�(���z'��wU�5Q�è��{@��������קp!�դǞ$K�:�TK/e>��<R%�vE��j?�i�wdW�� �����{�2c�U2Mb�2�����V� L��a�D+���"��s~�}%��>��Sy�Ql�N�i��� Bk$>�fT��CB��N��Y ��TY|�KGfG��^��]1c�Ɩ���r[k�%����_$����/�����6��2�s�����&��=- ��j��²�'��'u��%�w|������~ژ�ζ�N��V��D�T�w���ʲ!մ���B���l�^y>&4T����%N�:5\�V`�N�^?��y{���l�����ĩ����l�o��1L3��+0������ !�xEip�<$�����'u�;�Q>�4�0��.o��݉��*�JJ4I���=b��2�ObՌ1��@�u�,�\_vdi`Ϡa[��p��q��w����2����O}�����7��V"��߿�4Y��WbꔄUF���&_�ȎE��Ƙ��N�]SKG���W�M�χ #�؟K���9��rU���i��9v£�8N?�D���2�=�?��7GL�(��Gzb�+O�����������;M�E����g��<TH50T)�c�c���&~'M^�b��G*xòw$4���0=�7�����Jkg_nI��>)��Ķ�P�|q����~��E��(�O'"q%������)��������$�I���ܚ��o&�w�W�(>7��ܩo��Kg�b�|k�v�`S� 'g�G�9��t�<�I��,���?�P�7&#up�1 K�o�U���"�bo��(���TSE^�}��o�)����X�\�1WBs���}<d2�V&�"�ԗ�B�qF����P�1�o�㑯�ߦ���l��V<9�a�^���$���s��t��ҙ����V6�� RΫ��JJ�=�͐������ �L&�C�:Á��ۀ"Y�"���s��G �a��� ����I˹������C����L��W|���n�ܑ.<�EH���� ��eX�����Ž;��aZg�X�H��Y(�̛�D��I��Hq_�������{<~d!�)zTc$q�B��áE�p��@Zk~7�f���A�ULS���Ι��K���%C��"^l0T.����]�(����g��^NW�E�8.�^#��`� �q�QϤ�}uX\[�}d��s�e���P��l�O����;�f�V� ��u������t�ˁ�H$�l�R��<g���!���Ê ~^0h�����2 Q��l��c㯝�����D�!�3�WL�n� r�Y�L{ڶ�:F����'�̰ű�`�iHW��6�vsy>@�B0Cb���9�a�i��i��ҵ��70�+d��dj�N��Wef�i!� L�H���O��35�N���pF��[s��̱���8H���^��������E)��%J;���˝2���#b��Hɴ?c�x�] xZ���4�%�b�ޙyH2�n�s'�XE�p���~¾����������>8yqqF�D�.��s�L�ʺvv�c2�>��?���o�0_Y� c�,Lk QQ�&���7����~?���SK�9dL�y���REn��.�?I����E�Xb�q~% ;>�v�/n�բ�$d���i�K����X{�4RWuX���1���c�ؔ�cҶv�u�-&1���a4�:�|X{*A�/H��$!���S����R�3?8�Y���ǁ\�ϛ"7$IE��<��qg��!ٍG Z�)�0��v�Fؕ��~K�C�e��2f����8e���rH.)����l������R}EBS���<�L�y�n͞,0���@;�� /� T�&{Pt�4�u@���)Y�y�uh��'�nI#�)G9b�=� �|��-Kϐ8XA��Ι�nb�w���6��a�������Ÿ�ษ���{݆��Btm[��^��P�͞ s����4�"տ�����o���o���/�61��*X�6q�h�yR�����Z�9C�FN����#,[�Ls@ڳ��*��9_�^��Z�LKж��l���Y.����e-1�o��:��!�G��^f���ڙ/<�S�q�0 Բw���^{c�]R��'��Ý���Wݩ}����7f�ʬ쨥U�h013nT���Uo�H�P�:Wx.�%��=�-�@�߆�5xR�-���f��������?���Y(��dj��h+���ڢ������bd����P��?q�蕕y��n�z�Vr�}�����҅�!v ��������;K�x�,�m��-���釈S��-����F����z�W�bVqGx5|���� ���7Z�lE����y���6-4����L>]�۫ȣ�B�#t_[�6�YCĖ���O�b5=���ګ�y�-�#�r���HZC���j�8ʗںV�z�����I��!�)�-��;g%��?��Kvu����t8)/�'jW�[��nF�6SB{�|sd%�����l�C��C*���BwZ�F����1�s�yWp�E�*�=u���7��DGe�G��(_�O�LςjG����.�����ݓ�C�� ���}�2F�����pk���g��|��/*�`5�-�J��'֣��~_o����ٍ �5�ͯ`�EV�z%�+��� �C���w�<W��)�,�+H��������aQ�`Z�_�2�f;Viº�g� k�݉T��iNfM����a�}�%6��%��S*Ր�+?�_�c�|�ӊ�2c_�)^A����Ӿ`V���+��D3��4������h���ՙm�F��.R'lDꆏ ��7��F�ʷ�U9���ϼ���`u���!�u�#v0p��F���mFQ�>i��*�w����g��Q�y�zG�^��K�4� O�1qMP�/б����]�ak*#�+��{�a|nF�M�����Cg��)wVH��xA�(�m:�[h�<�C_�R���Е�R�)e�T;�2g����RY7���M� o�G��]�EI�Ǩ:S%s��_C�IEԼ�������o�ł��"�ذOV���@GpW?�e�B�)�f=qQV�� �C
Static task
static1
Behavioral task
behavioral1
Sample
81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d.exe
Resource
win10v2004-20220901-en
General
-
Target
81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
-
Size
169KB
-
MD5
04ab3fe511b4a7465c57fc9e7aedcd3d
-
SHA1
f678150e525de20a58a2766d52846cc70ffcb622
-
SHA256
81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
-
SHA512
e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
-
SSDEEP
3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p
Malware Config
Signatures
Files
-
81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d.exe windows x86
bf1481ed65fed5d9d77e9e96e54129ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
HeapReAlloc
HeapSize
IsValidLocale
GetCommandLineA
HeapSetInformation
RaiseException
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
LoadLibraryW
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
Sleep
RtlUnwind
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se0 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 494B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ