����G:�v�ư"켒�o���烞q�`� 5�w��n0�,A�e���9N����Te�6)nW��bw�Z*�%�tΚI�OyDO�0r*���s�u��&���Rp�I�A1M��>���PU����x��s�Oڪ�K�N �+"�z���+zb�������S;����'gh�O�q؊@�M��K��-���1��Rlm���Bɱ g"mh|�z�0;c~�������u�d��U��s�f�`sx|�מw{ �؇���cA��������O����S����Ro�A."�eBs�c 0�^���F��=Ǫ;�2�����j��.%�e��2@���]�>:��9���0�f)�k?���y���YiU�*��e::�A�e�����④.)�Y��Z��#J��{�|ܙ��(%,�ȣP��F����0���ZQ�<��<uf��4�1�U������a:c�:����w9xK1F���έ�z��j�C�ڱ�DsF�66D�8���+�S�.W����&Ƌ E�-]�f�#�a'�7b��ż����>�G��L�yt�Kղ��͌zuZE>� �f~�/�� LN��Y�-��R�* �e���*�?��d����Z R��e6N���#�kl�/��;~�d2��V����x�Q�(�� �����y��l���I���U�&���Q)%� QZi�-2���=k��j����$zok�&�;Y�� -��H�#�����m ���o[E�i�3�k�(W)hƽ[�u \wZ�Aor����#�8����k�$_��mh�f�ц�vZ�v��F�����|V�ҟ��ۀ@�� �;���jವ��q��ƕw8^$��pE����"8�ՓՐ6̑�V�v���Pv�j����u�0�_��U�<'[�kt�Gv0)#��n�[�z�zw�e<ԓe;������!�pKa�9^U&��.���d(8vG�]?��x 9ˣ�a�3DR1�=w�e�1F���J��>�ܦ��zH55R����S����W�� ������S+�A]�kLݽ��6��μ�X�T�c�'j^jM� �e�u�*�A�<�<0�.�N"�W��ڐ�6��ëش���<�'��-��xg$M��R�, �QKpGIs��N����M����"�:�9}�$�Kj����<|��$��gr8��;����R�T(@ݧ�v�cr$�،D��J����gZh.җb�$��K6m1]�`soMyME3�e�/.�l���%n�n�� ~S�ϸ�s�Wi���A��e�<Qe������3�W�Dt;�ͱ\Ǹ������tli�Y��ޝ/s��co������oM�<��,�����B���r� C��vD�KR���}m���.Ve�آH�<{.����ŖKZ^�������.<L��E��`t~t ���r�c6�$ �����Ж7�'9<��nv�h�z!���O:�f����hnu<R�*-D'my�t?�K���+��A��{�r�ק�q#`��"1��F��}J.�"G��訧��ۤqWG�g���ͼ����ߊQ����O�B�~Zb��{-���44�C�]�v���F|1V~�Ѵ�W^��(*����8��AmCj�Ͱy�j5�T�b6��o[f�!�G)�3v?�E2%�;Š��k����T�,�q�Ex�b��N mYS�t��U��>�>�����o,N���7UUX,~����ku�ЬC����{��ꨜ��H�p�b8��{w�t y#�&�d�b�]���f'����cГ�l�Rlz�����,���"���o#CH�#S�_̗���@������ ?�C���)��#s��]6緛S�w�K�ZÆ�<��jS �X��[Q4&M���-���ѯ��./��U�W�S���C<�X�n���F�B�D��;����H:M����*�F���0��3������������싉���#�-�|��f֫�3�p�(�Y���jhD�FS�*s֊���&2�/�(� � ��U�Y7"���($�H$�/"i�FF�|%Ѵ����b���'dXC�C �\�q�> �s(���&4��w��Q�,d�����oZ˒�'!i�3����vF};�ʣp�x����6£�#��yrt�f�������r]S�<4>c��#��^c�1�Au�M|�ݓ�!^%���Ьw�&.�����$��wL%���Tx\����WQ����[�ػ���=bʩx��t�@*T(�h�c��X���T����W}M;����"�� /%����v�o���cW�8|/�EE�/��j\�d��DSb=L�!�x�?'��1 �euz9ԫ4S2Y���@ �����챢L�$Ʒ݀����j(XN���.l&ڻ��H�I]�0���-��)%��u�P��[��u�YQ+���W[���ݾ&�4?Sķ6�d���Q���ҘC㬄�B�:5d���D��My� ~vo��J�:"5z�x.qLPjA�Cd���]Xr7�~/[�d������H���~�'���\�1ĩ?{�<S��f&��#�09�T��6Y)z�}xzJ�r������П4��y7ьp��)HGb����W�t�Ih����[M�k��P��=ȫ���������p���ɏ��j�����-O���.o|��-���%M����"�K����RE�����E 6Ҝ�le9t�@��������W�z)�0�BT�oܽ<�������k����7�V�%$p�pb��h�B�W|K�}�?��̫�Z0�j��ީTHop��n{MZ���l⏝��I`����xz��q˖��Ow�m��B���?c;n�[���dK�@h!M[6:��AJ�`�/�T��'[�s����d~P*[�Oy��g��r�*��c�HչQ�Q��p�=����`oY�u�����_f�6�5��f�{���c�pxf��b�K�.`�5���5�^���C ��a<��d��?��8Ҳ�Ap�y$)�*$�_ (�wx���a�}a�3���ûtG��h��}��UʻY�=/��:KŹ�0̦7���L�>�F��������k[r��u��;"KZ�`�
Static task
static1
Behavioral task
behavioral1
Sample
f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
Resource
win10v2004-20221111-en
General
-
Target
f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e
-
Size
150KB
-
MD5
54c71c18183ef05b38143473d5fa486c
-
SHA1
8adec4c1367c8f580f68e47b26c2f2ef9d51f494
-
SHA256
f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e
-
SHA512
e8456b6783a98bfda0ee8c45da3b6482a996eebcda7743180e66d875b520d37863a81685754b8733360f4ca7567d3d351f27bcfe316a31a10c3bc420ad91c2d4
-
SSDEEP
3072:MBmpqM2kO7XGVSQPwqCC+SXwHIlike8pDUvYDGOzubx:MCU1WVSyl+SK0ik5hqOzubx
Malware Config
Signatures
Files
-
f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe windows x86
3881c42dfcbaa1132f2abfa0c0cc8a53
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_ntoa
kernel32
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageA
dnsapi
DnsFlushResolverCache
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
mpr
WNetGetUserA
wininet
InternetSetCookieA
msvcrt
strchr
advapi32
RegCreateKeyExA
ole32
CoUninitialize
oleaut32
SafeArrayDestroy
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ