���2�ܴX�^pa� ��;|GB�?���g,�wl�r��s�$Υ�a]W@��6����ƿ�8�n�АLd;�E���:����I�� �3�%M�~��, �)��vm/�������!3�rs� #fǢX��J�v�� &ݬ)��]�������I�w��¸�>�| KKw;�8=�5_A~�\%;,'9*�7��_J�f�F���H�;��C�]�m+�9ï>�:,R�=��F%G A �@�Ÿuk`'>&C�2�x7��.9δ�gv�N��Z����Q���h]C"���2��v��[5��}����^t� �}�\a<w��v�ve��/�g$jc �J����I�ׄ�K�!�T},��Nˍ?�\�'���3�0�(��48����$zW V���S�yg]5+U�fߥ��"n��F����N� pf!W+����xV�k�1�ܫ$l�]V�ނkN#j>�I��+�%(�rr�r'�ؖ����ψ^����/��*= 1F?�(ע�����[ f_�<I�/6;:��7K_��]W�AƇ�ӹ����F�It+���. 6{3��#a���|�[��=�}�Q�)(`�CT����AH� �5pr7��={�i��"?��f��ն}����7�4����X�N.�"�k|K&��}&�6�;]������{K��B��H���b���:���,����Oxָ�ԋ�h[��O�G���7ֵ$�Y�衟��R�2P�uUC0����^�҃2��黕2��������E��l*�D��]O����92:��A�$em�`�q����EN��&6&LjX|Y����Kc�CA������(h���V9�T�σ�-�U��d�tG���e����__��Q�̢�<�H`�b�Dq���y�,Fk���$iO.��_�kAnA؝� L��1�ђ���RQ��p$$�ew��u� B���4hEG�ߠ�_�?��`��)Kހ���Â<ڋ3cރ�#n� 0}�Vj��l������(��||��m�R}B��f�䪠�u�(Fh��Ep�]��g��|[pY��j���WG<�0������U$ټ���0nf��� ���?��%�k�s�yh����� u��9VL�*AWS�&d۪��&<����+��u�XD�.�"Ś��*/�3��V�?���v�1���5��܆�cw��U���D��8���G�Yqxͧnz�T�?:á�����.��9���栞^m/��n��i�i6��9��>�!������K!�H�,f���c���%�\�n#V�v���,���i�>�%Bx��|��B���o��pK�� ON��N�B%M�ԡB�W��_������g��؟���'��x��BS�@(������|���e�x�`̟a�1s�s���!�a�n<T��``����D?")�W�� ��\q>�ۖx��^��]o���ʧ��H��KuN��5�9[Df �1I4�/���V���)~�O�^P��&��fk����,�vlx;��U�>Ԭ&'ZԈ����Tl��Q�Bם���MZ��{m�3�_�:�`���)p��X7� b���n9O���B˱>���{W|���.l����}ea�U�۵qsK;<*g3k%�� �(�7g)4�ieC,n8���c��gb��!ҙ ���ڰ�\�%1*)���~�Y�����qD�?���45P; pg���nز}��w�A���lU9� "�Ⓘ��c�Lh�h��E����I�l_���g�1����ի <�3�ԬϚ�EY�D� o�&l�����4BJ�J�WN�����-\�#�xL�H6O��xN)��/:�,���M�`�ӋF��bi����(vf#K��P.4$��Q�i�V� \����7��N�v�g���~摘��"������� �'��� �eW�Q���b[�G7�ϣZ^9=2}6�Q��>0<�=i����UK8�]�H��v�z�m�&q�E�D=г\�I7�ė��Q!Cc�MP�����=Z!a8�^��������{��J p�&� 8��LΊ�?g�\p}}�C`�51N�o7%N�f��� �c�)�cNڞ���ne�.�l�\�՛������x�-8�Y������<i%�� ���1��^���d����`��9��+=}� 2/�Z�]��ڰPT�� �PC�We~m�oZ�`l�>JD�FRŚyU~��t|-��8�w��+&����e�{ʸ��|�ԖJ�6�{w�煝@��ҠEa��A�452�՞�N��6|�h�2C<VD׀�B�2��؝�äK�:ح`m�;Z'�|ַ�b�����RxW�L�x� �Τ�Jդ@-�}r�p�;/=fuԦ�I�n��2�%���P���A��1W]h�9�"�˺�ח��7?��}� ��х��]�ݱ!���T&�Y���Ԑ]�����<Hu5G�$U�����F���ve���A҄�A�]��ͦ��g�ZwA�{�(3C[����D�M/��b�c7܀R�H�A��β��U���(��{]���?⮍�����}�J����u�̰���X��P��C0P�~�?.�X�Q�����X���?��+Р�Q���ՉccwO�r���<���J����us�@��a`��öњMJ![4`�=�I-��c���x���m�q�]���L��x3��/��0$���pr��r��|��Nn�b���g�K�Koب��6�&��Z�����S[��,���ڪ�X�-D&&�?q�� [g+��a�����Y�;f'����3x�}x�D<��b��0W-_�pOv�f��oZ�8�K���#4% ����il��麎k��Y����ll�36Rȶ�����E&��v���1��7�Ӻ��Br�<&i!0�w�=�E�OP��-�M������*�=��^<'Y���x�קߟ�SA����)� ��|I����<�_'����/7�p�B��|b��g�Q�g��tB�*��fFf�Lr���+��{e%�,�@O3�-��|��С,����8y\c�Oj�ɲ�B��a=x5��!�"B��t���i��ۀ�O��kIm�
Static task
static1
Behavioral task
behavioral1
Sample
238a0617ef1c2ad2a54ca283b41ea2a138dd8fa62aeebe57d3dd3daa835ed0e3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
238a0617ef1c2ad2a54ca283b41ea2a138dd8fa62aeebe57d3dd3daa835ed0e3.exe
Resource
win10v2004-20221111-en
General
-
Target
238a0617ef1c2ad2a54ca283b41ea2a138dd8fa62aeebe57d3dd3daa835ed0e3
-
Size
1.4MB
-
MD5
6aa577a6bfc98bf248ba713914499026
-
SHA1
aa686caee8964c6dc7956e6836814b40161a77ac
-
SHA256
238a0617ef1c2ad2a54ca283b41ea2a138dd8fa62aeebe57d3dd3daa835ed0e3
-
SHA512
9eb0bb42da50827a7e089f692ffaa7536e33b52c86ed2a53c411ccdcc222469bcabb78b4c46b96c9141753223388522d9746770b685044f78f273ef55393a088
-
SSDEEP
24576:RsizY2HegnQFjrieRjDH7PQW4khMXM82BE90R23c0d5nj+9aiRpVtavU/:f0vQQFakjDH7PQWPMQ+G0bj+MiRYvW
Malware Config
Signatures
Files
-
238a0617ef1c2ad2a54ca283b41ea2a138dd8fa62aeebe57d3dd3daa835ed0e3.exe windows x86
9172f97203f0a7890a03d0c59405281e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSubMenu
advapi32
RegCloseKey
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoA
gdi32
CreatePenIndirect
ole32
CoUninitialize
comctl32
ImageList_Destroy
shell32
SHGetFileInfoA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 770KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ