�:�wF��z���!$Ӟn�f=���>�7��� � ���KM����V�� ��TC��r���3H��GfNA��`�9=�E�N�7�$E詉31��Ȁ����eb-G-l��y�L��j����Ӿ�x`�ЛsBˀ(�� 4j"�鼞����_�ޒxV5f%z)Yr��%�* %O�.u^E���m.��.TD�8�-���Z6�N�,U��w"ٞ�_R�MN}]���7l�E�P��c�<t����0��1=y�>:�|B�l����� �dK���B�h����Z��y�a�gA'���oM������x#9��>t?��Ï.;�aA��{6x�{��3(>y� �tP���C���#�[~-D����U,B���?�4����ⱘb�Q����X6���TT�a~�2�tԌ��J?/"�n�r��D/� ���.�K�{��=�]l�_H������2r5�?��p�ACҡ �R��/�S��e�~����}E!�]�Ϙ\Ĺ��u�i�C��O�I��t���6�Z�D����b0%<����a-'�]�����������a~s�}G���(��3Z�ÁѴ-�v1ʄ�3o)t� ��>nu�k�B!� +Rg;�����!�vg6���L�X�9K)v�6ەC�2*!%+a�m�� Wz*/:\[��<�#�E�)��+�����O�^N�k�cLyq�A���(�XnE�K�z+��a ���̳�s�1j��e^���,��i�fh]rv��G?��)hBW�j�G�&���>cF�=].t�@a����#ܼ!5��݈,[ ���4��?E�iUʉ���ܱ�h�����W0���'Ԩ͵J.�V���L�ξǮb��H�!gn9�ߜJ$�U��[����,��ho���[����������J1 d^>���O"��P�܅̒��X��{]OϺ����#���H3�������X��0�~�\����\$'y_2̥��$���<I�J��Fn�]R-�B#f�C6�w�p�u�c%���t� �g�����A�U�Fa��Mh�O��! J���W^�!���(E�7��A�Cx-�{��U+F�a�P��p�j�[>�_�)a� J�T���N�jO�g��1�����W��v�я�- B�|[�b��'�ҷ�L=�/��/���P��W��幋��U �]z��cѡ'd��������g�zO��;p ��^�R��7� ۑ嬙�pJ�Y�!o�y�Q�����6je����7������C�Ϋj��S� @��ckσL��/�3�-A3��o�K��`.>�)�V#O�+��a�6i�yr��1q*�j��� q��?��0։2��W�;�a��1w�V��ו����<�/�<�5 ^.�r��x.��%g�y1����.n2��JpM䴢��Y�9�i�=[�%��G�"��G�M;e�� ò�������0�O�G�u�Ў���� �8�8���ι_DX��,���e_��(z�Z/^��������j0�Y#'�}�A~^�P�j);��*�%��{�-�4�5Mt�F�3KT�� Ϝ��F�Ov{6�.'"���J�� L&��"�Z���V;A�.����Iٳ��U�`1��F�����I#���ǹ7�P��s�����m"��a���|aU��!�^�!Z��6�N>�GY.��0Q+�n������`����k2G�R�����#m=��Y#�9U"��]��v��a$E:Ab/A�:���s���to�Y���{�H���B�� ��m�#2ς�v�IP�73������ր��s��f�xv�,ǽ�c R���N�P`�I0����Nw����Z�ˊ�_-Ro��&8����,'�� ���Oyst�|7!�����,3�G��r ��$�szZ�j�����G��~V7��V��Y��&�j�p3�cM�W0�<|��/\[/����i�YNT<�3�K�_��G�=H��7t����SW,oM���((D�[ݴ�9�_FW���wD.ë���/N�։�v귲I�������z���6D���A�L���� ��zae�A�:�� ��uGI�lK3ĵV�.z��r��d��b���Z,�A��R�*�~���U?���x��`_ބ���L2P��UE E�M^Vx�E�7õniQ($qj�������}|9�R5�!� ���t���������ɶ��(U��]'<��zN=��nU�5˖0����H�\�Q������!Z�F])#Ty� ��(�7��+ �U�3uM����:���B82����q����J.' ���{�}�Q��ko�vicq�X�f�����#A'Ås��@�Ǜ����֏�}C�T;���ΐ��I�3H�G���]{x��6q�Sh���F0k�l,��v]�A�B�LKR�\'o�w�54c��Sqӂ�Ho��̞���P��6}��[7sC�u����0���۠���@���, p��H�`�r_�d T{^dZ���X�h��e�m]$�uN�sv3�b�ODx�}8oX���\��p��WCd[�yGr�\�ĺ=7�m��wy)������:�L&��,��ȜE���v���Q�Uke?��������mcć�~�K��X\Ί��L�nW ���C�Q������r�L���_�������M�����+DP�DE�,���} b��ԁ��V?gP9��;0�걌)��I��8}�6���~8�q�.��9���Ԉ��\9�������ۀ�A|VWä���5�Mi2�|��Z�P��G� |����*Ȭ��M��v3ْ���M��|���`�j��9��O��k�����{�f��rp����f��PR�[�aؼ�g�F�E�V:nE��5bN�T�x�7�W�:zW_��AMq�&�������_�6�S�캢�V�ou]1������|W�7����|�^���Z ��#'N�c�l���HK��t�������\�'j�?[�Gm���B���>�[}�:Y�S����!i٫�����Q�7�\��qU�v |�fz\0��M��ɫ���5��/��z��(J2�%��S�.BX
Static task
static1
Behavioral task
behavioral1
Sample
a9bdbb6b903126b82e3948f87001ef99e7cb6edb897ed37014d8783a9f137906.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a9bdbb6b903126b82e3948f87001ef99e7cb6edb897ed37014d8783a9f137906.exe
Resource
win10v2004-20220812-en
General
-
Target
a9bdbb6b903126b82e3948f87001ef99e7cb6edb897ed37014d8783a9f137906
-
Size
76KB
-
MD5
4d51126b7731e017b216a81e8102ecea
-
SHA1
859a40e29a04b7fbcdc813313743048423c1a732
-
SHA256
a9bdbb6b903126b82e3948f87001ef99e7cb6edb897ed37014d8783a9f137906
-
SHA512
0ea760dfce505bb1eddb5f37fe89b266167a3dac342dc6463767a01627d44e15d72f59d93d920cab994622e54ec47f64028128ee53f949b6c1f9f14b6dbc22c9
-
SSDEEP
1536:V78g72EnvwnRzes6q4Dk+llQk0MWUqsVNIi0FlyFMEserJsP6wfz:V17NvwnRt6DDks2k0MpVNzeyCE5rJQ
Malware Config
Signatures
Files
-
a9bdbb6b903126b82e3948f87001ef99e7cb6edb897ed37014d8783a9f137906.exe windows x86
efb15bd0be8fad956444fb0c177c9349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
2 Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ