���m�;3j1��N�1�h��������dl=�/�:f��L��%�2KMH+�sHW��ѕ�,���<��Ec(~�O}�)/����jGD���1�s���W $<#ZQ�K״��G��A:";�oy�όmĝ�t}(�x���_Y����58��|Yf"X<���eO���v5�$p��?�w�衎V�%I�G ^ ����ņX ��>�`��L��H���v��ߠ���Jx�!\�6K��qԀ 5μ]��ib���~� ��ΣTU �6Ĥls2��U�@ʬ�'b�7?�T�w�����J�;�k����Â�m����T��@�����5E��fi2�>mO�1`���x��)C*Q�Ֆ�� ���������A��I7&��?�f��N)a�����נ�3ARN��%]��P�m�O8��ֈ$��C����y.�a���0������ ��B6�v�� ��������dL��+xEƈx�z�&$�h6||e��@�ϐb��Rm��?u&YE�� ,d/�!����!�y�]6@b�r���x����Z�-�g���S�߬<��ߦ��:�������dL�Ĭ=�=R��3S�a`@"�[��x�����Ŏu�_���W�?7`��r#��?Ń�$���vr�ة7_or����˹a��jC��{9&Pu֕箒���_:Ѻ�/��� R������w9 >��oJ�?i�z{�N��Nn+���Г�_�9O��&f��Ϯ ���&�K#�?��j�+�:*��hh�SxޡR)���!0��^�{����c��˫�M����ssxY�@�Ȉ��Р�r�"��f;���p����L��q\݄�΄j�)�6v��2��r�����ru�C8��!KɄ@�Tj��ۆ�%���kn'�|���=���������un� <1Hx��_�*�7����#��K������a<T�)w{?���؇�g�B�b�ʱ�l�EX-^G���M�&At��+Uބ��-��Q�ʫ�>���b�F�k�g�-�-��cu�?,N)�7�����s\H}��M��dG��}5���<��s^+�E4��Xh��č��r_]�n��R�y|���-A%o�ƶ;�£F��si4�SǨo{�Ke��!��x!3����W������.)8� 8�3��o��'r���B��["p'ZEG��e�gw=a�;�� jy$��n�H��^�h1�x9`F�N����S�r��^���r�-M��Ʃi����]s�P4����Z/�<�@�����*˩��eaL��8�"� ��۩�wp���E�ū�يӱ�Oc�O~f��C/u��m���Rg k�V��+�D�Kq3�,��M���i�<�e���jG���F��ةM�)�Y���HP��&�On��m9 z:���� ������8��T��PB�0�q�����T���,����� �>fl���k������VY� �~�Рx���e^�Ľ!_ ����O+�1�;���'����5��A��Uh���\-�-���z�I�k��i�! �e�>:S�',��ݏa�X4��]Fee��(�v3%���d:�����t*:D��c:����+^�<���~PaD���`�4�H'�(ɽ��?�� ��uz�De�,�-$t**�XkA+�Y��\*�MV�'�Rb1Q���Ʈp ߞ~��;���+.0��bt��'��oֵ�V�ێ�,))�p-�Cyl������Hz�S�C]%���u����^2,>X�9�����bڂ?"z}֫o˓f����������1����1Er�� ���W��I��A>�4���_VJ� �N�3�$tl\�uߤ��f��{ ��P��(w������R�N���� ����U ��j({���R�J��_0�����آl{�.����������g�8���������B7��@���f`]�<��C�����g �s��A�.&���'C�B�*|6+����-�x��,R���\�R.#����R��"�<f�^��|w��D�g���睐��W$��hn�Z��xpZЇ�|�3���6�aO�4�yy�����d>�S�Q�%$q75BT��\쯛p����'g/�c�{��5���Crv�[K���kH���Y�������WZ�ϸ�@�sPhEVD���~�. |^q>�q���_WD��y�`��=>��o�?Zk��Q��MҠ��a�� '`#��T�z�-ݳ�]>lF�R������OI���ۙ�{-���8��pꓲ�E|co�#Z�4YS��Qp1p�lj���9~��nvt� ��p T+����w`��\Fg�W�{���,ށ�B�SH�����!ub�����d\K�8Ĭ4j ��k+E�vL�%��h:��Dq|p�N,�Vl�H ʊ��~n- B�M]H��œX1�Mͱ���(܊nM�|H<��s��bn Y�[����IV']?�T'D���,[���[�gC�̲\���1)g�����_�$�(�+,�Xnt�ʦ�2;� ������S�kH�{?�����_����R�{Y�-�ۛ ���Рv��"��� _�>�6�0�k���D��rgoo-�r�ȍ�� r����V!���&A3RP���Y�Z�Kgv ,�[ �������p�ˠt��ӯoɭ@b5%p�E�^�]C(�����cQ_zH�҅�R�i!���n(b}�[��u[�D;Ms��a`�y�Ļ&=����͝��]��ڐ&�ʸ� �0�#���k� K� /����e4_�bp �z[)�{��6��Y� aC��_^�3�P�;�r�%��f��/� \����┙�Uu�f��>e�AE��o]�E��F���Ro� �⧰)�9U�[� m�'mu??>�Փ�݂�7���SR�s�hS�ԓ���$y� 8za?&�·1��@���<��2�ƊL��� ��.�qP@��� )��ʞ�Z�K$J�pC���مKl���1[-���Y��J��(�;���(*�?�N8[���{�M���� ��_�i|��)���U-���S���S
Static task
static1
Behavioral task
behavioral1
Sample
c6431d7babc3b010edd511cd7088a3ebf9e526faacd7e5a58e55f02275f07ac1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c6431d7babc3b010edd511cd7088a3ebf9e526faacd7e5a58e55f02275f07ac1.exe
Resource
win10v2004-20220812-en
General
-
Target
c6431d7babc3b010edd511cd7088a3ebf9e526faacd7e5a58e55f02275f07ac1
-
Size
822KB
-
MD5
920061fc609bb3c426dd5faa6a5c568c
-
SHA1
9fb4687004cb42864aefbd779d851e871091d431
-
SHA256
c6431d7babc3b010edd511cd7088a3ebf9e526faacd7e5a58e55f02275f07ac1
-
SHA512
c5ead5698b7d4b86c9428cc6075dc0add9b3ae9cc393b2289afd5478315dee6d2319e9e626d831727509663b2b08cafcc2868da957a2cad17091b7135bb5a2d6
-
SSDEEP
12288:CAiJFU7sPKJNrmRKIqctW7pQaDFWpv3T0hiyyuB1RQBg1AKjDVgHA/qHXBwMEvOf:riFUrJvc8kv3uzFUBKAKGPHMg
Malware Config
Signatures
Files
-
c6431d7babc3b010edd511cd7088a3ebf9e526faacd7e5a58e55f02275f07ac1.exe windows x86
64bdaf128b08c3f4197bfc3321fbb882
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
RegCloseKey
user32
PeekMessageA
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetEnhMetaFileHeader
version
GetFileVersionInfoA
ole32
CoTaskMemFree
comctl32
ImageList_Remove
Exports
Exports
Sections
.text Size: - Virtual size: 481KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EPE0 Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EPE1 Size: - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.EPE2 Size: 765KB - Virtual size: 765KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE