4S����������aY�D�gO�~x\�� OOy�UP�01C��BJpS|�A�����8�\ ����n�O�^��!6$���y�6B�h���G���U����6��f:�^��@T���}��#L���G�{L��ؤ���A�ꔸ�C62գ<�� �QSg��C���!Ov��kÒ�#��=t��ƀ+��,�p��zu���d�5�j��$t �3�V�캅�c,�!Kyi�{ �u@BrG���h�ge�����E}�������\�I�x^b�\�î��Ų� 2��f���������\`��l'�4Ey���ʪ ����b����.A��f �Q/��}*��럣���qd}qMo5��j�N�R�C�$��+��������~�pC�p�z%���z���>׆�\?���'�Ȏdz����v�$�A����Q}X��.�7���,����"���w��W�A�|�H3�����f�w�Fc?U�-<xi�� �.��5�vI��bh�Ѧ��"�XB�žԛ���� ���kSW�eJۛ���m�.��R�[�2ҷν6tʧ§���4.f�����,�����[�5�ZX4�O78s(�C\3F�f�K�'��n�!�p��T)F΄:J�#���f�Zq)��h`����ȳ��bƦ����W��'�>U�Кu�}e%֯c֊��]���Y��I�:ҹ�Ո�FN<t������g�qH��\���M�E��{{(w ���H��.��)�ǻ{k0��')ד�_�4��H� ��>k�ȟ�)��m����T��]2c*�92�aH�c��wUٟ=�$$��3����u�ɹ,q(@���{�"�")��Xؖ�aZy����>�! �3֦�iً��伷���j~~��K�Oņ�6��$����X�ѝV~w���8Ӳ?���/�T�.@fN]�ͮ�����7\�ٗ#,& 9,�3���;��Y��)��$D�Q��cA��K�<�{U�z�T�������w?�\}�.5�)Դ��]�������a)/!�h��1�b�7��o�#b�j���μ�P��N��)�6K-ho�I�����֏�5�0�����G�ew )o�Hn�Е���,j� ��o���C�'?�h�{wb���E���/�o�`�.#���w����������ᑬ���:� ���j�br�"�j=l��4I��S�1)��V��OS�_+O��Ue���n��7h�4t36? ���PV � �Rtk��������`��#� ;�R<���*���rp��&nm>'�����f�!�����o�'�p-˂�/^��'�����\�N�y#_5�f��n�!��!��dhy�o�1�0�M����}���,+��YE�(ۗ'P�Λ�(=�L|3�PNr�,�]�>j��J2kT7?!g.x_�}ӊ`ʹx������=�ɴkDŽ�\X�3,� (�ϣ��d���0�v,S�1�K�[-�or�-�Az�G?W_/����Ǜ�ɽ�3.@�leC�%���n��?�x�k1(���r�M���5wDŽn��W`��f�M-�h���L�a�>���i֑��h^�y܋KJ�k�J�(Ee��|T�jU���J���.��RI+q}��n,�W��4 Y�����E�ZTõ[��6�+�,Ս�"�Խ+��F����P?��f ��6m��NA�IdY+]�S���Pa����l �YZ?i 6yǗAp̈́�A|�WXԉ�Z���M�*I$�����g�zG�\j�S�:R�٩U_��p+�d��/ ����%Y�jn�3o:.�[T�A�T���{/���m�����/��|�lC�<���g�������E?�Ɯ�U�欪l�8��Ҏ��F�ǫ�)��<VGy��tTf�5UM REG��ڭ�2Y��C�(�����S2���x p8�]=䛬����?��ͽ^g�Y������� \2�Tz'��gy�!�kݺB��w-A<![?�Gd���\Չ����\-X��%8��\�nm�aғ�ot���kv[ qm�(>�4���k�����Z��_IShl�I��Z����ğO8�x5�������i`(2a�p����;w�9��u�'���F(�n���(��� ��(w�)}r�VX��@��'�n��2�-�JD�!SA���0�K� ��l��Ru����i�>�#ed��aaz��&4k !�I+���Њ��r�.{0(�b DH�*&J��~�m7L���Z�_|&23�[�Qh�q.'��T�l���ߧ%<�2��%�%?�O2����Ա\��R�': �cX�#X�p�/H�&�9s�/�Eϋ�>Zg��4�0q�x��MVu���8H��g&�E�k֣�S�]���e�Z�RD��m�>3JH� r�)��=b�¹�@Tk���h~QH|�Z���惜eNѫ������;-?7x]D���-~^CW�Bp��+�x<;���\$��u����߾RژAt �Q}����5:�ؐ.�e�K{�^,�(����1�-�`&�;5�I߅|i)�>��~����:U�8����+M܁�R%�9� $�����{�U�P�~�?���*���sn�3I�н�'�l|n~ 6����������p!h}�#x�4��.<��T48;Ɍ��z��am�d���(9���s�9<�Y.��l�0v>�O�Pu����Ç�A�My�,��6�@͞����f�g�c܈�w� �-�?��qp��ԋ p9L�����,A��M ~���_V/re��04JWʸ�Q@ z���om��W�-�) ��,��]���~^���p�t,�>+����� wXwR9>�3���`~��W �M�O�K01�ʉ�8m���֮�S������g�v)Kaժ8�.$�⨕�:\�*��� �*�r}kN8Yv��m(�]�#I>!!TQ��Nc&R�<��P�_� ���<*��Qc�{�7��������n��L��?oJ�yQƊ B�nwk��d�'W�rE��3`�ݓ �-wd�ϲ��R���&�&��K��C�RyQP|��ߊ�Rr�*��� ��
Static task
static1
Behavioral task
behavioral1
Sample
14d6ac3032ab77302ff31b08aa772207ca5ebdd05965ac25e7779a41429034ac.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
14d6ac3032ab77302ff31b08aa772207ca5ebdd05965ac25e7779a41429034ac.exe
Resource
win10v2004-20221111-en
General
-
Target
14d6ac3032ab77302ff31b08aa772207ca5ebdd05965ac25e7779a41429034ac
-
Size
3.8MB
-
MD5
c81b884ca37638da84e58ac76aac0318
-
SHA1
a5ad886501ca3d46b81fe780d6670a6e44aa3b66
-
SHA256
14d6ac3032ab77302ff31b08aa772207ca5ebdd05965ac25e7779a41429034ac
-
SHA512
b99bed7e437c0adae1df2cd7a903a972103465b7e81eaefeaa05360cd29bd0ecdb4539234eb9851f87f4604f212ce47b815b156a2b3dfda779079557e35c3cf4
-
SSDEEP
98304:FjFLCbN+ipQSCbD1REcLAzDlDeXscVw/t/PdOHX:/LW5QSCNoDlMohm
Malware Config
Signatures
Files
-
14d6ac3032ab77302ff31b08aa772207ca5ebdd05965ac25e7779a41429034ac.exe windows x86
2a64d7c5b423f9621a501ffa9ff5ea66
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
waveOutUnprepareHeader
ws2_32
ntohl
kernel32
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WinHelpA
gdi32
CreateCompatibleBitmap
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueExA
shell32
SHChangeNotify
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_SetBkColor
oledlg
ord8
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 518KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.z3veu0e Size: - Virtual size: 955KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.z3veu0e Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ