y�1v9��oOuYa�`2�D�0~R~t��kۥ������Un1��G4�������H�\���r�}ۭA�py �-�i�M{��%��wz� TR��� R|�{I��3. ���a*r��Gَby_��!`UMx�*�qVO�_��'S���������M��!���) ��]���!'`�J�=����ƺ��/�R5������R��G��6��b|x�)�������� �C���`eP��ϡ_Ȣq��&��4��ȅ�W[-Z�0���w�#����cL=yE����M�V��A"g��! ���P)�� =�'ch�2�3e�r#{�� )CPڗB<v:���k�Y?/��K�H0��,�"�A��TB�Y�/��x:�����Z��U�l-�(!�hà�"`�$�Z֣8�$q����㽄�LF=���U��������8ho���6!�����<'nOJ�Э8b���{�].$�?ǥ <� ��Ix\Q��$Xt�2���P�|#� ��;�H�Ism�8�Q��<tz4.V��#�����$oY��3 /��Q�5�.ʖ-�*i9�pn,��o�sM1��ג־~����� ��a`�������'� �b��x�r�{)��U��#���ű&�^�8��HSL��h�༵a��w����ߝ-u�N��$s��+���v�ݤP�I��ky�e�}S���-흡�m�1��c�E��!�d�|'�����c�<&8q�&q��_�����4I���]!��!�fVh�v>���_4e1Chwj�PN�=�g�jp�1��+h� $�DH3��.�o�M����rO'�%hv���u��d=)�F� ��/l��(�d�n�W�����dЙ��֑���٬5�TJL/�VM� �'��ǁ���V��[��j;<,��w�x���ȯ/=l�W�87<��4f|�')*��=(k��[T���mB?��YfZ��E���ً��lױ�eb^�v���ސt��>.</Rf��2�/!d�ʢ�K�A�9�����qR�8m۳D:����kl�U1�ȶvti��m�����`c��y�d� �#�O& �1�٘EX�3������xS��<� �9+��Gů�i$w�>�Wm���^��5˔) �?�j]��M��bC��<��&5m .{�|oDyUE��r�M��zKҭ�i`$R}�a����ݑ�ƾ�I ��z�a)%�cT'�o��E������B�x���UA@�c��x�MrJI^f�\v��'�]��6�����q��� �������HIc�p8 �J�d��&]�v#;�����T�`=��W,u�9'_��Y���{8��L|��`���U��,0��{ Ƅ��0퐧iX7��G��D��D' ���C�e"��z?{��P�4�x8��ȷ�gZ�r2XB0b��߾ �;�Bb��:��Y�� 3-�s���"Gm���܅%���"4�r)"�Y(P�j�E�ui��o��~���;���� �İp� )�{��S*` �~���h��m"m�ǭ hgA~�n�!$����L{s�+4d����B�ݠ��%�(�a���k�K! c!b�V!�9��@w��`4?��8��\����Bߨ�e�n}j�+��)ܸ���P�՝�*�q�|����G�x�*o�����Zpy$��I�it�X�hw���_.�56��}�}�ۿ%���$��|�ҭ�]z����O�2�7��Y�����a�j���k�LL�m��P�'J� ��I�Oߚaue1��C�RO�ɘE�h���C�()�Ll�Z�� �T 8�'S��[3 ����yv(`(Zҥ��X��M5��$��F�R��W�C�,��k�-7��9���ɲC�`��� ��a9�JA�3े�LldX��%Rƾ�H���緺�;w;�M�P��:U�y� {�ׄM*9Q�z�����Z���ب��}��ұ�eނ�Ww-.��c'���-+�|a���m/N�D.I��a�2�qa*� ��`Ưq�Z�(p�k�)�2���l�������*��P�]#��_!&e-�>��Bkm{���i3T�.!���7�=r `3a��0�������|�հU�M�!V���-fqv��9=������j�ŕ~ڃ�^3���t�>���Q���q�=�l۸i���&� _�c��� >����LW���qU����D��v$j'������Da��gtɠ'Ӑ+�w��ӝcb�3<LX!Yj�2���w_�ހ�������/��h��"���#c9Я|��� �R� ��!�F�^�g@B/��}1�a�����4,iy �+��I�~�trZ�ea���jLF$��"�?˂1;��郌5 ��j��<�����$�51D��x�����R�����psN����4BͫxC'R���BN����Q���r oM��3�����Mqz ���yq��R�6�Z>�5�s`E�W�B���m����58�[i/��������ˬ'�>�K���J��9�\�Ju�rD�]d�u�h-����v)U��3�R���r 5�QT���Iq���}�9W���j }��@�A��;5;d�|z� �'@�ʄ���̆��'��dV��>�4��v�W�@�E�3������|u�1K�p��O���tw8Ѝ�{r�W�"N�����<d�2*��C�H0�%�%�u���3�إ�Fiڗ�2�>�� E�u%^����:�+�Mdh+�`�#=�bޘ5{G܀.{C /���j��;|/�"�>k�Os�����Z-/����=俙V�N��;m�O�h��"6�#ƹh�>rQ��%G�!u�_/�A��<x^N��$i[������rL=(��e�b�Q{�-��і@w���Nϩ�V���mUy��:lP��ju :d��,g��FV'���iX]��ټkPX�9����Q��[~͋�q{GǺ-�t�]�e|��j����l�e%w�#��k�-I�����[��0�̤]����h���$OK'�7���5�;�P+ 1��$-+�&���/�%�V�P]s�&�y�������V4����e%v0���i�נ�Jv���&jS�![c(��z�����`��v+�s6���ѷ�z�-Q�7�#[pe@���x��
Static task
static1
Behavioral task
behavioral1
Sample
97e3799d26987fa40811456f9264a574aaa8dcb42fa7ae96f1002955a1bf07fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
97e3799d26987fa40811456f9264a574aaa8dcb42fa7ae96f1002955a1bf07fa.exe
Resource
win10v2004-20221111-en
General
-
Target
97e3799d26987fa40811456f9264a574aaa8dcb42fa7ae96f1002955a1bf07fa
-
Size
2.2MB
-
MD5
5d4c410d3d067059ca7882affbc4554e
-
SHA1
32d8222b1b93b61d866a50a778cf3e9eaa7f27a9
-
SHA256
97e3799d26987fa40811456f9264a574aaa8dcb42fa7ae96f1002955a1bf07fa
-
SHA512
c250b3aaf5464feb759295cbaceab96ef2bc1d65c93e5ca0e6e7de2c6b0a650963622f1f22c2bbf970c094584ce551affada80cf549c1571f77ceaeea7f0db8c
-
SSDEEP
49152:Q0kYu7QfRdI4Qb0IKfJlRh3xNMpXoycB7eMO3b8/llBbTMnfj3M:QFl78jvdICxBMIdlxTMnLc
Malware Config
Signatures
Files
-
97e3799d26987fa40811456f9264a574aaa8dcb42fa7ae96f1002955a1bf07fa.exe windows x86
142b73553106183c697e3dbd78cbadae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutReset
ws2_32
listen
kernel32
GetVersionExA
GetVersion
ExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
gdi32
PathToRegion
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
SysAllocString
comctl32
ImageList_SetBkColor
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 875KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 999KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QQ0 Size: - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QQ1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 360KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ