<�y8�Z"v3��ū:k<���l��77�/��R�� �Dh~�뫻Đ�M�]��C��]��0*D�6)��� ~o�(��hTF�KbV�f��+.ց�W�q=��l�]/p�NMoFr>9��b|������e$����C���K=��+F������<lX�<[��D-��:�+ǚ?��bS�Ѥ�q�[�pt!�k.�@���x�{S��%�G��T����3��hi/�ؑM�����]�ښ���<$l��i��pN#�$|�� �@�,q~ �@o?=���beA_VIr|�>��B���($ \y����h��e\�E5SW�n��V�a%����M> �l�2@��-*�~�l=�����p`�>F˔7��P�*��OS��}|�˸y<�z�;d�F� ���sG�*@츍B������8��2^q�kÙ�T]#��?�᳨[Bg���N��M��7��_\����}�FV��r�����)��O �a��@�s�U &t��L%2X�O��4ך$�/(��a�]�?j )�/�����V�rft�b'�����>P��mBDc�=m� N��#���|��OGOE�ǔ���?�Az�v0_��s���Jr0����7�|�w��$u�q3� 1�3 ���e/H7���.����(��R�����Ə���BrL�l휺�21��[hG3�E�.R�AM������#��+@Ts��������E��4�*��͜��q)L�p�}��� / �������*�!�VW�Q��D�4-���#Ȼ�b"���=Jj�0�,+[����H? �jx�Dž�m�8n�X��4�Z6K��0��%�`�R�`Ç��W��I�d�+Ag�� ���������)��������!)�|��$�� ?����`���Ȅm�����ڊ�������M��j#��ĺ�y��V�a^N`�3ll�q���ROn�3ܝ�z�?n(��t��fU+'��Gl��٧2<*��X\�!���)?4h�,�o�ِ捴�9�(vW� ǥ�+��a��z��'�F��������4��5)@e9�(��6��3���n>�D�h�C�� ~�Qi�ڄU��N Z���a��/B�!�*����(���);��� ��s�)ATnꆓ�}y�����9Z�i5vfY1�o����{�"�q��_�^�Y D%��y�k���]"e�J���JFT �Yʣy?`뛮f)���7�Vz�ڴQ?��lq��b�;�p�n =�t��S�dt�y�/�w��(\��x,�?Z%�,EP�}�o8HkO��-��~���jI����xW$��`:��k�F�gQ���uB����$/���"�N��ik���/a��}��?sz��+�b�������/��f�4���qX���Q�H��ڑ�V����Ę����0f6I%jX����q��m�"~T�Q%�D�01I$>s7����w�'�'����^ �n�&�U��I�gb��B����'=�`o�z� k%��������ˤ��������NOY0�۫&S1\�,W]���\#��fr�Cfi�bA:L� ���>�n3�J��IBm9����2d��Y�Q���r8 ��vH�j��_�����6��ٟ2H�y�XY Y�����M�2�!�s�9�]t���<������K�mi�w�KWTdR4=y�^bt_&%9$S�_����ס��r�\�Ty�� ����x��wJcp��k�8��+uږL��ZDk5�����b=�}�ؘ��^I�+g��\�7_���9ey8`"�}�sj�������➈��&�#؇f�|� �U�a��� �^B���Ĵ��T�ъ��r��A�D�4(t���hL���2���Ȥ���g<��䁄#��"�8�+L>��� u���߆VZd[r=|V��,Ѥ�v��:��_-m�]�jf�� 9�� ��l���뢉�(rln3Q��Q��}c�9��}~B+V(E7�n�@���JN%B�Q��Rf�)�n9��Sh�NB]X�ԁT56^�W�]}�_(`ل��UY�=,�+=�����3 �ٙks�p�4�����P����F>RX*��tCe+G�;A�g�M%#�E[:/�R����!���������wm_5��mQ����ԎI3h�����/=?L�<�~�y뼼^���{��=Ŝ�WɁE�7�ؗ �{�gt`�����_�h8ε��Q�[�n/g�L�>Qd~:o��̭�j��T�Mz��)���+ 1�H�*P���Ť�bZ��3����C d��,�?��}��۽R����"�!��ۣ�ǜl��g��O�q��p���*2�o<���+�z����d�f �BM+Y����?� ���uG/n��S�F��ڣ[����Zd'�;]-�lVyB7+��rn���9.}qq��;M<i�>�@?�7 1?���}�������93�wV0ǥBEc֭�vR1i�,����7��?5���WcRg}�K�����m��Q2���Q�-�cu��x����R�m:T�x�f��o����X�Н��a�ͩ��%����0Ə8�?�?�(�����8:����l�{��|b����YKe�1�υ��EJEu�����<�hIx��w�S�$ݢ�6`����w��}1�G�:����?>�@��C ���i�` �i����Jo��'J�^�r�8�Zvq�� �|���M��i���U�C4lx}�;g<�ei�8�h�'��� ��^�9o#]��8��{OIA��E�h�Y Э%# yV����Uҫ���M��T���M����jpq�U��&{���|��ٯȪQ#Wo�T;�c:��=����[� �Z��� t��K�qtWn��U�8�Fe� � �մk&BMU�%�~lb�o��Zk�-�i�Ç@�!���Ȏ2�����'S�$�f�d08(��[�� SR��R9�?�vqAo��4���\�����(|�%��U6\!��4w���D�3�0/�/�X��M]� �A�$��8`����o)���5pF�6��őlX �|`����?n��J�����a�d��q��
Static task
static1
Behavioral task
behavioral1
Sample
Actia Multidiag Keygen V30/MD_keygen_v30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Actia Multidiag Keygen V30/MD_keygen_v30.exe
Resource
win10v2004-20220812-en
General
-
Target
050b14d547798c0ef2b4bfd4a777bc13a6f97ac8b687caed560518bc77953e35
-
Size
759KB
-
MD5
653f5606a87a451624c866d0ddcc4f79
-
SHA1
af84d8ecb3fc52d6400610ecd9b4f71aba9d2729
-
SHA256
050b14d547798c0ef2b4bfd4a777bc13a6f97ac8b687caed560518bc77953e35
-
SHA512
1969dacc89cffdfcdb8795959b0bbd81324e66ef939f62988f144dc521ae1f54961b225e8af6609588c4c405784930de6e7a1d8d8d12a285c2b3e576ebdc04fa
-
SSDEEP
12288:97L8wzXBEroVZ2wHVCTO7Oe9+2XwcBKajBvNKNY0xBNeV5XdBBlan5S:VL1zxlZTF7XV9KW0z0La5S
Malware Config
Signatures
Files
-
050b14d547798c0ef2b4bfd4a777bc13a6f97ac8b687caed560518bc77953e35.rar
-
Actia Multidiag Keygen V30/MD_keygen_v30.exe.exe windows x86
00cf33734c2ca3600f75ee1f99a5b88a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
comctl32
InitCommonControls
kernel32
LockResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_setmode
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 440B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 216B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.key0 Size: - Virtual size: 825KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.key1 Size: 762KB - Virtual size: 762KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE