o �8��@l�t0׀|� ���a�[���I)J�ڢD�J�.R� �Pn���=v�Ys�y��Fo��A0���L����U�z(�� ��l�C����9�o,����%C!Vy����J�{ LC��:��T��N;ȹ#e��E�J�xv�誎�Lj������K����`�c��q��{��8�n��2��+��j�f笘��=�M���.�S$~�)��;���h]�r�'c� �]�Da�=��u����"�x�:h ��"�L�?j��+�9�Z���PI��������o~��\��䡐�<P��{ �h/� ��dN[�5]��%�IA��m0�Z��#�����@�7kQ}S,-9�2��BD�xU���d]`���f(Z�G�B�Efֹ���7���Q���2L����bR4l-��6wJ!Z�{:k�dk��K� Q�U�^��v��{�� �_�W�� d�����'���p����(����iK�N7�X��e0x:WLf(���m�����=]g�;כ�����+W��c頕�6�D_��Ps$_)���B�B�� iB�D��1��� _����x������Y ���Lw��&e-�_˻<:\���x������9�z�]e��9e������i7�}��L��Û�O����� 2�S+�#*��M3~��ᝈ_qZ�OZI�ˋ��As:� W!J�#.u�*SH��|T ����toqt\w�R���6|�5��}؍�`��ٿt��Lx��������M��jVA.� ��褏����g�)�-?Co���Mb'�ҹ�ϗW� ��A~����l�s���j�PVZQ��v���@�Vl��w�+BCS�V0r6\Ȱ���r/���y��ӇR��(�2�(�Ut�����#W��o�O+� ����c�D9���������8v]��j�A�.}d����1����̬������\5��o����Q��*ک'�v��|���ȋ<��X/m��А����26#C�s��'f���&����e�>[R�h�|��������ʼ!8Ӄ��i�G���}J4�����S-�]�HV�|�Q�?������xRk���g��`��7��ɪ��>��_p[�uק-�.m�P���_�T���P~�jt�F���պ�h��93�z-��E|�Bn6��gq}U����=u��<י�m4�z�����3�L���.��o�ѽ�w����!���g�2���~����p�^"vꌁ�ες�U�-���kr=NF/��V܃x�� �r�F�b���<g�3�ZL֬������fl���6��c�)�=(Sg���y�����`��4@xQ湾�$�L�?���'8�X�O^��4�6?L���P⏅E��aBa�!���lY�t�#ߘ���Q>`�3�PtQ��G*y�i��Ʋ��+�7�$��q��ּ��1s9�H�k��RG��鵓����3b�ԤK����C<u&���f�qD�]��W�1t��5��C�T�20�B���*0�V�5y����-#�>z�Ob惻'���Q��+�R+Ʒ� ���n�����i?.��t_|��P�F#W����s*�1k?-2҉���+└�m$�$�0&N��KI����K�ʊ��c4�2���!Ѱ��.�J=]oYNA���zE�}��qF}��~d��/pK��mۄm>�9�EԠ�����ӽ.������fOS�n0����/���x��c5ڮj�_0�d�y������ ��!�]���=��yazoL/A����u���������+Mi�i%��h�_K|�+��|EZ��yΦ;����Q��J� �{a32�;��s�H8b�yq��\�D(����#�OÅa�Evf�Б �m���W��x������"�~dA� v��f�B�ƔLH�|w6������X��B�ٿ�#v��Ơ���0��f��"6<!��_VN�>Y���+�@at�N� e������ۺ�>���+�����TD��I��� ��فt�O�8%�֨��Sr�� ���X���H.�戕�$;��hJ���m\�K�:0G]U�؛�����)��������mS�LXP��X�Qh�&t�Y=��C;H���9����\�Z��r��f�|�?����?rw5C�����gRH��"�lpJ�]%E�fئ"�KQ��I��#�d��Q�MZw{P�M��I`�0�@m��� �9�����4�ek$�i'��ѣ X#���b���~l����� �d�����C�� m����&s���U�HNg�a�mHۉ[U �GZ��� ���+��,���{��ذ�B��H�LN��hhRF�9��zVT*zc}�X�:<x�l�]Rz˥����Im'�Í�k ��n������65 ��q���o.�Kd}���ΕrT���pY������M��W�t^"!P�B!�yk�d�^�NE�y1�4�M�m�G�$�{6Yjv�����x�PxC���qc��"�\ �,�g=�p"~c�ʑ�d6�6�o&{�u;Y:=���|[�b��Rɉ� *�&����$����=)����sMW��,Ք�;Aj�QR`ٲ�[�P�o��@��<#R�[0s2(����]��!���eh*��F���Uqg7�}���Sם&�`ڮ�3�5�|W������Y}��[BE��ky{�4�7A&��>B�����ksQA� LL�.6���fpݜ��4^�sf��!l�Fx�?�LO��;�e�E��2w�����_�yw�U�6%�j����8�Jb��<��;�t�7� �_���ܽ���\��*�C��<"Q��y'�Z��~N�n��|`p��/ƛ����C�Xz��J�o �:��4q:Yu"?�Z�V��-�������h�c���>��75< q5O��f�x?�~��+{'B�]#�;�����"���еN��8�>�s�Aw�K'�~�6~˟^T��0��ʠ�t,��D�j���By�#Vљ���E���ᙥ1~^['�,zpR��!�j�����9�:��\�����y�������a%��q(˕텪&�>mL��W
Static task
static1
Behavioral task
behavioral1
Sample
e022776743d9a7da5cb7481fe11d1c98d9697712e20a3082c0da459dc0b6a2f7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e022776743d9a7da5cb7481fe11d1c98d9697712e20a3082c0da459dc0b6a2f7.exe
Resource
win10v2004-20220812-en
General
-
Target
e022776743d9a7da5cb7481fe11d1c98d9697712e20a3082c0da459dc0b6a2f7
-
Size
1.2MB
-
MD5
f058602f2ac02f214a402eb65b168ceb
-
SHA1
05daf953a32f7f26c1411b71762ca7005e32348f
-
SHA256
e022776743d9a7da5cb7481fe11d1c98d9697712e20a3082c0da459dc0b6a2f7
-
SHA512
abd668baa98f3ed1eb977ccf9533aadbf399b57e0c250135d1f3973bec53c4b048e0c827da81bcb098a666397af1cebc0bd57288f18c83474cbee600ac7fa0aa
-
SSDEEP
24576:ju9hXWX7GZ1ldCZEGwFaZvpadoBDZgcOCrIVPzrq:ju87wUZEGwFalpR15rIVPzr
Malware Config
Signatures
Files
-
e022776743d9a7da5cb7481fe11d1c98d9697712e20a3082c0da459dc0b6a2f7.exe windows x86
9b962c81219df0fb0fa98b2326d35e3f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
gdi32
SetPolyFillMode
winmm
midiStreamProperty
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ord17
ws2_32
recv
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xitcz0 Size: - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xitcz1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ