�ӵ�I��h��'y �D�{`�7�xX��͋ |����&�h����U����mi�%�-�$�!.�`1\�,Ĺ�ϭ�'�0_Cˇ�`r�ȼ�ֳ�1�����FC4��k�zd��XW��d������_���Ǹ�#��:�'�B/��X��u^��~Q�y�����h.�2��Tt�qv"�G0��-t0��x���x6߿t� ��\�9�Eod�$L&���Ҳ��LJ�U�R@�����Ij� �� ^5�.H�1�4�WS�z]Z�ѹ���42uѰ�tzC���}�aD9�]��ފ��-~|�I�C�0�3P"uJ�w����C+�3ȳ�L%4��=��^c }�:s���"l��#��Ո�j)u���5H83,��~��h�nX:����\�m�sW!l"����D�>���ɰ� ��+�,�u@�1�i�|���o� R�MN�Y��Л�j����/�G�������Au������|y\��B����a�Q��(D���O�s`���j��<�h�IR�Q�cWŭ�Y8M5Ưq��6�<�p9]���C�U���n$M�Hl�����I�ԃۺ,vEנ�����N/��ݒ��j��2f����XK��W����3"��m�??�� o�a���s�D�-��x��?{��{��g=�O��;�VE#4�6��5���s��JTŚ���4�4Z=Z%:Lpm���$�}5�҅�r���Hbl@��q�U��߱�/��K�����kۈ%���`(:�������r�u��W�>z�G=e5����@�3����>�Z3\ex���H�߸jlY�X�:A���v\�(n��: ڥܱ��@X<C����L��3�zyp��`(���qƹOo}GY��C�o3؊?e��R l+�L��[c�,<�KL��������.������:�1Ъ�1��#_:=��ʹ�����q_{7 9ix�o����`��xd5h�>� M�ע:�90��f����x%�4�̊뚓���w�����$>��!��M����i��x�%��`3���I/HƗB��y4�Е�x5�ν����=B^T���"�@��Ş� �b|����Th�y 0՞w��ꇋ�<iWX��":��s^��A���ΕuG�7_��C#Hǧ���x��Mo�YW'i�*>Qn��Vh��+���ݻI�d e�7��?�Tnj�9�Z(�o�'� �u�x��7���l�2�oT��?rl��$�&��f��Go�z1 x������+ݺڲ] �5���ټAE��Kda�J�ۜ�0���I�v����{: 3��{z)V+���/������=�>��w��e��6)��2� ���I���U��I�t�A�����(��4�����֬����˟S���i#��2��>//�eP �Y��Y8�pC�$�9���W/i�����I�a�.���T�[�1(�\,� �3��7'(���PyF�������Y f���&�� �6(SB�ɘ����Ź���k�(uR�?H��j���� ��W$��7�H�K���834����PsJ��-�AB�L���m�- w�?����u�6p1��<���x�W:�R�����q��=�^~k�H�y��3�X�S�<65g�a�]�0zJ�_*��`7KK���WC��x�v=�7v"����;�u�wR�DϺꨮ�c5Κ�uX�������@�����pu�zV4aC�I��(��G�f���h/�/����C>��i����{��*�T�oLg�ϳ4@$õB�5s ���[Ŧ��yuߛ�+��1�)��6K�ËZa�/S��D�L7}@����`¿T�/!���s굼�>s��I�CB�)Z�{7h�`�:J)�\��3�u�[F�i`8��`]~�M��54ε���%^��K��6�ܨ��&^����/�SPr�u{q���;KZI"lB5�.�����f�/v�oƸםU�c𧺆���>�*�e̷����-N��8�Ce� �-r�L�Y�~3kf(]�:��7�|�0�mX�kD�a�=�U�K��ŏDx�T�f�V,6�s�K�� {�.��Lb���rkV�7�W�J���� �c}Q&(�����H]�h,A_�E��(���z����n�U�evgJ��/N:��Q@QRNDb!W��x�><2�pV?���^�Ś��O�f���>��@>��A�}�o;%N2�V䕌 Uy�����z�[�����4k��� �����Ί���� �}e��^��xW�p�x��n�9����C!�>����G�����14*��b�J:gC\�r�|�۬�ReI���n�~���aq�P.�]��^N����J��eCD+���f�0�l�� ���y�����"��8�Me��]��d�Κ��-6`$�w���>�+*�r����Ⱦ�(�p0s�Ͻ���άGX>�@�fyBT����|�,��++Q����@�H�Jr������ԛ-s.��y�ޓ�2(��2�X�A�(3 �ܟ�MjA:��G���)���#���pz{Y�9�EՕ^tH�i/^���t����dN���k�V��J/����/�X~��ZN ݁�:}��T�)���cy2Ʃa���X�$!�Z|*0/!�7)����SG>�aA4b�5���F�k|�W2=�>|Z�X6k�A�xL&m��,&���;���}L������l�nA�8��0������B?�k�+9�by߄�^���%LYNn�:��,��$�u|I<�:"�7�����Փc������Vv���|�o�Ix0�L�Մ����_����JW-��:��Ns���fZ�Gz['-�5�P0�7��І1 �N?����Z�����c����]���("����_eǃ|�;�2q����5[�Mʫ�qn�wO[���DHװ��u��o�9ݼlJ�9�(��UQR�7�K�u(�o"����H�Ք�g����D��J��lA睋��F=��W8<�縻���ex��Ё-|�*��4]��* � ��g���@=�W���MS�ӹ\�Q,p�=�ى��ikHZ�^Sj������!�{���A�]g�q�����
Static task
static1
Behavioral task
behavioral1
Sample
ea606628e2b574c0fe7c92f9c0c06adad8a1ef1f835ef00b924be6fda7663655.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ea606628e2b574c0fe7c92f9c0c06adad8a1ef1f835ef00b924be6fda7663655.exe
Resource
win10v2004-20221111-en
General
-
Target
ea606628e2b574c0fe7c92f9c0c06adad8a1ef1f835ef00b924be6fda7663655
-
Size
2.6MB
-
MD5
66c6d50673f2bf5de92ab0359b35a47c
-
SHA1
9789572c7423d44ceb9cc41bd2a7fc7f93573667
-
SHA256
ea606628e2b574c0fe7c92f9c0c06adad8a1ef1f835ef00b924be6fda7663655
-
SHA512
42fbf82d1b1f86483bd0e20e1de013795b1c8e54ed1d0bde50c5244bbd7d0a7798d0b662bf57e1d992e4d0dac3c675aff704e0d6462ad393f0b589736f17a737
-
SSDEEP
49152:yRtchLH0e6alQKGXWo3zmyHEX4sA4YFOVvXaOxoV3g2noYEnDxoSvXbJXjo8g7XC:y4LUBoQKGpjmbX04YFOV1umYooSvFXjv
Malware Config
Signatures
Files
-
ea606628e2b574c0fe7c92f9c0c06adad8a1ef1f835ef00b924be6fda7663655.exe windows x86
c82666abf2367df21606c12f49660f65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord621
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ