",E�{���ʶ?R ��1p����� ��,�!k��*���om`~��a�N�tz�72�S�b��#��̧1ã�V�@,��#�_c� �:`Z������&,�c,R� ��g9\d�w����eH�b{��ႚ4�>ix�F����Kz*Z��6Ⱦ�a����7hW(Ҹ��H�VV�0�X�3^�>�%�Z*�t�kN�A���q�\G���~�&�;c�� ���!5��E�����G�%��f����"����}o�p���wp#U�`ܙٯ��_���h�7�3��e����Ti��ҫ���7]���"�~2���T�����P���� �d���lk|`|�\u�O�����[��\|b�}z�ɂ7?�LӼ)���L&~"�&�yE��y}Oj��@���O�:I�V$������}�pX�&���ޅ�[������,!TX�@zw�����@��@����OM��$1�.���d�=d�|͒�귷5咄B�^�}�MM��������À�Y*���V���cm��i#�8�khՉ8�)�K�𪆉U��r Dж��J�͜k�o�vS�\t�䥈 �Oc��C�9=@��i^���}4 x���ֽ�ڸ�$��=��� b����i��0=��n/'��,������c�uәU]ݙx-�Q�-����m|��;�c���i\�+�#�W;���'������X&��3������W��u�c�� k8h>J��"2|�LB��_�p`�����Uɬ��"�Ţ�=�E�n�"���=d*^4Ӆ�{��U{��~/=�n��,Ӷ�V�@`�c��:��kF�%��wLbT<��� {��f+0_&���v4�rfd���Zm�����w�.�(��ߨ�?�j·tۺ����W�X��O+�h��]V��IV�\6��N���gMQ�Y��,����9V���S#���y��M���>���'�V%0��4���k=du\�>��?m��4k],(�;�?�j��D֭��|�e}�����&��"����;^�>�@~��!�u��c���9 ���#_2�cT���:ݘCB\3Qg&���%;%d����һ��������0����}oU"8�$���׃��5,92�X�L��gv�Ni1������O�����o%��XNNN�I���g8�p�TR;%���m(ٺ�2�k��O`O�-�Գ�<s)��,����^�{�_�ǥM��=ttmt�'5r��1o���EvtC Ypj��~?����IAE"��GiS�?�{0�P�;���ؑ�r?b0D�B-�c��o�kX�\�zJ �u�n���^ܽ���z�X�%��7����[U SH�[�&ߠ��c����e>������k�\Cs)�Z�l��6O��}{��G�"����t��=]��k��۸2;[��q����fN�����_�kV�5���rNQT���:�a<U7��#�����M�o���Q���� ��_��p�����@�Y�x� 9߮�><��@T���]BE �P��Z/d ���2RtSJbS[��O��r�B��/�'�����yxk?SuB�G�y��?��!)��@����&˥�\Xl�u(p����(�����nX!�M��h�M(ݮ6�O(���Q݄�_��6��ϕSP�y5�`��m�Ev`�B!��}�(�E�D��bm�� |�^<�S� [���g������&�%ɸ�⟶�������ب���C?T�6�[��_a(t�g�������H�IQ)fh�̩Z%ҕǀ.��L��ΜB��&5/��-�L>\q��]W?��ھl��ZMr*\ (��G8j�>gZH�����|7�e\�K_�$�v�ߛ_��,2Evw�S��g�2�~KKy��� ݰ��ϻ�v 3�qh�0��q_��eX����ʋ U��R��������c�Ya�l`�c2�Q5���~��12�"��W1�#�~��! |���՚ #҅��t�bH6v���A��C��T�=��8���h��L����b�<vIG��r����d�b�&[�IB�S�Ȅg[�N�c=�ס��څn^{fs"?�>�{�u��M7]��I��i""��'ȍ�0�>����-Pec�D��L\��#��\rh�����ǶE��|��r�9[r�i_�����G��^�e�fļ����wY��� dvR/S�����/�h���%�����h��%L^W�+U��4wznpM�+�]��W��r����E�ݹ�~�r��`+|N,��`@a�D��G�I1��R�M/#����рWLj;�_�i~[�j/�z P�?7Vϥ�U�l�0!��>�����[۹D��a�~rNyϿ��n�u'q`"ԋ=[��vG���ɇfǍ� �_Ȕ���,j�X�f`a�T�����t�����V� A����a�S�}��}��6��L-H"ay��$�a����"��r �Sj�%�wD�fLDE��V?Yť�vhʮ�k?�+��/���D���d��{����F�W���e!#��;K�6{���{���n|��.-9? ���R���;i��W��':��d�2t�g1�j��G�V�AP'�s�����p�(=��e�Wb;PZ\;;�˂��@��Ԏ�S�ge^��)��ݸy\t��aN=�\@�����8�j��NO�Z$9-�_+��tC̺n��� ���L �͒]�y�V( u#�?���a���>��7�j���� ��< ��BA>�\��Т�u���y9R�}Sn���P��7��l�1�/��Q1����v���C�u���%N.�X6����r3x����D�_凬);�����@yB �I���՛���/ӿ��s0C����j���=��*SH��z��ЯH@5�v?�-��SϿ�eG�YJpǍ����ʨ�σ�/\xk�g{�^v�Z����*g�3�y������*��>\�-K&�$z���ꢠ:1�6� ��>P|%��r�vh��f���Z|�����pq�?Q�����lq�f۽ԿU�^�j�q�Y�d�����y�f�6$�5�mM���P� �jJ��{l�t^������1wO���E�`?'
Static task
static1
Behavioral task
behavioral1
Sample
92a30521fc7293ef1c5f192d923368f50b8b6f5feea9cc2df8382aee0eca35a4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
92a30521fc7293ef1c5f192d923368f50b8b6f5feea9cc2df8382aee0eca35a4.exe
Resource
win10v2004-20221111-en
General
-
Target
92a30521fc7293ef1c5f192d923368f50b8b6f5feea9cc2df8382aee0eca35a4
-
Size
3.2MB
-
MD5
4909ead1eb2cc99dcc7547697ed95720
-
SHA1
057806e8cc25a6188c52e442cfb99617f9cb7675
-
SHA256
92a30521fc7293ef1c5f192d923368f50b8b6f5feea9cc2df8382aee0eca35a4
-
SHA512
41cf4096581c762eb3e11ed4ca352a7503adb917eed274a8763f87f2b03ba1847227f6765d0a55d09762bd098cc8903786f15603954780cc21d4b61318939b6a
-
SSDEEP
49152:4zmzSuM6vqTP7ol6rfjDsNWzIJlRyB+By74Yz1ApzBJG6zAaCOgWLGHcibj2xrDL:4DuM6vqTP7frPs0klhyiL0am58ibODL
Malware Config
Signatures
Files
-
92a30521fc7293ef1c5f192d923368f50b8b6f5feea9cc2df8382aee0eca35a4.exe windows x86
f8a9f855ee9451f1b46c54152bc06fe5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetTimeFormatA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
VkKeyScanA
advapi32
RegSetValueExA
oleaut32
SafeArrayPutElement
version
GetFileVersionInfoSizeA
gdi32
CreateDCA
msimg32
AlphaBlend
ole32
ProgIDFromCLSID
comctl32
ImageList_SetDragCursorImage
imm32
ImmGetOpenStatus
winspool.drv
EnumPrintersA
shell32
ShellExecuteA
comdlg32
GetSaveFileNameA
oledlg
OleUIObjectPropertiesA
wsock32
send
Exports
Exports
Sections
CODE Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ