� UEr�w�z9�Hk�D '&س�n��L>|s1��\������6���K2��4�U,B��`x�pZ0fKJ:BD]*�\([���{�������a2]��`����]�]%�{���r)v)6ƨ�����9�N���L���:�)r�����Fz�`�$��㓨z�ڄ�&�g*������8`%�������=7��i��f��U��o�Ʃ�,;h>�:8��)��!IJ�}� ���w���kf�WL���n���_q-ᣨ�E9g�d:��_�!�H�W�7������#��s��(F�dƉ:����R�O���:[�gj<Ĥ��BA�\ ��M�3I�<�j �fgp}@�ªG���8,�%y�-V�!��c@��RܢNJ{�a��SD��˜�7E*�l���Yy�+��9cǫ���"��Ȳle;�~����Y�o\��������8��ԃ� }�tc5������͋^L\�*��;����yp��R_hj�I���D�]���CP�`�-3;eI�6lne�C�ux< ��� �q�놗�"���G��.W���V�)��q�� Re'�F�Π1��h�&��̨��T�]�����06e�"�@�$����#��� s�_���7��k���[T_�X8*�t����6?�Nґ&�QO�{QU:{S����������/-�>LR��i�4�y�#z>O9��Ff��-�[s��xmA��͙'8%����9<� ����6AW� c�?e6t����� o���yU����U2�R�hS������u��)Blcn�dw*P�(*�����2tE�q�}O�mO�۪NJS1����ؐJŭ"���z�^vÈ W�J��35!��/�B��%�Qj�D�w� <�0`_gq舅o��$�����j/y��E3�Z�RmQ���L�L�Ի� X��\��on �]UR4�m�`� ��Us��F9��r��#��7�:9Y\���"0��ޑvWե�\}BD�W�P "��1df&u�д���������k�0���`�:G�� �M�iH�!�|>����P9��&L�V��y.z��J+Dz�B����m�vdR\��8e���i�خ }����5������˅Bg���rB|#�= ���H��=bt��r�"k�)��i�������hE�T��=s�"di*�i�n˥7A�E�A�A<B�������_���Ħ�X;wH�{�j%��2��B��%���ߛ�]HG:0�`��$M�U��״�� ���[o�u��1����kcR|�����L"�j�[p�?��p�s�x�P�t������[��!�R8d��F���c!�w���|����&P�q�եe}����/p���?���L8����}~*���h4�eNӫFoO'TF7�V�pO���Dv:��h �8w#<�uJ gU���$�UJ��(��` ��!����Wn塂��FGs%\���͑ L�2%(Y��F�3�$�v O#�����vA�'C�|��ؔ��"��u�U��˭�f��<��H)}��:b�ͮ?�U�,哖gFH<��yVn&��s�$K����%>g��p�{�#a_'��V�����Y(U%A��ޅB0;���4��N{=8#�l����0�d vq �-K�x5���^��="�nL��8�� β�J������6�1�z��ז����d��:>H�x������ �7�a�u��D,P,>@�|Yv�;-�E6�5�FU3��n-醢���C�1k�Fou���F���I��w|j�x)գȊP�j�=A�|�����#��iV ������oݾl����������0/ ����t1��ĄުF�m]=:�2��Q�4��9o������ﳀ:{>g����gR��/��kK^� ��A���[N�A�V��1��TF�8v�͠I���ø�`����2��a6�����"+0Lj1�r��!��_c���ۭ[2���D���L����P^۶ׇ��j��"��R'B]��_�+=���% d;VL�5���b��s���l)u��U���Q}�����������0#���(D��$��n��c��C������3vy�Ak�x{�=� ��R�u��=��`�2�B$��E�\�B�W+���>ͷ ��������18 Mv-m_���CҔ,�w�v�j��D���?�{��)1��G~��+���R&Qa�� ���o���pfO�h�0� 8� ɧ�^�:��D���Hl�@�*�6�\��T�R��A�}m�C� [#XQ"���� ��� ���o䞷��`4�I��m_k�T�I���%[��edKA(� �P�N8W���Ÿ���jG-�ғ1��,���Xf�"���R�Ƀi4Lb9������/�^C��7���tj�R�� ��{\W�=ʥ�بb�ʡ�{�0�7$�|H=hl�@#0��Ӑ�'�|h���ͺC݇*>�$�(X�(���o���4Ty��가�Lj3=���u�f�1�;2�u���o��u���%�D���M�� ���m]�����e���?�|�-d�<�-�����rLR�X��U�J��.Lc�{.~� �yW7������"��4&� 4��k��崍���.j�j�zH� t^�����7��q�0m�4���Y��Cɫb��j�H���s�S����@7��s���_@m�W�i|B��te�8�����b̰R���]!#����"q�6o��qfb �l��Ԕq�ڦ&Yګ��#� �G�����T�d��Ҟ+(r�ƹ����@�@=1�s*�&�x�w�T{����9��}T�W?sm��_�<A8ؼ&ے�3�%S���F���Zd��q�%Ⱥz�K�D�i�0���%��w�$��k� ߁��z��I[�3� 0�'���ϭ�"ÖG"D�Q FG��I�Wp/{�\�<z�[�_�]����g3�i &ȕ�وcf9���=��v�t�c[Ǎ���*-*�ܗ�x������.��Ȩ�\ա �{P��4�ڟ�X�Є y��_bﮏ>�^8_W{l�\Q����?�NP�l��K�d�.e��.�y�2����͏C&ȟ��).�����
Static task
static1
Behavioral task
behavioral1
Sample
32a91169c671ab107c9842b3eda1781762d4f4d43f81113ac0949d68e372fbd0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
32a91169c671ab107c9842b3eda1781762d4f4d43f81113ac0949d68e372fbd0.exe
Resource
win10v2004-20221111-en
General
-
Target
32a91169c671ab107c9842b3eda1781762d4f4d43f81113ac0949d68e372fbd0
-
Size
1.0MB
-
MD5
7baa37e9179287c746ca82d4c4b9e39d
-
SHA1
31ba38a565a7cb42c6493d46fbbd05423e3b8da5
-
SHA256
32a91169c671ab107c9842b3eda1781762d4f4d43f81113ac0949d68e372fbd0
-
SHA512
88737c24cbb32dfa2f4069436ebe1f4856f81349124e51e8e6777c8eb4a5a0979eb49dd823acdfb737e752523dde3dfea60fc2cba27f39b1216dd8441bd6f798
-
SSDEEP
24576:QtU9fZVzVXkGt6QObPWFfD48mWpZTLkbfab:QtUxjxkGU5+L4uEab
Malware Config
Signatures
Files
-
32a91169c671ab107c9842b3eda1781762d4f4d43f81113ac0949d68e372fbd0.exe windows x86
2ad32e85244e5ba2171081dd59f45493
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
GetFileTime
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
Sleep
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetACP
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FormatMessageA
LocalFree
MulDiv
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalUnlock
WritePrivateProfileStringA
GlobalFree
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalLock
lstrcmpA
GlobalAlloc
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
SetLastError
lstrcmpW
GetVersionExA
GetThreadLocale
InterlockedIncrement
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
ReleaseMutex
GetTickCount
GetModuleHandleA
LockResource
WideCharToMultiByte
GetLastError
CreateMutexA
WriteFile
SizeofResource
LoadResource
FindResourceA
CreateFileA
FindFirstFileA
CloseHandle
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
OpenProcess
ExitProcess
GetFileType
GetModuleFileNameA
CreateFileW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageA
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
DestroyMenu
IsWindowVisible
UpdateWindow
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
IsWindow
GetDlgItem
GetParent
OffsetRect
PtInRect
CopyRect
GetDlgCtrlID
GetWindow
CharNextA
CharUpperA
KillTimer
SetWindowPos
SetForegroundWindow
ShowWindow
GetWindowRect
DrawIcon
GetClientRect
GetSystemMetrics
SendMessageA
IsIconic
SetTimer
EnumWindows
wsprintfA
GetWindowTextA
GetWindowLongA
LoadIconA
RegisterClipboardFormatA
UnregisterClassA
MessageBeep
MessageBoxA
EnableWindow
GetNextDlgGroupItem
LoadCursorA
GetSysColorBrush
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowThreadProcessId
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
IsWindowEnabled
PostQuitMessage
GetKeyState
MapDialogRect
gdi32
DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
ExtSelectClipRgn
DeleteDC
CreateRectRgnIndirect
GetRgnBox
GetMapMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetTextColor
GetBkColor
GetDeviceCaps
GetStockObject
GetObjectA
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
advapi32
RegSetValueExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptHashData
CryptCreateHash
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
StrStrIA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
VariantClear
SysAllocStringLen
VariantChangeType
VariantInit
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy
OleCreateFontIndirect
psapi
GetModuleFileNameExA
EnumProcessModules
EnumProcesses
Exports
Exports
Sections
.text Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 608KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bfz0 Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bfz1 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE