q�)ry�d�{�}�nH�ch�I3�u�$������U�ْ�Wj�+��t�p�gw/��>[��}(�j\Qr�0�$������kIg�7M��ί���5>�2��e�E��$zc�F�YD�S#���,�ǘ��;">�{�%0��o��$�7����!��u�-.%��Q����l��/5ڢ7�i1�4Z/D�^%�%�����MX���ϳ�E�|�����R��2�0<E���5�M�*θNP�`�8�G��1H[xw qV���Q�r$��@P ��3{�69*mL;b���H9���������L�I/�4.��]ӊ`�x�.�YsŒ����@(�s�n�*:5���ɚ%x���`�&���о>:���A�8�p̱%^aВ5^���bOJ۪�S���?Y>���������lU#L2����(��콕^��e��rp�|1N`Xb0���(���ПJR*���xzM��b0V���%�(�K�@�v�s;|��},]CגP�Z[7����]��֚g�A�3{�/����֚�DN�5V�0x��d��ɺ��D�{�]��P�l�Z�|��Ŧ��w�Yy�����$˺& :2����Ԕ���~Ҭ��zz�^�ߪY���6���:�[��Ge.�E���2T�����lF�+TU� �#�� ��@��n�*v��OLz�i�F�F��Jn�F;��`"����-����Ƈs��� ��h��O ̾k�É@s²{{�Q�43?d� >,��J �U3B��t��d�{}w9+�z�$� ��:ME�-���2����В���W������2�Yzc<,\���y�M� !����S�U��C�簗(Ag ̉\���Мf�O~7~�i����d*?0��K��'U� y2�'|X��Bi�a:�r1�&H�J�����jii��$�O��>�O��lI��;���ZD�~Z�B�]r��b�;����.�5�����^p��(��X1�O��f�W�6Z�=�}����H���}n�.j{Z'���X1ܒ��_u~��Y�&�������k�z�r�n�)X�|'����q$jŕDm�4ĘE932'\�pi �����mۏ�<͔�1���q P���7�������59����~�Hέ{Ɓ� W�����!,, u� �gܛ�T���c���xi���!��R�J�=k�4.�]��S�+ �"_� }���(]� �X!S �n�-J}*��l����o���-�Vn٧1h)dG}���E����I�)�!���}&�ƚ��k�K$h�_��d;���|��a_��ŹP+c�V��UA�����J�����x�S5�*�y+ϟΧ�c��-��δ�BW������f�w�:��3Jq��S5N��禊@��*���|[T"��l�3c|�B�2��2d@��^^F{�H�f��C��EL��` �J�ڵ������`B�җҡ5�Vby\��<���0����7U�R\�E���z�B\u�����1��O�˃�iӈ�1#�}t�r|B%K��ͱ�O��@N}z�D�L�$84��ȑ��M~�-y��@{�W��;Wd�cQwa��Ƽ?(�� ���l�� �{:� ���F�֩_;�,�2}�=O�rZe|��B�-����s�#��؞��5��1g�����������e2a����ьoq�@�lLF6E��µr�u��pz��A:i2�dE|�%��q�2�N��8��T�@Tc7�k�*��~��I�(��U���2�9y)������&Z������=v_>W� �t����ͧȜ��>$QjP�'����vy���>���2���A���tQ؊�><�Af�ӏ��>���p�F����4 0*vi k�,S���+4cܩ��d�آ�4�:�H�T$eE~�?��|�������[�f�@��Ғd^�e�,�9ܼU2�>{a���;��� m��dW��ߣީ�hj�-՟��:rU �}9�?IXSw[$� %W���E��^^�}��� k�,�;rE`�G��[tA;��x4�~�V>�}e����'K�(W�͜��uݠ�*������,�rlB�=�� !�gF�%:p�`I�6��{�a�PD�� ��$zx`F���Z�a� ���,#}�hOյ���ǣ<�&~�����.����V�j2������{��I"I���a���db����z��d4E�P�0���+ACKIm� 4��8�����v/���o[�p ���ՙz��F�%l\O`u�W��le :a�j�a���D8��⚙��Z�^�k�Msz�E�O��,?��� [B.����s�&E�06I"~�y\+��L��p����b��G��J��8�����˩tk|D���'�gR<Ϯ)0�8`E�������h?85��[��G�������duRE��$�T����[:-�ut�7��-H�' �Z�č��g)��/\bI�vY!"<�� 4�v�r';>3�K����]��ө�x�ǧ~kD�����#X#����Ul�=��O�0m:�y���BpՓ��9�@��[0(H�2/�@���-&x���(b�◽n��q3>N6���s���>�ٵͅ���3p��}1��wDͻ|����K�`y$�(�Dw�u�;���rn,cF����$��@�Ex�o�^n�Nz�����9&�z�@���= �-L;�����(0SO[�K� ����8Ë𫝈iة�eXaX�G�_�>N�������ݹ�qz��o��1;�/���)9�ܴp�->"/2����ev�x d�r�B��p���|��\�=���zm .������r�N;+�TK^*��������'�֥�z�@<(�˗w��C�Y�37O�0���)z7 "�^�ͦe`��8��I.ZD�&���:�:��z���Bc�d�P��G�V�6�H˰X��b��k0��bo�����u&:ҖGg�ԝ���"P�����J��JLj�V�y8z�fO���^3%A���\0o�w�Z��/`ʇ6J���ޞֶ~�.�_��� �T)���1�5�6���XY���Q%�^U�j��R��F�
Static task
static1
Behavioral task
behavioral1
Sample
09c4eb7f6e8a050eb2e7c4128fb6646ae8cd0c4c6b624276cc0c16cb223dcf12.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
09c4eb7f6e8a050eb2e7c4128fb6646ae8cd0c4c6b624276cc0c16cb223dcf12.exe
Resource
win10v2004-20220812-en
General
-
Target
09c4eb7f6e8a050eb2e7c4128fb6646ae8cd0c4c6b624276cc0c16cb223dcf12
-
Size
816KB
-
MD5
87192265e13bdbb9faf7a617f8b546c6
-
SHA1
f7cb3cdcb6c87f42d5db8ff19e7471f5730a1fac
-
SHA256
09c4eb7f6e8a050eb2e7c4128fb6646ae8cd0c4c6b624276cc0c16cb223dcf12
-
SHA512
928f1dcfb993a89c986b925095bfc8688459dbde8ea81b1cdff6705b0ebe7bd3aa784644144101b6c43971934003ff0283f59b14d356a6ed12f0a88fd37ecb1b
-
SSDEEP
24576:O3xEEHH8YHQWlz4Ai5NB4ZAWH/O6Yd9V1YYgtXsh:d+8YHFz47XMAo/jw9ndB
Malware Config
Signatures
Files
-
09c4eb7f6e8a050eb2e7c4128fb6646ae8cd0c4c6b624276cc0c16cb223dcf12.exe windows x86
091aaef57ce32f7c334d8003210272ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemAlloc
comctl32
ImageList_SetIconSize
shell32
DragQueryFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 789KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 774KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ