tA�\cO�E�X�c-�q4��OT) �Gџ85���V7�ɰ'����fG����M{^ �;ؑ*�/&,>h��E���P/A�Q��t?njV�$��h'���㳙� 5|�&�B���Vv���!��w9T�r�W��Ϯ��_���7ȄOp�q��� _�V��g��U�RF�T�R*S��Dn�dm�ZQJ@R�u(�?��6g�`~&�otO�٣�a��Z&d�ی����-y�nM���zY ��J�bR���1�d������Vx �ḩYT�oe��.wp�7��N�D2�x�6�U!c�}#�isu�|%���W�"m��=����ݷ�Z���K���mCތ���^s�t�a�f�RM����/�ՠ-�����x_���)��tϣ����Z\z�n�]��6#�f�6��E���ߊ�p�gy���=�� H��/���)�a�&3孪$z6��=�r��a�[��@�������1^yx���S��[b0������R�L�R��ǹX� �k��ɓ�9l�ד$�V�>�Rj���Xj���=Ӈ��]��D�K�$�Y��#�K���1�O/��j��¾=�О��-�"�b�>d$EO±w�O�-gp�hĂҵ�˻&��я6��P NLL�UO�3�y�qr=l8����>dπ���z�r��8.�#:v��e�_bh�C��:���5\�!K��p�T#�6���j '4�l�E��3R���s��͡�h���a\��.i���u.a�b ��ٹf��D�cm ��~��@;9�;� !�-P��U�O�|ՙS9��R�f���vi�bϮ�e{H����an�wZ�e������BQZ��;�HY@�o�e��%�X:��U1�7�����|1_��5Q��t�*>�f*c&��5�\л��^WO�cy_�̿R��}U�`����U�?���H�̸kF =��A�!MKE��§�5� <[(ͪ�@?���K���w1�שSTu��X�����Nm��6�ʍ:*|< &\�ά)D~fz��c�l������E���b���D� �*p�_�����a�(��Z�,�Rz�߶�'z���0��j��;��Q86|�N��r6�`B�;뫗�kQ%��B@|db3�1��E���XH�K�NՌ�R�n���{J���KBú|i��D7<�@��Q\x�r��b*p�i�<-h��m.���9F��4J���f]6�0�T7�����W�Y�:�����%�9�lpq�JYo��� ̄������J�,f�!�.���b˒)��A�<hu�����XZ��X���}���w��9m��,�R�ܙ�$E`/�XA�4��G��] ۊ�}�ʐ�X����%��Rb�c�.�j����|X�z�C�LBꠂ���q��|�Cw�O���R�t���8��ʊF�l (O+�v�$;�,][g]tδ�q�W�'f�l�Ai��vv�?��d��:�/��z%��'��*F���%I"i{��1{���Ql���!f��Eb¨����ď������k��t�؎' Hoy1>u��J��k���)� �!圀��!��=���I�5�D���C{t�`�~���ޔY���C�tv�:�K��tR�� ��S��ӥ�x?�C�2��e� ;o���I��h慺'��^���������HL�·TdN���nAV5��^!��g)i�K�r"�d �&�4�+W��Ч�Mڇ���]����s�Du��(*����"tc=}�w�Z�r+A����?u�)�v��q������kNv�Cp}(�M���~�-���1�����0�v9m���+�x��H:zL�=��o[�.By�)��4/n�������Y���M1�h�-1�jV#َ_�]M����`;���q���.���/|�ٮ���./���>b���;{��Dɜ'�aq�>b��G}=Mhɦ��6�y��x����K�)s�cI��LtΚ8�ډ@�ǥ���̯9R�� /�Ctl���&�<���9;N� `�C���Aa������'�-S�B��{���:.O�PL&���TP�]��5��s��y��J�Y/��4�]״���hgޫ���j��WX��?5�7=�U�o���߉M�6dF>sH������Dt���=Υ�\�[��8Ņ҇?I���@���saymv��L�'�;&�cSBNp�x|�M�����~����gw�ήy�a�z�&����N#�v3 �.ITߝqS�V�P�DI�c&>\�}�V���8�e���WJ�����*K-�9�i�]J�5��ϫ��b��4L7�����n-��W(�{���T��=4k�<��K l��'2����+��kL<*��D�Jc����SD���%n9���u��T6�/�&Fܷ1��C��W�#9i���^�+�$"����{�����z�[�E����A�w�dmGX��C?��O�+Ajd(��"|�+�Y��J� > \�N8ˬ"K�P`t�(�聆,�+Ѻ���!Z�C��ͣ���c+���e�H�X����Ғ� �3J�Aᥗ?�j�{��=7�%�G�L���O�� aR�#����&ƭIz9Ń�HB�9���q�ݙ��P�e��bF/L�U"7f�} ����~X��gt�yI:ѿ'2ȗ��q�89@�_��O��gmҽ�j�zo�?:N!1u����7�Fǣ���2��ܒ��R�u֙�Q�M9��i�dSwp�͇Q䏫�Xiֱ�����^o`��N�f��b�otB�TD��! w_5"d3ڲU�zܟ�=6wZ�t]%��eJOǪ�K��J��d2%�_�o��d ��~��rw�=}s%&��kV�����T��]L�7yn�>L�E{���E���Ly���*.l�`v~,���Ks�tf��H�Y�F��H���r�uM�����u�2f�Y��@�5\@HT�Ҏ��U)�Uk ��M؉[���w"=a��]�hl�\��U�vs�_�u'o��3\�v����͎���-Ʉ��9�dKٛP`��۱����i�%�*��3/xc�s͚J/����;��I*���
Static task
static1
Behavioral task
behavioral1
Sample
8c2d1d3645ff23e6fe2c373b4820127dfd0436c2d36f1fe0dca54d5366ef0977.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8c2d1d3645ff23e6fe2c373b4820127dfd0436c2d36f1fe0dca54d5366ef0977.exe
Resource
win10v2004-20220812-en
General
-
Target
8c2d1d3645ff23e6fe2c373b4820127dfd0436c2d36f1fe0dca54d5366ef0977
-
Size
2.7MB
-
MD5
616d430177852e7ad3ffbec497c2c723
-
SHA1
645354076b47d453d405d3704937d6c820ad3e23
-
SHA256
8c2d1d3645ff23e6fe2c373b4820127dfd0436c2d36f1fe0dca54d5366ef0977
-
SHA512
938b50980adf3fafc956719b712baed0b0502e4122467a23e2e805e455bb84f9490d16162bdbad85a810325c57a243dddb0f63be0e3f218edbc4299f38c08a75
-
SSDEEP
49152:rlEC8272yn03NefSI6vT/mVMnGq+DCoEcXO6fBR/QFkw3zPWObKjBRu:692YQSl+MZyCo86SDLWCY
Malware Config
Signatures
Files
-
8c2d1d3645ff23e6fe2c373b4820127dfd0436c2d36f1fe0dca54d5366ef0977.exe windows x86
4acac23464af0afdf94d49cc20ccef64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundW
ws2_32
WSASocketA
kernel32
GetVersionExW
GetVersion
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
SetSecurityDescriptorDacl
qt5webenginewidgets
?triggerAction@QWebEnginePage@@UAEXW4WebAction@1@_N@Z
qt5widgets
?keyReleaseEvent@QAbstractButton@@MAEXPAVQKeyEvent@@@Z
qt5gui
?fromImage@QBitmap@@SA?AV1@$$QAVQImage@@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z
qt5network
??1QNetworkAccessManager@@UAE@XZ
qt5core
?toLower@QString@@QHAE?AV1@XZ
msvcp140
_Mbrtowc
vcruntime140
memset
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-filesystem-l1-1-0
_makepath_s
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-multibyte-l1-1-0
_mbsrchr
api-ms-win-crt-utility-l1-1-0
bsearch
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
version
GetFileVersionInfoSizeA
shell32
CommandLineToArgvW
Exports
Exports
Sections
.text Size: - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 520KB - Virtual size: 519KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.flyff0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.flyff1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ