��ֺTT�F�p���l� K��*�����^�zM����3(��8�\�i�YD����J���}���>��A����̓�IX��H��Zޙ�:�,͡���U�_�۵�ec�-T��9Y�0m��9w��-@0��xas� ~Υ���G8!$LDB�U�]>��j� vؙ:�G�#k�Pr�g�x�W!y�#jZJ ����$��j=�M`X6o�7�L��_���MY�1�N^�Ecs�*?��H� J��V��ܷ��Ո��`{�P�@q~����)_G�"OI����̇���E��qg�vA��*�*���]���з�Ƴ�h���iv;X���8©��t#���G �H�C�ĺ�Qu,�,��ږ�ʨ��#��m��(�c��P#�����d�ml9�;�wPl��,���Ha��xgk����߰��|���a�l���]�Dڦ=�X��&����������HwÀ���������੭H�r�+�o�?�����-VB���d��.4xW ݺ�B��梇+!��"�uN[lqW�#]_�l���Mʑ������:�kMs�-�=V��<�A�QL�t����|� �ű�?6u|�7:4ܓ��M𖪒5+8������&��Ə���F����ҬR���-,w�0h�bN���hu>�J|�Fi�:sb&�f �n;4�{PU��@����� d���É�0ţ[��Z�j��;C_��=G��ޅ��L��5 m"�5�m( ����c��F�t���Z�,��wV[��^���Hz���k���%L���U���e������_!�@��7nƂӳ�B�/:�B18��b8Y��pz�^H�C�u�~0�*��(AyXΆ.��c�w���u���)�_����0�KS \�1��n�c�%nA��:i�_K�pU�Ѽ��|/���������I�61�ٿ{� �1��C� 0!�=������d�Kc�a���T�d4>4vK��~.�v���y�v'�� �J��L�F��ǺX��?�<��H��dJ�������F�m,��}�n#̈x���m���RK[ ��Ȟ&�ʀ�����g%�w�K���`��9��Jgw��J�B �/#�|�����x��Q�S�wT=ϒ8���<��?���[;x��*�僕��y��uSV���$@��������ૄ����jXs���?����Le�o�f�-�]*p���"�\���<�^I���U�s������{�9��K+��@���]+��b�3���[�>1���ʱ�N���&q�� *__��ɽ�x��h�}� )��IR�]M��vh�Q2ǝ_��Ht?�*��ظ��l�끾w�]k�'��� ��n��_�5f���.�w��c�Tni�-����kMq��o4��+�ȩ�A��I��M%*e��������OYiK�a�n�n�mߗ�#�� �/"i���>rG��&��W�®`��O��7�Z������i:d'��̋���%�B8h�v��Hɿ:��5�;vK��-XR��Ɂ���4�|��h]�cZ���?K�k�]76K*�[i�_�&|�d�J*����.f3=tW6R B5ަxW��.9R d|�� �1<h�.�� q�g�|��Tu����[�`���FAİX�K�-��M�P�b��x�����.��T 38�5i�o��W�Q��?1��=#�<�,��;��_���4_�b;'��-��c+�u������o���M���7y<�e��M��ҕ���� �T���$W���[��N�L�~�W�!0�w�(����*�c>O��"���H�յ��aXG��~�L��3�+�Ïԉ�IF��#0ЈNf@���Dsn��!�\]���1�善�':����f*��Z�"�x}�ϩ�t�B$���%���}�a�qM�yׇc0�СJ Z�����&�4~*f�7PZaoߑ;/r���L�B�5�L�E �������E���,��ܖT�����c2����:��OS�__�5��p���?�+���;ddn .��FtIMo�'������jM�q�-x�)�b7��21�C��H���p� ��5&��g"�F���{��� �ӉU�����T�j;��Xf�B��oI0�o��n ��cc��i�RmN���� K����f<� D�)2��O�����a�D���/qfO��?��Wy�qD�9� q2����\:+\]�9Y�1F�,_�BJ��m� �#jۖ�&8��.�k�d�n ���o�P�_a� ����S� DDo���]��&����� R,���"{J��v��Zl��լ�&��NV��$? �%%�:|{0eZ���/@\̀{%;1^A�V�٧�k���;C�,z��=D(˔u"�$���"%�#� wv��;6�s��KYe��f����k�*`��������]ߢ[Վ�0�� �Wy�x�.�hW�c,[�A�[�'�5 U�0g�����o^4�#���e����p�G�m�_K�=X��%(g��'i�����8�����O�T�]B�ȹL9��g��G#������5�h+f;����`1Ƿ�I�쭥�<T�z�Z�{��>�E3ʌ��������bQA��c/2��Z;�,�lr*LM_�/,���4�#���.%���<I�&��������G�_�5iv�0�,�����2��r]S�����u���\��@~ڈw���X�e���U a�O|��)��i�䔪���UtfuźA��}T����1�F���y ������c���վ��v��ĵM��{y�:��ꢷ�"]�"�-wG������l0x��g�3��yS? k'�����U%��N8��<2����koc?����j�ڈݓ�?v�òCK?�ٹ��ɚI`��\z�����KYzr���4�h��1n�:#����@�آ�u��4�#�^>Fv."yx<��֊t��_�)�(�ٵE��J��VΙ�<���Q�!�3 �,�q�ڏ���2���Hgx��m�ܕF3�h��u�۳+͈�喘��}U�Е���ZI��Œ��\�)z���P ��y��fĞ[�=�g#�2��`'
Static task
static1
Behavioral task
behavioral1
Sample
de52130b0e9311f2fcba1789697b6b48d6b02d98721742201be720451662fad3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
de52130b0e9311f2fcba1789697b6b48d6b02d98721742201be720451662fad3.exe
Resource
win10v2004-20220901-en
General
-
Target
de52130b0e9311f2fcba1789697b6b48d6b02d98721742201be720451662fad3
-
Size
8.0MB
-
MD5
14168983e062b61a93d9dce097117e5b
-
SHA1
40fc16a4030ce632541d4b237e67ddab9293238e
-
SHA256
de52130b0e9311f2fcba1789697b6b48d6b02d98721742201be720451662fad3
-
SHA512
ff0f18e4c7be90b3a479bc55358cdf441a69089de5954e4b32a38fb012a6669e3e2389d79c7bf18b741e6ae2425a476819b4dc292e9ea1008a801fc46372eeb2
-
SSDEEP
196608:qw073/JhKbwGzcMqi2+bXYRD88gbPjZAZMaAzHWTt:v07vrKbfApCXiDSnZ+T
Malware Config
Signatures
Files
-
de52130b0e9311f2fcba1789697b6b48d6b02d98721742201be720451662fad3.exe windows x86
336f0f2289814686659da203142b1106
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetErrorInfo
advapi32
RegLoadKeyW
user32
IsWindowUnicode
kernel32
GetModuleFileNameW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
SetDIBits
version
GetFileVersionInfoW
ole32
CoTaskMemFree
comctl32
ImageList_Copy
msvcrt
memcpy
shell32
Shell_NotifyIconW
wininet
InternetQueryOptionW
urlmon
UrlMkSetSessionOption
comdlg32
GetSaveFileNameW
winspool.drv
EnumPrintersW
wsock32
gethostname
crypt32
CertOpenSystemStoreW
shdocvw
DoOrganizeFavDlg
crtdll
isalnum
Exports
Exports
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 544KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.debug Size: - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ