Mo*D�6YEdjPdL�eX:#�R�����S����2]Ŧ�R�(�Q��0�~M@�(����C�в���D-��C��2ۤȁ�ws�-�z�����͟;*�y|���"���9�1KA�p+�_������\L�>��#����-���X���*�]?��o˻�z9t�ڦ��1��hѱ_��ƻ^\�8��.0;Z�>�b��eJϚQ_ጝ�|�������N�e: P~��&����,�}%����x�Β̿~���r$s%H�)�rI�T[04�,C�k���P����(�c�v��'�1$2 ' I�y>�����k�����#q]��ջI��W�3ʌ��\^n������g�\��zR��*��?�W�sS�D����������cT[ҠEo ޣ�LdB���:���r��JB6��˔19�5��(�-�erڮ� �XiH��kQ��4���j�1C�lU���O�+�I~� ��1��k�*f�J0�aj oL/�b�.E����I�� Ad�ED��R�WkS�;���5���BtS�o$����{�7�(���#��3Z_���՝8��������D{�D�NJ�{#>+v��wO;��Պ�n�Çp�����N̔5�^dW�F,E�a��^q����*�u��YcOnx�Z��4��Nj�,#�;��ؑ��A6t�.�>\�������3�����=���S�������� ����㥍Н'��G�芹?88��$��M- �����T+���H�xw�1B���� �XJ �5 �����A�n���u�W���Xe�0@IO ���MU����L��E�i�����3�&��'r��]�y�6���U�� !�d�+���s[*~��k�v�8wv��,�Pԥ���)^A�<�s��2����w,�y:��W��άF�����n�ˌƽ�7+_�S�?�Z�'.�1���o �攣D�̐Wj��dw�]m+&RP��,��h�Wp��ׯ�Rp!����LHe�#*�� m2����P6R���27�O��n���o��ې��#6~�RϞ�b/�����(3�R0�ۈ���0g2~�O!�]v+<R`����3��d�+U+X\۟���ݑŷ@>m�5"�t�E�.����s�a��f��(��d��X��v%~L��j�6��\�����pX7����&1o P}���x� 4��'�������R<����g]�'�j������e S�E>�����e#2A}����=A;ٯ |u`0 G�ҥ����5����B���hՆ���E2Ȃ����sExI�� S�N2�������D2���&�qç �[SY�~��}[+4Y������Kz�����bi�������[ޤٳq2@�2"�2�]f%N���V���⾋ճ8��2��������~��4�Hqwr�����r���ʞNu�śjë�{H�z�86$�E+K��ٚ�;i"ETe�?�-dk��f�91��ՕϐB7]P�����wӇ%�� ���Ƙ���w�etFJ��F�ژ����2��Q@���h��bD?�����Jkm4�y���w���W���������S����Nxi��}�n �(ͨ\��aZV��17�>*�I��4VV,%� �C�~�3�=��*��]� Fh+>��]�����Ø`?�c�X�IB��6���o�4���K��\gh������,CC+mg߬g���j�����.�|B����M���I�/�z���C :�e���k��/Zfw� �q��\��mq���?$`-1��l�V+C?r������8���`c�>$�Z��Y�����Ʊм����\$�˗fu�3#�f�[l��E�.���HP�r<��K�����mrWq��\?"u �ɡ# ��i��c����]���{���BC���u�R�-�.\W*��F�r=N ���(m��s3i_I��!���������W�u��k�l��>&;̷���{p#*�3���S���,TEe��'�.���;�[�O�3��֨_ήo�?ͭ�e4l���Y���q���jt@�m��5&l �������JF,tU8jh��F1���G�E�<�b����,H-�չ�CI^=�����V�8���T}�|�%q�D�^�t�c�L3�s�� �~���nu��ڶ����XU�{W���D� f�|=��,���9O�w�{q��O>��8�����*��7�K_8ў1�M]��,V��)�zk������=���'�?���T �|��6��]V���%FX�W�V��W^o������u���l� vJ�_;�`�zX��\��=S��9�'��UHh6I�3�@��BJ�D3��]w(|� T��C���%��ɂ�z��y�җ�S5�Q��� �d0�C���2ۣg��PG�6���`�&� ��o�����5.|��O�j�yE��Ә�z�2�����q�g�~�r���F[!s~�@���l�ml�״̐Ep`�/C8`�sx�xڛ�_75��,�7uh���uUL ��#� �Y�e(��Gr,� ����v��hӷ]�3�����^L�LI��l��d����������U��DX 6;���\םYY��5l���=�A���:d�^|� D�Or�|L�л������hlԟT��^�ˢ���SA=�qIw�8��*0Oh`�'��$5k�����y�r� y0��������+@�;���c1I�mr4=�k��?�m(���ԟ��m�҈&�j,@�?��Tf� %� )�(�� ��y�Љ��d�ëH1uS�Ǖ0�-P�j�p'z"�-�1sߑDo�m����.���GL�)���f4��s&�;���}��)*��W�� [�.��������?:�0;�����a��^�S���*�!0R_ h�A������i���J!��F��w��' ԉ��z��F���o}�y>K�U�m��4(�sː%�ׁZ��C؈C�mE��P���![�?�^�-��y�&t�C�`G���n����'���Ţr��Ϯ�̼Q��f�����4I41%XKqdU23ϨN\=4�Z�H�zYDe+J��1LgR
Static task
static1
Behavioral task
behavioral1
Sample
400c7a4ed8e6806654f79a243a78a055d127ac06e3ba2d1812d18f4755c532c0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
400c7a4ed8e6806654f79a243a78a055d127ac06e3ba2d1812d18f4755c532c0.exe
Resource
win10v2004-20220812-en
General
-
Target
400c7a4ed8e6806654f79a243a78a055d127ac06e3ba2d1812d18f4755c532c0
-
Size
9.8MB
-
MD5
86d8899f51564d18963d98ef7eef1020
-
SHA1
0cd116b6405a38b187ea5e3406d8df3ed4c92f5f
-
SHA256
400c7a4ed8e6806654f79a243a78a055d127ac06e3ba2d1812d18f4755c532c0
-
SHA512
69c7f3e0fbdf2298fdba33909a488b6135d65eae7da927f68ab9d1efbc59985dd69108cc39196870d704b99bd2c84a292085720c73f49674459d42f3fba0b9c3
-
SSDEEP
196608:zl3afV6BT9tcUdybsNJmkESguYFPvNkOvV6APwb+fSETfn3Gyx:h36u9tvdyIc7ttkOxw6fZ
Malware Config
Signatures
Files
-
400c7a4ed8e6806654f79a243a78a055d127ac06e3ba2d1812d18f4755c532c0.exe windows x86
3d108a7745fd2042bc06049ba532a1a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
select
rasapi32
RasDialA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ScreenToClient
gdi32
CreateBitmap
msimg32
AlphaBlend
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameA
advapi32
RegCloseKey
shell32
DragAcceptFiles
ole32
CoTaskMemFree
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_AddMasked
oledlg
ord8
wininet
InternetCanonicalizeUrlA
wldap32
ord29
Exports
Exports
Sections
CODE Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 587KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ