-u[�H�ǣ�V���m�x*=R��l����dm����g|^��J�)ZY�)W�&M�z#�BO�o��Of��,��χ!�H�9�AI���Y&�K�zq�ސ����)�XH�5���t�a�g%Y���k��hhrcG����� ��ͅH�^h >�Po^�o8o�,440����Я. 0�jK��nrXsՁ�6�w��!�i$Z��$r�����Wh���T��e��O &}�7\�W��n�+ ��3Jق�ț�Uе��ߨֿ���2���Y��is7eQ꒒'� ���$�� ����8}��뀔熠����E� ��`��\����d`٠���u^R���" "����va�Lj6]�� �~�)T�JΧ�J��/��:M71>VTs,���}�L�6��������^L��J��J��y��P���Y�V�������vh�'>�����@;�H�AJ��r��C/� G�j �D:��N��T}|��/�������������(��႞�1@��+m�a߹�f��avQih\�7/����-���V�Gj�P�RyN�B���T�F��N&���)a���e"�Y����&!RLY�R$y�\�*��\�aQl�ӷL��*y��,3�D,9��sr\";g �2�B���KWɽQ�����=`�jG;�9�w5�`�(���&�X(ĪY�4[�~��D�7 <9}ؖ� O�9k.�H��Y]I�W�=_�9:Օ���m��K��o|l��V�\��3ϖI�ٴ���?|VV�T��@������1�Ƹ��b��עŘ��_�o1߷~̱�<V��A$pFf��/��V~�l(� *Q�����}'Lw��r՜\�Z���l5k�IX���}���!�L�V��t������&�P����9����ų���x�pz8�w�_����~bx�Bx,{oB���oin/uG��"v�mv�~18���7�����`l˵F�sYm52B���7wU(�L9)��h����ѶH0{K����t�b�5Ա�q�xX�0��D���Y���y�c���JP-��>��=)����>8��RQ/���p���s��P?�;��Η��Umך�K;��D�H�Cf�߮*,��-^,˃�a� �8�)Z��(��5���[S@����H��@�xR�Qt{K����j<�;h3��8�@o��̘p��������6� @n�t�� bq����&� "�%�<�*�>$k�Nv����],�� �-u�m�|��B�J֍�]�I"���r5��6��+8�|�i6x��A��~?�n�=z�~��&��Ѡ�R���݊'�Nߗ9g�Z O�\�$� ��Њ��(� �`+v���H�tӲ�A��u��}�{�JԹ�I������m�T&�]����*��wyWJT�̏l@�h��y|q�u��E2�����[ڕ�+ma����։7�8���{ENyd��W����4!�ibk�*@>�5��S��К�Mn��+{�/�Fl-Y�W�t�*�b��(�,[HR8T��}/�Ⱥ˿$��i]�� 6�!D\x��AV�q���oǨ�$q��!)��X�t����q��C��``$�� ������� �� ��u���g��`�.��jy��P�xc���F����� ��E��^?�PQ��i*�d�����+�������/�}��^_?���i�ڕm_�)k�P�� \�+�*���(-Ag�_˩p�H^u�YaB1a��xE���HF=�ki���e��Z��d?��Zt�vիz�Gx�������lU&��_j��;�`(!�E��<W���l�������=�^��5��{C���`5�a��ִ<~ǹ%���G��Rd��R�֜J��Uև, 4�@���փ8�.��(���|��lF�I&������@������#�Rbt�Td9`[�R���ɽlM���Ġ�ր<|?�#�s�hM�£�+���OZd婺�:����3G3���!4���^��$�u���˚&��Jg�����J^-��+9�G���<�$�'����3���J�* ���"��c�)yHC��Z �G�u{�7���f��x�@3�������{5� �v�/6�5)�/ٜm~|�O^^�T%��m���*�U���B+�n4���PE�XlLl�&k�P%N� ���M�?���:!)w����������7�\O@�z'����"�X�K��5s��" t �dA�'��\2� q���"�s9�Q���;���i~��_Te�_^أ��_¬_A9�uo�Y��zٔG��+��NF�k]�v��g}���)�ݦ����)Sɛ1��D8*~�}v����$�u����?ScM��f \T21$�?�*��ꢿ����N�6��d����%>]� y��b�z6Av��{n8��$��:ӓ��"6��n�y�iO�!�V�=�>��m+S�<Sc�q�r�8>{�B�~����c���!���Q)2HO���^y�U����W+�����\�ã�˺��4�`�����uMH��Ks�R@�>�F�9r�������K'.��)�����L���7=�P�ᡬIҮ��$�1o�t��pڙ��^�<p�j��>,+1���%��H�VPh����i�%@Fу'/N��x������{ڢ���0dl�����y`���ҩ&����=�t!�ʕhkxK�/�Zs����E��iSXŇ<(mt���36�J��h�)�2dޠ��[�ٶ�@��逮o�՟�ջ>�)�@���� ��bH�F�:������z^y�������F�Q�%����V���5<��Б��X E�����5�T�q�ϫ��,�� ����d5�]J�Ty����(�&�� fE��`S�yÜ�&�34������\j��ݭ@x��j�� �F��<tJ�л��)=s��J�Bp��$�Qv}7Su���Wsf��w���6���5g������H���])��cK.�.�n!r]6� !���?����m� W���%k� ��?T$��n�#�b/]��� ���H��7Nj��9�9����M
Static task
static1
Behavioral task
behavioral1
Sample
9506d775679697e228715b03ebe5a488d9dd20b14af95e094447e34c9ce60942.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9506d775679697e228715b03ebe5a488d9dd20b14af95e094447e34c9ce60942.exe
Resource
win10v2004-20221111-en
General
-
Target
9506d775679697e228715b03ebe5a488d9dd20b14af95e094447e34c9ce60942
-
Size
2.0MB
-
MD5
b16111a62933a01bb7837c478704d174
-
SHA1
fb9979d4f717a2284bc303bb08940642d726cab2
-
SHA256
9506d775679697e228715b03ebe5a488d9dd20b14af95e094447e34c9ce60942
-
SHA512
24df17aad2d354801032dc85ef57298679063e4f537d82b76f776b9bc1b63de604c3ff414d374cbc9707208e1e2615670c660e9469a5fcd1af10c1c804ad7aca
-
SSDEEP
49152:nus87wmWioS6N/rFAXd2BOL0PQ9GfEmXDjZYTvh/GDqCA7/Lv4SRd:nT87PhoSgpAIgL08Gf7PZYTsDqCAPv
Malware Config
Signatures
Files
-
9506d775679697e228715b03ebe5a488d9dd20b14af95e094447e34c9ce60942.exe windows x86
35e1a487132382e6ae7ca2e53681b67e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
ioctlsocket
rasapi32
RasHangUpA
kernel32
GetPrivateProfileStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
MessageBoxA
gdi32
BitBlt
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoCreateInstance
oleaut32
SysAllocString
comctl32
ImageList_SetBkColor
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE