#I��9}ܨ�s�+X��6�%�ݣj��B� '��!�c���#!�ُ?��m.�%��=�sMd��?)7���K ܓ:���B�y�-��<_zW���k�f M׀���f: ��u}�_�^1t쬵76�;�d�?n�;W��v�nZڃ2�U0�Y�G�%�s˵�l�C=/�Z�ݷ������T��o81�r���[Yϑ�ɩ���LL?Y�G� ��<;�`#�� wIE>������ϙW,�̬�8��m����n�׃��-Ȏz�m ZEww��EO��� y���f�g���pXo.��9� �Sw�#��N��h��*ƬL�^�q'R@����N߬��N̔�+���Q���t���uUn�+w�USy�G�����M��Y3�,@�H1i(QXzv�� Q���=���dEI����,��g(�t���eB�v>�a2f�A�*2��Sy�$%���;��� F��V�A8���j�w5��� J���d�L�����3I��a��d���R�����k72���8 ]���*Ai-������+�/��Ʈ���EwabF2 N�����?��^��C����-@�Id;!��ѳ��&Q���uȆ���A�z��~����R��2f'#d�F.8�6k�V��'`+�_�!~� ��x�4%�YoN�Ц�l�q �O�/��Ҟ�"��b08m����� �O��҆<K���|���ɳ�_�v]}M3��&�g�`���TI�8o�� ����ՃD�Q����d���#d�A��jT�/���� ^�&:|�<d�e�W�5��$�MF�+�qvr+�Qv�,Y3w�^�qJD�3)�߽.��:@B��t{i,�N"G�6�J�^*�I '�|��h�;pwwS�f�М�3�ð��/Q���[��>��Ꚅ+֛���� ����(��oXN5�,$p��e*2t^n��6��C��b�!����e���C$!�v����V�|r��?���y�� Х KPwL*L6ǂb���+؎p�`�Y8�5)oTQ�9[ �҃�0^�UC8A�f���A��g=d�Nt�$@I/B�L&9�?��P�]9IO����l+��=\�����7�lB�x�A �9tVsmn'�_� ��kZ��ש�Q�J�*�?,���.&qŋ��Ba%}s��q��s2|��. ��^,E~eϠԏ[���!˽�ҴM��'n����㊇C��$���E�{���L�}[��Q�M �X�l��"<��K����s�D�sb���>?��t ��0ME!���v;��ӟq<���?���� �܋��@"�&��q��vk�s��\�Tk��U}�y'|%z�b��2��4�]����j��J��a ך�?��T�(;��tM��k�����:�}�SN�AM�N ��8=����c�u���b:瓠'�[��Å�9{��8���Cx�n5�+��I������S���zEl���;� ����O9�$RLDN8�����2S{8��R��Q:�?�>N#*��k#�e0���n�ge�����c��B�� g(%�7&��~�j�#�z��Zv���1��tdD_�b�;�#�0K6�^��zq�q]�%�_��|/�4�~�<��Y��q�EH�eߛ���%�b�"XQ��*4����2��vNt����'�H�m�=g�G�C�-�O�B+�f�f����}�;����q�]J`�U�u��C�h�/f��w ���^P ��"�D�����?j�t���| �wv��k�>�L��;��=��#�|��O�sQK������g1О���i�/(�*�zE8}�#�۽u�WK�`D��ktNq���H�&5�k3��;��8�\fZ�1D����:��_|��G��q��5ٶ"�}.��c7!_�-�<1�W�E m9A��W�V�a��\�ź�lK`�d��v���Ʌ�|$�W ��@�(�l�Ց��e�7_��ᬇ�H.;1o{8���!�%� �;,`���ӳ_���H��L�\��c(�����u>��G �����J�o�D� ��o��.���[���F���}����b+R�s�_�x �8v���1(�V����iy÷�`��*�h���n6kH�'!V���n�^]v����%1��q���V.���9�Y�{rlFnw���==� ��N��9Wu=�9��&iH8�x� ˯=�^����_忩����%�����gC2��h4L'����)�����x�C��:�6��!��&v(�����ۢ��f�ǚ��4$H{���523��|��������zi��� ��F�>e��/?��b�bA4�s�����W�������gO�=�y��QUw)�x��y�Ùn#�N�j�Pm�[ )j$��%���?/����V����m��ZA�-ٛ���/��"�ў�)�:p�ꁣ�|�������dZQ}S��ea�j9�h�i)��Y�5�}��R=�n���͗�����cj;'�͙0�4OE,<����5;�� f�|�?]�ѷ!G2q���$��Bj�.�r��_O���<�P@=�pH-5^��!�9�b~a�A�g����Ȋ^�Dv��� ᪰��+���K/5�z����6�C�O8s��IV묟ɋ-+ ߿���f_�:�y��k��]�aP ;�gM���h��������H�Ɓ�_oq�6%L��SM��+'`�D6s�����ew��nq�������.�p���!�&�H����v �UNR���MdXZLVȝ��xR�{��r5��S�>�P�҄Y�#�� ��e��b� %��e����I��Hp���s7hDxh�v 4L�Y�Z,:f^5�p�\o&Pb��i�G�_�3Z��0c/4�M�����%H�N^egF���^��ܨ3]ӁK2��{�n0T��$�ʈf�}�k� 6U`��H �E�W��q�_8y�=�"B�~_Ԍ�ُ��i��%Inܦ�8 ��V�&��]��~;��!>e'�q�T��B�s �7~6�@.Z��䦺�L�{���c��y*%;N���'G�o�1Y�o{m��22�i�h0;�Ρ܆d���������s��K#x��+��t�;c0d;�E��L��>�����^�
Static task
static1
Behavioral task
behavioral1
Sample
e4396ee8c437ee0a90c476b482a5cc14221be24c5243b65c68ccd0683f933e3b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e4396ee8c437ee0a90c476b482a5cc14221be24c5243b65c68ccd0683f933e3b.exe
Resource
win10v2004-20221111-en
General
-
Target
e4396ee8c437ee0a90c476b482a5cc14221be24c5243b65c68ccd0683f933e3b
-
Size
1.3MB
-
MD5
a074d19503ed5c94af23fc4d6cc74df4
-
SHA1
b1d295973fd08ebae1e014eddac0432ee6225618
-
SHA256
e4396ee8c437ee0a90c476b482a5cc14221be24c5243b65c68ccd0683f933e3b
-
SHA512
60abb160bd8eba1fb4a362fba688c5c8560cafafbd948a0ec6706aa6c1982aeb110f39fde2b728b3a1142c71df6b7fe2f3469fff77b2dadc98a0181854a450ff
-
SSDEEP
24576:fSwdZNH+KOv8GFmGa/Wn4AzGEU8UKFC8zjH4vqJ+pTbkq1HwJEJzeQJth:fSwdZ+v3YIS3LwC8nH4i4NIq1Q2JZ
Malware Config
Signatures
Files
-
e4396ee8c437ee0a90c476b482a5cc14221be24c5243b65c68ccd0683f933e3b.exe windows x86
62562cb6e1a72f1bb36b41631f186bfc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
EnumResourceLanguagesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
advapi32
RegOpenKeyExA
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoSizeA
gdi32
DeleteObject
ole32
CoUninitialize
comctl32
ImageList_Draw
shell32
ExtractIconA
wininet
HttpOpenRequestA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 546KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 969KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ