�KT�x���V��T[���<(�ʆ,7��ڷ���w�S�&۔R��ݍ���\a�j���W-�����o&�c�PL�cU�lB�g}l���Y�� ���k�l�6.���Ai��� ���7�a����I$�.Y�r�!x~w�H�٬3Ѭ%t��'l�iWͳ�e:�[p�H�:�$��ٹgs�P!�$����:^۞Y]��+�i�?F�M��mꀖ�"�/k�1E'�@`��Bl�.� �,V]Ψc��[�4�*� 0�&T <�y%��-�d��?c�7�B�)�Ȍ2śG3�+�C��U[��_���$���|L������m��3����9'Q"�����/WW-�i@�F�p��sO�I������uM�)S�����`���e;m%b�Hmľ�8������P�����?a(*"(Ȧ_�4�dŴ�;Tu6�����b�ic`;0�D�����[%GC����n�X��-���ۜ�P��#����ާ������1�9��;��"����@�w��3�:xB��YO?� �&���:��L���xO�zy�x��d!����e�Al��6h����i�0�kM�fy�ܭ�>�b��iJn�����"+�?\��ꓚ��\�Ӥ��)�34�����qz=P��;�"�����Y�&�)��(��4+獆jk,��~�,�q�)���q|��G�͊1��]��� �/^��N��NJLL��et`;���^��{��N�.�V�G��J�C@B��;:����1�'�E���?�A_)cT�L(���>�x4eK 5��AM9I�)�Z�_МO��L)������P��B��u�=Z�y ����$�V��T�AA�3!j��"���G!�0+�>���f��yS%z���H��ߝ����%�5��piB�x4-�F0�x���_[A�k��yH1����j�2#��N��?�W�\���:d,R��:Ή\Ǩ�϶fC�iX6C6���4DL{$Ck3>+��d!1m<Q]J��٤ͷ�z��bA{��RU،�v@���//���v�1�4��c��j�*@Il����n�jW��y�FLj������-C����ʀ`��������uV���{PV�Px͇[Z�L�3��l�:�ȹ;�BfJF���)�����D�aDZ!��B>%�tU~y-��c�v>�߫����:��Jef����`?m������� �G}"�QC�!������)�6�Ա�4���;�%.�$2����7_t����h��ǩ8�^�V�\'�,�l_t^@�o�g7V��;O�*�������� �i���w���q�h�w"�{�ҼA�3s�6z�M�쮵��䭗����7??��S=h2�<�_wq�� ?Imh����@ЮLp�ky�xem�@��&��y)���=��%u�Z�#��T��Ԣwj��"�����y��v�[T�V<�y &R^$ ��[��X�AĞ��p?{�X)X�wnX�*�U7�ي6���[��y�1�Oݔ�!$���eɑYBH�th�+O���%]�F�y��I��H�bVL�����D���3]�4��tO�����9qڣ�j߮N|�S�Ο��ς%��7�e����=�ɖ���#�/Z��gsY������.l��6�}g�^�儧L����p���흄�8w�YF ݰ�����xhv���8ƲٳhL�����UM�Xe�g��b=_`����[G�_S� �gm�N-b�{C�+�g����(��\�iPR��zq��gt�Dt��Q F���e�M��|��_`������E�������-;���뭞R�䈌��Q���^x�;K2NNS{�-����-�S���s���7Z_�s3E'��Iȭ+�;z%��&j23�Ԯ�����mi��~Q�ن4g�˷6���8Ip��G܂Sc��{���ӷ&4��ӡ4��U4o�SX�w,c"���*n>�@�D�D k�I>��� ��f�̈�7I11yĈmv�{��j�h
Static task
static1
Behavioral task
behavioral1
Sample
89909f834292c1ed65cecbe9e088b5c978d14e7df326d75a6876c797315090a3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
89909f834292c1ed65cecbe9e088b5c978d14e7df326d75a6876c797315090a3.exe
Resource
win10v2004-20221111-en
General
-
Target
89909f834292c1ed65cecbe9e088b5c978d14e7df326d75a6876c797315090a3
-
Size
2.3MB
-
MD5
fedff7b7c74c104310cd90d15a233db3
-
SHA1
00fd258dc166fb19875f7653ed1cf0a7f6e3d18c
-
SHA256
89909f834292c1ed65cecbe9e088b5c978d14e7df326d75a6876c797315090a3
-
SHA512
69d06542c3f3025e4fc4ce1318372a240304480a02cd508226f483224b888d0ee3832e7d74266530dd3c7bbc0303f8bc8b9fd3dd57b709d7233cf864541f1439
-
SSDEEP
49152:svIwfMZzPL/Ns3C/DFG0CUQTtPw7vyNpxYwTZEPzuRkAHD:sv677O3C/fTmP7pxYGEPzuRk
Malware Config
Signatures
Files
-
89909f834292c1ed65cecbe9e088b5c978d14e7df326d75a6876c797315090a3.exe windows x86
045c48b805d07f8dde5e42bf1fd11f99
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamProperty
ws2_32
accept
kernel32
GetVersionExA
GetVersion
ExpandEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
KillTimer
gdi32
GetMapMode
winspool.drv
ClosePrinter
advapi32
RegDeleteValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
SafeArrayAccessData
comctl32
ImageList_Duplicate
oledlg
ord8
wininet
InternetReadFile
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 505KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.erwerw0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.erwerw1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ