�YO5�J۱~T��a "'�ӓ�P���u��ZK�xà ]$�` ��z� ߁��������W�B��]g���g����܊��de�d��9����H��&��~��%�Ʊ/Ҏ]7g��]�'i�z2��.I����G�/������S�.h�~��9��7m�ܬ��;�x� @�L=�q��76��)�$§�{/h�6y��2i&vCq J�/�5kDZ��eT�R�s�\�|�N��SS��f5�⎀%#��|6�R�Ǵ�����~�ER*m�4~���-.��������w[Hm�0}Md���@#Mqk>���"b�#�g��+B��__���;-�D���@f���[����.�`��s� �����,��d��c�]�T���ӠG#"L��|EWB�찁Gm� }G��<w���}���f��`�I֣\HxU��`����C�Z�KwlS0��;v�"������2L�=�����ɑr�#�Z��^�_�m��G�U��J . �&���,���m��W*P�v��r���Y?7����J~1b�)��Tb�v>����ނ}�����wYe���/�j�G�$['�Q-�@[Xħ�O��P�������n��%�6v� 簋K���ɺ� t��C����.�E������8t�$�c���}T�{nV�����:�hx�*v���!��n�/� ^�j���#��/ V�I�)y{�`rA j^��G^*Y�x�6L3�~E�<�J�8��vT�Z�b͘��S�T��^����z�������q+����Q�B{�~�o��:��� }��6^{ܠZ����͟2an�3��ꤜr~��;��A������va����^UD���?�u���ψ>���q���=pRf���.��v����i�O0^�%+W�89��#�P�|k��ߢ ?�bR��W4y�<kN".�?X�:7�s�|�f,#64�����x���^~ӆ�D��Y������3l��cX"���z&�R�yNȅ�Z��wa��fv�?:���X^��O�Sħs���&���)g�,e�xz���a���/��C�j����E�Λ8G�}��u����|A�|#�.�AksJC���D������;4�1�^P�b�� �����Ҡ/��Rq���hfQ�lKcī�7O�D�_�[��:GS�/4@��i��K���� ̖��l�c%��9��m �-�#x��������IiJz�:�ܹ4�&B)ʲ���&�[��6�I|��ں�y�B�b�r���*��ԍ���x��J�w'Q(9d��%���휖����1�uOc��*�4���鑇���m��=S��9�Jţ]u;�������i*�V�����4�'_'(c�A:H4��"�Ǒ���@@�U��x�<��f��h�|��HZ��l�h�$ Y��g}�$�Ϋ3D�V:Ǧ�$��f/��e\^�*��B_b_����2�o�<��_�IMW?ײ�V?M)�BȈR�����u���y�'8J��W�'0�ퟹ�������SE.%�_��<;��Q9y����y�ofOp�CP�߾>���e%�u'o�}�*���K�'g�Q����)�\-���4���Mbo6�ji�V8�d㏀���#vJMfm����,������.Nf�<�6�:���Et%�A���_ jes��~=�qP�hj�`Q�i�{�"94����Sˠk���v���Q�:�V�Z|Cl� q5��Ļ�h��h��m\��73��'�����jc}�Moio�sMe27��͗NB���m����!;7��h���T��~#BD7���I�~I�쿰mD9�W�HU �/��D]�l#�ıe ��X������$l��u��Jj��D��⊣��j�'ʈ[)���H$�}ӑwTF`o<�;��ۧ�:��L }¨�3P{I���s�y;��(�������a��w/��w��(�=�A�'C7��#��<s�ż1��h�sN8A�;��i�8K�ϳhEQ���7�ˌS�� <l�61ME��!o}G��jz�6�z�E�X��!�뀄H��iu�[��.ةlG>" �&I#���>DQq7����;����x�m-3���I�fa���="����d��*�d�6�_�?6B��u����)� -g�k��X��BS���C��~w�����8�}$�¬�3�G�ҹ<�1"0��(���� �?��C�%_� ��#��v-�rvW�{��a-א1��eS�r�^B�X���0���7�6sL��<�R��v��9~������Vt�VW��Y�O�EO;x#��ֹ�S�7��\Ø�AR5ي��|��PΝ �F��kE��Q�_d�h0k��K����)3x���� �����9����s���!J� >v����=�Iϲc���6��߈p���8)b,��WvG����%J�>�t���'A�ߕ����r�f���O��1�a�1f��{�����Ie�`}��"�!��>���DZqjC�Cx�+ҷ��ӷ��u�b_Q������)�1΅�' ��T&���e����+����c���懾A��uO�,W����n���R���#M�Fm���'=�,@H���A!�'}(��0��1�``os�2\H�KH,@CXeU}��a�y-� ����|�����#�b ��@��ڍ� ^��.�0�Es$hD��Ks����_������� ̣ҢZE��ǁx�� ��neڍ��G�����>6Lb��W�Ѧ�))�6,��AwAxvIԤ�e�aIwvLM\x�����nq�]�¹��_��6�4�����M�iX��b��H;� �������,����{S0��!�U;b&���_ +W7X�9�xZWǑ�vdgy6��^eu�\ ���B�-��xE���%&�=�;\���� ϕ=x;�S꿨5�`-4��I�������q]�a}���W^�/!4� ߃1(�<����c�3���6�,U�F�9�ؔ#��J8k���QA� ���aᘍ}IyL���ug5{��b�����y�'��i&��5ٟb�)@X���;<ڳ����<�ljO�B�BВ�b[͕J�
Static task
static1
Behavioral task
behavioral1
Sample
eb03666511f5a4dcb8879d6d4f6a160e8cb1621d924ed7a47b920d7d9159cfc5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eb03666511f5a4dcb8879d6d4f6a160e8cb1621d924ed7a47b920d7d9159cfc5.exe
Resource
win10v2004-20220901-en
General
-
Target
eb03666511f5a4dcb8879d6d4f6a160e8cb1621d924ed7a47b920d7d9159cfc5
-
Size
2.0MB
-
MD5
fb8297591a0122942c20f776ceaedbb4
-
SHA1
2c86918116bb45bb43e4842d2a952d100e433b4d
-
SHA256
eb03666511f5a4dcb8879d6d4f6a160e8cb1621d924ed7a47b920d7d9159cfc5
-
SHA512
da58286d10664ccc228db28430a54ce4079745a271787469a7043424cb07eba84454df43899d286dd10c02e5decc2db27f7e737fb469ccf8033d9573d055cfae
-
SSDEEP
49152:Q3y47odwGRfmYXQuONBFdF5VjL+o9lXLO+Fsb9huuNYRZN+ao:6y47ujR9QVL5Vja2lXLDFsb9suNYR6ao
Malware Config
Signatures
Files
-
eb03666511f5a4dcb8879d6d4f6a160e8cb1621d924ed7a47b920d7d9159cfc5.exe windows x86
70efc59e5f3ff74c76e0e8ab32bb57d1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrToUnicode
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE