��0����J��ހv>��p@5\M>ъlА]i)��M�^���ѦH�DN��0;نFI�����9֘�+w=�l<9KR�i�^�<� ���Jlً�e���pSv~�m�-�DVm菞;���YcX���Uhcb@j�;�S�aG5F�|5��*4��+>җe��_%VU�h��gƇ��[��5(���8T@I�U_[%Xd��N-)>!j��(�9hz�TK��U�CGR�н�v��n�[email protected]�*� �=Ŝ��qk�����SO�z��<,e|U R��ü�a�_�0�i{"�8��`%����%J�h&��c�������w!����3 f��yej}i˫�W}� �G�v]�KkX0���V��^qN�S����I\�!������!`>�o[�lT���i�#��eD���|�{w�Ќ*��LQm㘓C���5�+�ImxxԶf���l,$��D� ���?����=.���cA����#������J�h�g�sr?��^����`��f�k���Ӗ��l�n����� ����hv����G��%��r����9{+��2���8�W��)��ԁGO�T�k9��2"�����D��+�d��aLA/�>q���(����Ge���y'if�웢�ױ��ԧ\�̯���S���/��D�U%u�>U?��f�1��bW;ߗ`�mF �kEpj�Ã��3�����+r��K t��R�DocF=�6�� ��T���^��4����I���kЃ��H�_l�̾%@3P��� U�X@�O��X W��f}wzj~��n3��kŌ��ls����q��7�w�������S�������`�O�����X;�Krk���R{*:)� !���9ʳ\�a�SDW&F��v�K\�a=��S����-��'_�ϒEt����X����ka=&a�o#_^�T���t�{�cj��,R0$a����b��F��ɕ��� �SA4�<Vn�#��\q�G0��O@�����R���Č�Kc�����2s�N�[��A�I�|DصI5�MCB:C�p��DL_}�����O�����ZDpS'�G���Ph��F �O��*l5��M\�+�ӧ���j|:"�*Sz� �N��.W���,X��O ���_b�]VR��&�ڶ�Ƶ�������)��c���*�r�?�|�i�2l�i�І2Yʦ5w-�M�2S�c��([�V�����z��c,SbgQ���7(��e/�������D�d�$a���u\G:aP�����m[�&g�y,��'uUaI��*�\���#^b�<Bl���&��H����⋖~������LR٠@I�,@�q�~8p�z�k��O��^懜|c�]^7��5����x����_v/w��GY_#����\ KL0Ql�Š;�� �=��<���1�gyO�,f�%w;��~^�����g���*V�K@�rF/1U6đk�8�e �#���&��9t�׀,|��9���A��������Ro����LKYS��Ò����-�]��[����I�5�������h�[�B--����e�3qx�%�]I��p5|�ÆQ����v��e�nK"����Q�u/�͠GL��t�����zw�l��t:�SU9�� ��F�=(��=ӹ�?�J��� r�8��T�\Q ��ce�K_��J�ҿ��Բ�Yӊ�T�=M��@P �id��L��'��n(z�?���紁"���N��`���0W�c��)�����g��DT�n� �=��1�j��;\B�ݱ�DcO1J\�kV�?���� ��b釒G��xeAZ�x���yw�W���ZC,���S7ܾ��L�96--F�+Z-��c�eR�b@�Dp1��>�ͦ)D-5Y�I�JO��< ��"����� ������+z8� |�3�lx�Ù��:$���O��(�'4�R�����<�Fn��o9e�4oNi8����9vfv�O˺�b��3�\��k����v;���p��A�`��~�Kv�a P�pO����C�<d˦s'F9�l�P�Hy�9W�ʍ;C�R�>�h��&�ܮA���5�Bq�n�r�_J/�J�T����2z�����b�E���[�� ]kg����h3Kq����˗|���n��B�bCk����=uC�z�EGc�l�̛S�8�VOA��|[�A�#��7N���16ӠI~l3f�K�H'���~.v�~0ā�"�bh��:������p�\��Yh��_]���p��Bw^� ���VQ�߿��d��t�L)�F�U��AGRV5�] �a��Tz2�?kL����;��O��H:>����V�q諠���l�rj�Y�ѳFC�ϟ: ���%_��V����g^^�7{nԊd5Ho����j�)����l���� ��s�f(=�1���}}kX���/���Id�FޮI�𢌜U������+�6�χF5�.lA���M�TF����� l_�K��jWk���T̉�]qi�؛��Qh}��Q�'Qc[�SO�/�[ c+"v��e&��hL��2�#�73��f-�lT���@��!������~t$VE+�,��pB��- �=�%�$[Ĉ���B�S0|_���(�`��2���F���Yj����Dlj��""4_��؈1�rZ�6����]^�mad�@KOC�����ٱÛ�v����ܲ��H8\8�o��hʍǃ�߱��B�o�k�[�����nd���-�M��"2}(X���!���5=���;��ھ]�5��lAi\�;�����K+Іf[�����5�c��-�?a,0{{T�����-����T�8�xoi�p� ��H�B���� �]�i�,�X��D�Q��3�<�J�_��-��/�qޱ �ޟ7*��c��Y�(�p{�������| �X��f��s�q�A��Td�#L�Ͳ�a���L%�[�]Ur�*v��jwNe��qE�[���~�Zy�����d��2o|��V�?M9�}ԁO?}z\�0�����Y��i���E��K���p�eF7�Qz�'��M�lᛋCa�����������YZ�v[�P��-�PZ�A�ֈA����p��n��@�b��65�W�,m��r��/
Behavioral task
behavioral1
Sample
7dd4681608dd7a0fd6d942c2dada72c2321b2247927d97937065931114a34753.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7dd4681608dd7a0fd6d942c2dada72c2321b2247927d97937065931114a34753.exe
Resource
win10v2004-20220812-en
General
-
Target
7dd4681608dd7a0fd6d942c2dada72c2321b2247927d97937065931114a34753
-
Size
793KB
-
MD5
28e70131cc00f41843bb939d949a135e
-
SHA1
e66fd55a907bd8da7b07f171a437cfaa2de5945a
-
SHA256
7dd4681608dd7a0fd6d942c2dada72c2321b2247927d97937065931114a34753
-
SHA512
babe6051e570dc18342435252cc2f219c998db1329c7ad603648df295b31d11cbf05d7879073188e8c626d99e54076420db97602eb392347595f6478c7ac2544
-
SSDEEP
24576:uvabbvkaNrOoqiIa/h7/GYt8yO3D6UuKM:jbbvkyZDIaBrFXIM
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7dd4681608dd7a0fd6d942c2dada72c2321b2247927d97937065931114a34753.exe windows x86
08e3a46d5fef2acaacc349435c27f074
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryMove
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 252KB - Virtual size: 249KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ