�b�J:���N!>��^�I�2�,��H��p��p)C�b�+�̪6�D�E����;N��N.��}���L�E�������ne�&��T�#����]X�v�Rd��0剬�po8�&<^�Uڧ��\�����5�]2���5!�� vR��Ļ���_0����ufWn4p35_�6ҩ���B.�{���N�T��:r�p��/ t([Yؒ�膔�Hy�W��lrvWT%����������ksxZ���i]������ � ����W�ChrF7��W��3�0Z�������w��/����+�����8=�����=�� C��!�#�aY�X��iT�n˚��TFgM�&�F�fA�6��н���JD���2_.��h�]a!>h��eS���/ �S%���0ѐ"�fЕLT�v,�P5��v���3�E��!����k��k��,�8]+�)�Ĥ]+����m�����J��7��ifGuz�+���Ml���kjc��3h�X��\�qĐl玌Xb^S�=1X!�9�L��}�h�0U������lL���'6�7O��J����)%M���f�3<��C-{��60��o8�!il�r&��H&�@�[,Y��(8 �Ƞ>g<��ZZ\��Ӹ��[�Uo�<;��)����@5F�:�c$��{M�(5�K��=�z�9k q_ǩ�(�M ���s�g�v��F��W7�e0$�F��SF��6��Bd�H���C]��� �猼iem�LQB ����8s�\���c�V��[�y��v ��z���Ơ�X��.������JB���N=��̳�N?W+��ZR��#b���i�3`}�����_W)X9$Ef� ��F��ٳ�r����v�3d��K;#ƀ~�-=b?u��O��~'I��N�BZ�Z\%GinV����IJji!����{��>�B�x�&�W�KQW���Bˆ{�?Q(���${�h�L�і$������u#����w���th���wW����e1B����e��䕿p.(�>%��>�$��RW�Iͥ"(� 7t���������& ��c�Y ���y, d:�%#n[�ݰNx�Dhh��1ذ��Q��9��W��|z����MM3 S�bJV�r����n�yc,�(���G��2�C�$��=�a�Aj�[c�#��p�����,���=�4���3[ۇQ�y?�P�H7��[Hͪ��� ��|&�F�d��X���3jFGZa�o{Ԉ��b��'/���7���p�39�.|K��1�S�q"am�B���,�����j�o�b��\E~Q(Pw\7D��m#3�1z��lY��pE�9���d��L�[z�nq;2p!R������X���3IUc-��A�`-��< Q�����!�wTT��Ga�]. �<C��q$��eL}`z)w8�X�ߚZ�<�_foL�w��7��tQ�|\5?�x��}�)Z� w��C%����|&�2�-CQ:<�}v�@Y��j��M���^�eܬG:�=�V�g���(I���E�&ڴ?�g�[1���&�A��X����IL��8l��0ܮ���Xbh�����z��9Ȗr����lH���.m��`/�"��~�~} W:Iۣ���;� �t�gVH��)�lBy�Eq�o�X�ӽ)qɉ���}P2 ���[���G���o:S?��h���MeM�uf����b�W��1��/ ��GH;ڍ��1U-A��Ϡ�%z�6+������)���܍)dq~���\T�����`*Tn-��`'k�U�,g8�{���}��Y!{��s�zQp-W�]l-�O����>Iܿ֩�U��e�97�܈o0���e�+�Z�����M�0��?�ߩ��/�yG��m�R����u�,�@r��&d,ͯW>,M�gʵ���C���sw����f���G�&������\ ��yL`,U^Z��gS�wmp��<����T۰+�z������ڇ��X���y�����F/��'X�ƀ=z 4���UL1����d�!\�.���e�ߒ6�XP:5ͧA� �iMʣ�\�f>������� �b3�)�R�h��yOӒɮa���=nl�)K�ۼ�U!g� ^��-�j7W�Ք� �B�N�� ù#NM4H{���Gs̐�w�,6�y�g�~�'8����yI�f\�Ql���� k��`Ez��z}dR���)oJN���d*�(]�f�O����D��d��0�n�ߓ -�o�k�&���~'�1SE�&6��+�q��Ev���M(0��aN�z^��6����~o �?_��6��0I�X!U�Ož��D�o��U��wϼ�y��dC�Md���&T�ʳ����˾Mxd�_qS�0Ȁ��F6�Y����6��&�HcU� y'��+<����+M�I���s]�E˞�I�����#�_���6`��<F_P��v�Ƌ�^DކPS����O��x�w�.����r+^��ԉ*pn����aF������@�N�<*���"h}���a{����U(q���ޜخ)4߸���s�0�/?GѮ�v�z�i���bW��n�ϛ���rkS��G��.\����/X���}���&�B,(��;=p���(�@.j�x��ҁJ����l,�vܺM����Y�;�`�I�m�}���.�p���Q:��\Qv|,�ye�kv���q��#���:8��`�;����](��DO�m�;`��Փ�Y!L:f�t�&��mL������Z�ku�������"{ۂ��uLE���}�J:�ѿ,��0�jR+�ʘm_�Mh[Yf�8(>�o���-� �Nʧ���y"��+��k&�����ݺw�)��8$��2��+�LQ6�4�%�z]�OB��&�-� ��l�Y��d"UPדk�**��\�֕��Rn�FL��w�B 1P�<�@��?�TQ� x�힔>*�\J�I,p?�hD��u����2���HH�R��Kk��vK��1�����R�j_Cz���X=���c�������@v �������^4��A�x;���)��0�?r�)�^��5�i�F�OSK7t�G�Ժ�#����x��Ŝum�N�����
Static task
static1
Behavioral task
behavioral1
Sample
c8a6c4affff832e3b25d9fdc669469a022ccecee2f111dd64e9125e159b0bc0e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c8a6c4affff832e3b25d9fdc669469a022ccecee2f111dd64e9125e159b0bc0e.exe
Resource
win10v2004-20220901-en
General
-
Target
c8a6c4affff832e3b25d9fdc669469a022ccecee2f111dd64e9125e159b0bc0e
-
Size
3.3MB
-
MD5
e5a0276ffe69ef7b3bdb6be32bc80d72
-
SHA1
cd5f53413da96e57c245fc5c3eafa080b0752577
-
SHA256
c8a6c4affff832e3b25d9fdc669469a022ccecee2f111dd64e9125e159b0bc0e
-
SHA512
82183a694d3de1b0e77d9cf053a343ee060141aed1e14dfbfb0cd73498dd58bd1ded4981cacbf7c2842e2ebed1201a5ea442ec8b36552bf35715734256661f16
-
SSDEEP
98304:NMdmKuGmd/jsXaCiWkGuW8UpT/Jl0kR3YL:FKuGmdQFnkGuz2Bl0kdY
Malware Config
Signatures
Files
-
c8a6c4affff832e3b25d9fdc669469a022ccecee2f111dd64e9125e159b0bc0e.exe windows x86
5ae85c96d62af97561938eabcc4c526f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc100
ord3390
msvcr100
__CxxFrameHandler3
kernel32
TerminateProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
advapi32
RegOpenKeyExA
comctl32
InitCommonControlsEx
oleaut32
VariantTimeToSystemTime
wininet
InternetOpenUrlA
iphlpapi
GetAdaptersInfo
imagehlp
ImageUnload
ws2_32
send
Exports
Exports
Sections
.text Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LieYan1 Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.LieYan0 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.LieYan2 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LieYan3 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ