&"k�����f�KZ0G��.���VƵ��&E�Z�}�~���Q���ִ�7�;���|#v��D��f��_1m}[w�c�8yË��=>��*�< ���y�D�~�-��vY��2쟕?��\�d�]%MU��d@��ev��]����N����k��!{�f뫲t��e-k'����뫪�Q�͐��^��ݾo��O3������J۶��Uӊ���^&�Ù�F��nP��H�2�����x��9/vXR� CG;��Ϻ3��y��5�a����߷�/���n��>�M�蓽$�1PHa��>���_\Y�o�Z��hL2kj=_�,�)(<�E�c�1�7�Z"�|H����b%��@�kՈ��״a��|��_2��)IT�b)�%���7�F�|�ǃ f ߖ@���b�WC�ʧ K���V�[dAw�$��;cV��A����o��Ea�X�HAkn�%*Tҡʈ�!��4\gH���knXD�Њ�%dž��7ĮĮD���e��L�����wW��l�p�rC1U����bS�)����� �rq��1��qEoD3e��z&WV۴�l��{WxQ܃�K�e�]L����5x��" ��z��Y3��c����RK �WX�J�����ڶ�ۆ��@:���R���Τx� �b]������{n��+Y*�{3��Z��fE[�PS��@�<"�;����� ��5���������� ~q�dyN��o|�j�#�GV���+D�2>���þ} d�$V��\���/�[|��O* ����A7���[^�'�ƃv�.spd��(��w|J���i��&��ҏ�_�sI�z1K�n�Ƨ�7��[%J0����;���<��h��%TZ��n��Q�e��ݞAo��ۂ�>CK��H [��w �?�@H\S��<����`���I"x��`���8l)�/�@�+� ��9�Bd~Qo�3^tj�:�"�>��nvYY���o�iy��-A�#ȫ��N7˔~lB�P�**�8�#����F�^M:�_t.�٥�Ŕ@$7�[ٻ�Tln\!�F����F�����mX6O�����i��l���̏v�w�<�w���%����M���,�^�g�R+' �q��S���D�����j��f��.���[�m{@*Z�h����u��NY�c��/3�,ױ�z�`��J�������ښ"�����X6�u\��L��l]��K����wu͂��sP�IA��.�=�I%Z[R�N ��ʛ�q���0���� ��_�:.H3��������)�J�����GI���@�As�!w���Rk:x1�71Vȃ�3_�j���`R��m���a��Q� �=^fzY�o��t6���[JDP����5��!Y.�:��.QP���5X-� 2��a����ܥ�U�F&�,�ez[ ��m�C�m.d�YE��I�2\�DP��Փh��I�i)w�/؟"��LןR���J+8i�(�Ƶ� y�M��J����-g��:���]p�������0����W*� 9Na�㉻;6. åu���U�FA�]�����>�8K��b��)��W�P(5�ݭ�}�>�~+�=��kn��`PE��������e�c�;C�r 7O����N,���1TV���8��)��TMNw3㎢� :$�99�E��&";S��%Eᖂ0����Z�O�O� f��,���f]�<���{��Y8���Ƴ��1@ͽ�U4���p��;����P�|�.j�<�2�Q�����/����C��j �l��]�#�mѬ�011�W�����i �8���������̧��ng�����%�Ϣ�X����;��QTe k��M�sļD�Z�pI���{�(љ�\��[wOj��x$���ye�ӞU!��4�3>�?�"in��r-��ep\{�����m�k�4����cn�<���@R(��㚀p�0�d�cDK�1C;�mT�Zʨ|��0&��doRHx�`Ԇ��~�o����O|�T둙�Qe^�)J5�Ra��s�i3��� B{<���;��[=��v5����0����GоP~��N.���D%��$����9i(�_��5k(V�*��R�F�q~��P��?�b���̱�.�U�|$�a �<��k��u�ɱ�M1�%�/��~����S51h`3/B�Ӎ�t���~�����I&D~�Q�_��1�y��ޛ���S���mF.�8�m���̇�mCJQk�d{��M�;����!�\����0ؓNք$b��}����r+4�mS"I<�0��I�L�y�5��qv��*�w�w��l`��P���2�}w݈8��� �3(�*��Ht���~G:�7����~<_2���n�/�r]���2�C%B�>c���ֻI�e�vr�ݗ�:���9x"3S�*\ ���Z�"�������~��y��cmL��Eѹ��4�@ y��v�E�����x:���+?�1V�����z�%����Z�JT������g?t�P�Ya�����W=���W=�)�;�f�&#J����v�� ]�&��A<�GJ���HC��^����D��e��'�i�'[��ef'�%� |e��`Ί"1U~� BPajX��G:>�'�6�>pw�X�:iix�r ����Ҹ�3��� T{e�i���;���F�4�B���B\�}e�����Z���Y�ܶڈ�V�?���k�T�Lh)��9Ԛ���|�an� 6`� Fё{uU���������z} �`��(�[ߜm�[���\��@����,��*�)���A�A(�`wN���T-��D����Q�-��l,�tn2th$4X�ӟm����U��j��ު��Ƽ�厤$�r��"�v�nj���Ro��C�ךy�����ܵ�ԭ��~�Y���s��� ����,� ���"�?B(`���n������'j�d���zZ��+3H���u|�S�v�~f!�_H��ne�LNce�ݦC�O�G (�����/�~ߪ�z꼘�:h��uH*c�f��~�3��[ $CLt#+�:�N�׆H����(���Qe:�^/WE��|
Static task
static1
Behavioral task
behavioral1
Sample
fa67bbc0f0a6234d7c16e55ec679a93703a744e96f693f7f3dc138e1daca0c1a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fa67bbc0f0a6234d7c16e55ec679a93703a744e96f693f7f3dc138e1daca0c1a.exe
Resource
win10v2004-20221111-en
General
-
Target
fa67bbc0f0a6234d7c16e55ec679a93703a744e96f693f7f3dc138e1daca0c1a
-
Size
6.7MB
-
MD5
63f9d058bba90cde60b3e01c4f26334f
-
SHA1
66e6c632b753bae6787fd641b109be27c1aed964
-
SHA256
fa67bbc0f0a6234d7c16e55ec679a93703a744e96f693f7f3dc138e1daca0c1a
-
SHA512
2ea59f7a52d707541852174742bc16ffac71249257efea26fc37f635ee5c4d8fbe213f658fde75d0a96ab31163d0cdd09e678d8519466892433045bbe97906a7
-
SSDEEP
196608:/xBmefMH+T6VaLGUVaLwYVVaLEedBLpKk:pBfMHHyXyxLyd
Malware Config
Signatures
Files
-
fa67bbc0f0a6234d7c16e55ec679a93703a744e96f693f7f3dc138e1daca0c1a.exe windows x86
4886feffc403bad64732575100b5030e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
AdjustWindowRectEx
advapi32
RegOpenKeyExA
oleaut32
SafeArrayGetElement
version
VerQueryValueA
gdi32
RealizePalette
ole32
OleUninitialize
olepro32
OleLoadPicture
comctl32
ImageList_DrawEx
imm32
ImmSetCompositionWindow
winspool.drv
DocumentPropertiesA
shell32
Shell_NotifyIconA
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
comdlg32
GetOpenFileNameA
winmm
sndPlaySoundA
gdiplus
GdipAddPathEllipse
Exports
Exports
Sections
CODE Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 130KB - Virtual size: 15.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ