w�>�$Fp���ʔX�zom�Y�d��f'<++������J721%�#�䵤��g뱒u�˔]�t�>��%n"�{>��[� �n2 ;�PΙ�����"{,����Ƣ6���Jn�G�.���=ؖzr�nKб&����{�"��*�)+�z��>�]'�����,�^�Bwac��}�Ҧ���BVH��TNɷ� z tQ࣍Ԏ�E�AU��Y���=���y��L`���ڔ��P�q������0�0$ø$h,Ֆˣ�`���I���o�$E-�C+��U����ܵ^�ǚГ��� I�������y��/^�i����< F�'-�`Lܧ�i{�[���3���d>'����צ�4���ݯ-��@i��"l��SԳ\4J9R�R��2 �m�{[�����.q�S��h �m�r�=Q�����X��B]�+[w������ʥ��,������u��uǻ{Y+)�-_ο*>���&��(�w�#�ݵ��^�Jd�}�����0�A��X^R�d9ԍq$M�^��,k�1c���PH��Lp/k�| ";|W�B��>��3ɹR�#��ȗ��qn�5�Ō�l�?!a���Cc�.���]��S/��B$�Sbt��s��7�l����8��Mh���.Ӄ:��"�:P�>?���S�ۼ��𥱂��T��8���fBR����J�4V��m��q��=K��3C�H�e:���..iHk!١���=�c2�uw����@�5� �^p�،����}��t���Q��R�7|�ljX�5��^�Z-f�E0j�ڰV�ٔ���%��_�]r�)xx�E���A���p%��� �7=#cy�vy��^���N�AmA���R����ٜ(�V�_�9=Ϝ���D��n�h�~��.�W��1�zrX�~� )�:�dO�>��q���Z�w��&��25��c����|�m��ߺщ�^�[�R��2?Ns �L!����xj�Ûe������5:X��+�g$�\�()�_#�I�drǚ"Y���0B�l�@����%Փ%G`�Bs�:��ϻ������dѕZ�����������������Z�kZ����_���W�2Okjא��¶;tKb90X{�q��͒懤���)��j�٥�'v�i�W�Z���4�LK��,�~��D�ڇi�Y'�M]������=!,��(�U�4G�Ɯؘ�;���T��Ɠ������QY gsS�3Ƞ �����V�F��Дs�a�ಛ���F���%Cgzzt�u�������f���[�D�|Բ�C�X�?a��~����}IA�? n�Wi�+��q�����B1��ő�졕�s��peW,���TBT�W8iybxj��F��P��=�sN��7��+�2l��y�x���C:0����g5���^F�q��V�AI<eE��8J��J�1Q�昱O3�E��ؠj�s��$r$ �,F�����;��;���U=G��#���pvA��T��v{��w=/�̭c�1�k�TR�(\N�8r0T�-=�U(Bj#iضt���3�ã��(�q'��J�b-�t軘��(f����V��n�@q���j��?��5dW��X3v�D��P2y{7���<���˪Y�.��0<r4�L����:,�GHE��p+���g8�MA�yk��tD~���-8Bq�������S���eK: ?���z[��q`*Kص0K��}�Y����Zp1[~N{*٧���~G ;5#�2�ccf������� Ś��GyY$�`P��-��ܲ��6+��ƃ���A��L3���Y,�m�pܛ�'�LJW��X����=���y5Cb�uV����<w�n7�%�}3�_����dl&�Ves3U�3Ř�W�rs>��?�"M!K���d}@g� P��߱|���Q��}��������r����X��=C(��"6�q����S1� p!������+��Ԥ�<��Y���#G\��?3�/���}K����J��z�,Tg��C��RH%yII�Š�Ӈ��i��z4s � W�MkvB�� �H����<�x�)��^�����C���%S��b�z������c%5l���b_�*�Nlҕ������JhΖ�7� i��g�X�P��qZ��|�P)Q}� �,���q*^�_��%Ez��k��B��g|�`�4�xu���e��S&���� y�՝h%��v�D����b��s�@�"ڳ7�c���`�E�0J����;Ƥ�q(C)6�|ì����Bn��g*��:\FDZ���^��0��u����Zg�b�-�-6�H�\���4о���tk����,7�!A��Z���-0�w:{q�2��ʢ�!:�x1_)���4�gy ����*����ʾ�S��wQ������a���9:�B��ob���e�BC��I!��9�~u�ϲ�3�!�?�67j��KN��1Bߎc���]�].��d�����B�iG]��߅��|�H�əM�xp{v���ǔ���̀'ʼn�nlxy6��� 7ʼn�~�?8�)�:�m[�u��Y@�4�@���x��R��AU�%������9G5� ������ub�����3��9)��,��A�<�6�0Q��R*l�߹J ��Jmk�m'��[Ǹq���3�s��M���C�A��~nl�T �ɗ6HbVkC�"����F���a?3�)����](+I��w��^U/�r��D]ո�ξ4�O�&&5�@f| ����|���g��xr�A�ݪ�<}z l�^��U�Z��_/uq��M�?�ɒnJilq��B��ޯ^���<�Ĭ%[QF�b�Þ9?�k���+��X�!������'d�����q�L��ʇ �M�9�C����a+z^Lw��B!os������]/bW���l��$�ώN�G����$�Nټ�yW:�\��B(2���y��ςAо��" �`Ϧflo.nG,���S�Q����}aD���l8��7GY,^]��p6���5�����A�8��\��T��Ӑo�b&�W����FU`�ٔ�d�Xn)W*���m$�|٘GVnIG�E���z|�d���)�FBk|�a�NB
Static task
static1
Behavioral task
behavioral1
Sample
85c6b42c312667f6c76e3c92f50e802e82f7fc7b93ec482d29132e0f4e277150.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
85c6b42c312667f6c76e3c92f50e802e82f7fc7b93ec482d29132e0f4e277150.exe
Resource
win10v2004-20220812-en
General
-
Target
85c6b42c312667f6c76e3c92f50e802e82f7fc7b93ec482d29132e0f4e277150
-
Size
793KB
-
MD5
da2d6b84878897797dbb3e80a2a96cc8
-
SHA1
aee1052a0e5c8540a5cbc86321fd3e543b170984
-
SHA256
85c6b42c312667f6c76e3c92f50e802e82f7fc7b93ec482d29132e0f4e277150
-
SHA512
c3c564a3fdcc02743d4b8e99629c036fbb02b679a1949e56d61b978a9ceb29290445148048673ddbaa2f1cb08311da8990dbc6ef01cfb8941310f646249fd92e
-
SSDEEP
12288:sOf4qltZO5Hv62pq/Jq1Y8MVQtRee5S524CXdTXBgh526nfrAIsgPNoDxMwg5e1:sOZQvJYJgMmzp5tTij268ZgmVLIe1
Malware Config
Signatures
Files
-
85c6b42c312667f6c76e3c92f50e802e82f7fc7b93ec482d29132e0f4e277150.exe windows x86
89e78a132db2eb73b448ba181e7a070d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
comctl32
InitCommonControls
kernel32
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
system
user32
SetWindowTextA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 216B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.key0 Size: - Virtual size: 842KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.key1 Size: 790KB - Virtual size: 790KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE