� ��?��O'b�RE�n6����X�~�`�x���!e��v>l4�LQ��+�a��h�O�"D������諞�7&h�A�K��1V4 �~�N:1�h؛�1�`5���*�˔��\X�;ؑ"��Ȫe��A�XY۷B�R5�xL!�`��Q�PU��qN��TD�O�����U�B���vX~;�"cU���af��`y��f�v'����:��CZ����$(�y�Z��%���/D�'��|B�rvU���� ��{&9y(���?ʭy"����&�Uc�qk]�<z$G���z��+�7�m@��\)�G��(��~ujUЗ`����MP6�0P&fU}�]��s��UI�H#����e&$o�����|��P�r\�������B�$ˎ���t@� _u^��v�;�*4�ks�w��~�dciU'�H�`N��:��'y�z����6HȂy��幐e�WM�U��@�ղ�I� ��-��%��_�F�����- �բl ������#�]h|T~D>ە�?�[ű>j��$g�M����Z � �hz�V�C��M���ӷ�Ʀ�`wz�z�x��R!���o����h���d`U�*a0&/��,��{ڸ�%����9�v�;�2� ��<����[��O�`�I�)8}�����.����:��9��l��� �$���L�'�<.{(��������ڈ#��>����b`; �c!`�����b�fJ�&;�*ڞ����e����ť�u?�{F��h嬘渧%�S&���ٴ�4e|�}�\���J�2� �L�����RO!�U:3{������5���md��x���fQ�I�s �áئy�#��dg�Xyn BˍT�^ S�s܅Q�x�,���;JvW�fb��gJP�c��w�T�Q�l恔 yh�^ 0��5P�Q���≫�T�r�&gc���.��l#F$?JTr�u���˛K�Xa�ex���q���H�/�&09�]A��l:�y�#'.}\v%Yȸn��5�U�矀���K,s7�av���b=TĂ%_�5<ɹ����:)��/bURڪ�4�x@n�S�W�N��uLq��0c<������G�����Cij�rD���ݣ��H�*��\y�7cD��z��= Hi��*�D�g�G��k����<�[+rA��L�k~�M4��^��'7Psp`�|����'Qѻa矙y�,CU�j��� �EH����_b��A���r%Wj���ko_������lj��7p�)�84���$���_��(H���ѪI�����Hwvj�T~d�w�z��6QT����po��Jq�%P;��vּB6=`�o��T=�6Xة^������ �H�x�]X�L#��v8���,���t��⡰����}���e$�^˾-��:;SA)���&�)e�/�M���J�X)ژᨳ5����Dˮ������b�����m�O����NS07�H�֞��5W��^�%w�k����y������C�ͼ-XS�}�&WЉ�|�}�=��ADB�y��XM�ў�-Ij��_ljR����)7iK�c\{�f �2�K[A軇�)f@}Y���� ��W _�E��{{ #8�E�<*1Mh~�ɀ�w�KG�u �x�6�]hPF��rv���BDL�Sw���l��L;���8)��o�������cMIY����yfX�E���&�� Ҋrc���� `I`��i��ik<�����`�;���G��U�ڠ5c�"� ����b��v� ���� ��t��Pv{�Ic�+�L�kB���)�q�A4�V���̡�ʍR]o�\��ι���ֻ���e�U?;6��iU�N�i���`�����N%q�"u��Ξ!�<F�C>�;�U�*�I )�� �ϲ��s��Qc�w� ��<��W�ȿ���c�d3���&bs˂K��O��?9L���e0��G� }� �̨����!�/S�������L�6�����s���[#�e��^bJ����� �����B{-{��O��M�q��I]�����[���j�bo�5^��oOO�mte�I�t�<+C���OmdBC6|m�-3I� ���C`��|][z3<ˌ4��*Ĵ�����2��S-�&�R�!�O>�)в���^H��4��w5� xn<[w7��(\��~=���{�� %���JonHp���Э-`�TЫ{�p>sMPm0���|���o ���(�$��ry��`�(�.�,ZZp˥&l�ޗ;�Y&������0�_1���$S�b�Z��-���~�z�B���_������֬\Q�y��$�e���x�.�{<����O�$���=8�-�h�� R��pҩ�H����˵��.�E�yd���܂��>_mx��<�Y� ���dS'���S�@�j�g��B%�5��x{��������U��E&�w���#.j ��/�����-�9\����ʏ6V��l�RXW��?Y 7���5�J4,�c�TV�?X>c>Gy6W���ʓ�tT/��cxG��P��?��5���T�;Kܶe��)���*�S�J�����X�M9����[�����ؙ��*��\�9��Vq���\�����㊪V�t��\3��1��/+�eQ[ȖK=|���b}{ůY��I������\d���v��y�� �� ����X�y��#���Xj����G�D#�����TV����h��ܗ�a3OsL�z-�����5������=�%n�s�ӄr;�����6']T�~z�g�_r�0o�1B,�{�M"��:��-,N( ��`����Om��ϼh\�vf�G������3vX�h�q�߁��)b�?=_[�7 ���_9�ʳ�[yE�Kp0�_�a��!*R=)��{��!�l��.�S�U���<�-�,��=_K�L�G�U�F��������[ Ejg@R�mff�s���k���,��W��pd�@�yϐ����.j���w���wECyd��>�F#P�GM�!�A[��f�P�Y��>��l�C�y�L{����H~�f�t�h�ݒ�KڣA�L�� W.�s�J
Static task
static1
Behavioral task
behavioral1
Sample
320b4d4975522ced82f400e124f79da7c4013b911d27b443e8f2fa568fbd0ff3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
320b4d4975522ced82f400e124f79da7c4013b911d27b443e8f2fa568fbd0ff3.exe
Resource
win10v2004-20220812-en
General
-
Target
320b4d4975522ced82f400e124f79da7c4013b911d27b443e8f2fa568fbd0ff3
-
Size
56KB
-
MD5
e6812282c50dbf8204c20e73baf8c47b
-
SHA1
90fe80859057ddf6c9c25780bb83d07155672650
-
SHA256
320b4d4975522ced82f400e124f79da7c4013b911d27b443e8f2fa568fbd0ff3
-
SHA512
d62b4b4d9670e40d4f368921be6ba3634cf300ccefbcfa0b96b8149207074f169c2fd1ca1231e094e69148eef9094fd45a6ec3a2f2f578d7f5c4b0188e4cf28d
-
SSDEEP
1536:sHin3MaIEql5DVC8U76dIoiYQEv7XnKl3Z4A4wfz:sCrIdl55DUWqoiYQEzXnoZ4g
Malware Config
Signatures
Files
-
320b4d4975522ced82f400e124f79da7c4013b911d27b443e8f2fa568fbd0ff3.exe windows x86
efb15bd0be8fad956444fb0c177c9349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
2 Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ