�g��.�f��{V��@�� Kޒ����e�3� �SX$I���?W�K�[j�3��(��&)c�CRxq�r�U���Ļ@\;�� �5�#w ��%�s�9��Q�Є4q@�}9����R]}�f�܅ W6�Oy~�E���Sg�h�&B�!G0��A*iK�j �E�����Hs��{�p��&-�0K���k\ ��W!2s��;��V�[5�-`��l���m#Lߐ�� ֟�l���~o�z�mgY;Nh�+�g�f�ٹb� zI� $- �߫�r����M�l ����}.z i �-q��eB�⾬:����k��q�0"��M {|�Pؼ[� u-; J3$�x`ӝ2'͢/�HFw_c�Bx�y��U���̊�?0m���"f1~Q9%.5Q[�4��~�=7����ʹ��6��R�t��?&zV��OXм֩��.�8�l� |,�b�=�I����4�Τ�[�D�fiCȆ��5I=CKv���?��&��e���gɡ�~(�U��Vûb��� ILU�[o�v7SP �=�w��v��� `��#-�c�O�/o�&f�M9�g�l��͒Aަ`��D��p��5��&����x. �c��1^[E� Ҵ|a��ٟ����jO�;�G_��sڷ�J����~ � �U�a�0�������IA3���,����H����U�y�����uF�z\V1�����`�<����@��3"���~ t��|+ <�gwn�fO�ۉ@.�_B*0�M��g'��7��K�ʢ b��,?�v��4�L��N��KsNR���k��~܍J�F���8O�nv1��]O�2o��&De �<�zP�Nw�����KQ�N�g�������QX� �����Jd��DZ˽�[�$��=.�5S���<����AF��P�SB��9�(��>�ZO�M S._da]$������Ӣ���Q/#�;\���E�R�R���c2T�,���t2_QV�;0�q)��3���9Q%��Хb:(�Mt2K!�";��_u%����L�x�l�V|���U�\p��Ֆ�� +ڲ�)����Չ%emD��6�7�#ᝤ�?��%�W�r�N�|���n��s��nM�{82�J�c���=H�?�r+����g_V0���)E��%,�0�sx�ݻfU�0t��,�Q�"4 ���r&�����:��%�����n�� �qVH!vo���c�{�ar�,��K��}_`�P�ܞtj�9����b��C�fA/�P�O�fT�>@ q�dϽg*���˗l����X�o�G"�������|�D�k��_�r�N��%��Ҡ��s���Z���� �S����u�jT\?���r����-�P8x�o$qn��~���w�5W��%���DhfB���Ug"zPZu���()� �~�$�ħ W�g2��qT��aĴ���kyq�+K�xO1�Zn>����]��5�nn%�Iy^�����9K�z��w��4��Q��L���w}&�d���!��hQTF�y<H")�Z� @T>NJ��0s>�Ο�� k�s6��B��Zt���D�D�'kLc��W�Ux������<~�����Y���%��BL���z�K����^V��vز߂�NO�}���U]��8N=N82��]�6��d�K*E��bO�w��S�G2?)嫿��d2�J_���_?Qʵ�]`Ϥs�T`��Ǝ=i��IM��=Q��z�Pad qj�>�3Z��x{�[�=�ȓ��_�Yu�6q��@���;�?��L�(ʛ�r��ZZ���S�U>�:���x�л��fS��c�g �@y�<��2����W����# lR�b,�d8��.�`�o3O��Q5�z��K��0��$z�_�FYJ|���B��{=��� �S�'���w`��.c�%���pͪ=����kԓ���Td�1Ҝ���cFe��p� ���g�.X������Ͽ���GŮ��l_l¶qO@Q��P��Y�������UޱO?�x����eWݬV��f�.��x�q���<���Y�n�^�"A�-VW���,{����~6^%����v�����'twd����Ll��nإ�'HD�#�-j}3��{�ί���Z��Y���hI�o /���8���:]-�+�\��t$ x�QX�^��M�e-���Ɣr(�����[#��g�}�`��\~���J���Ǔl��V��olɑI1s�J�{�ns��Z2���� źW��h(~%�h+!����0I��-�zI�n�<�c�t>YP���3w��&��"�IR���h��3U���)���'u�;����g-\�O�d�ޭ�Nau5�Rva"���.� �2��kr�����O��49���_��;K�hG�*4W���4k�.��w���P@-��ق�¬��O��ۀ�Q%�d "h��c�,�u8�M����'�+LgC�6s��i�b���nG�T_���{{��\)$��p8���I�!F*V݁*�r�%����^8q���b;�B�m��w�;^����'���V��K �����:�(z�3.R/n��U��Y#�}5`�P�aU�$4<Ŀ�j��x ��2��uz8�� �ښ��-���;$������p�W�̫�<�6���Bן�yB�J�4jWa���;���3�����&!�f]R�:~��[�W�|����K�uP�W�34�4,�$Q(xx*�$��uy��Ԡ��k���-A��4��W�^RR7�NI�E���K��($Z��FA���l�5�����6\���Eg�FLy�ЖW������+PO7���yu�㢵A�K�s+��Y���6O�ЖN3�6E}t�SB��lSt��ޭ��,h�pj���U��t�[���W��X ��8OWs���|�C��E�{P��#���"/�)i����0/6E��Me2���B��.����Ӏ_2���#�Z�>i�[,��2P %��@�u2�͍���x�`}�X4��*��v�L��H��Ù_���%m3"�9����y�e�VBy|ٜbÖ᠃��M�l_,@Y�֘1�TO�6<vĵB4���!�N�i�8���4����E���d�:JM-�W<��
Static task
static1
Behavioral task
behavioral1
Sample
44d4293d83da18818fecf8b184444a83d644ecefdc915ea523904de1c114ab14.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
44d4293d83da18818fecf8b184444a83d644ecefdc915ea523904de1c114ab14.exe
Resource
win10v2004-20220812-en
General
-
Target
44d4293d83da18818fecf8b184444a83d644ecefdc915ea523904de1c114ab14
-
Size
2.3MB
-
MD5
c0eb90eac2b106dbaaa38de803bc4714
-
SHA1
c96cc7afafaf1cd20ec5ee7f868c09e0c9fee7ea
-
SHA256
44d4293d83da18818fecf8b184444a83d644ecefdc915ea523904de1c114ab14
-
SHA512
71d7de3854bb47445711fd4f30bc471412f455eb3edebf2ab94ae942f82abdbe81f14063ed2d78f7524a076d474eace6c91036ab7928ff525077f26edf97845d
-
SSDEEP
49152:eHndgArX9Qu0Jg8yP57o7W8MCyFBWcKI3YrdxX30pye:+gArS7JgJaWn8cT3YrdxUA
Malware Config
Signatures
Files
-
44d4293d83da18818fecf8b184444a83d644ecefdc915ea523904de1c114ab14.exe windows x86
d7153a252ed265dbb180d907e6ba8059
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
WSAStartup
rasapi32
RasGetConnectStatusA
kernel32
FindResourceExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadBitmapA
gdi32
MoveToEx
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
VariantClear
comctl32
ImageList_Destroy
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.suzhan0 Size: - Virtual size: 844KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.suzhan1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ