�/�7��x�s��t��U殣�Z��O����j�gHc�vN09R�Ts�Pt�a�=� B�?ty�,!M��g�Z���(���&{��Q���2���gZ"A(��v������,=,��⫝̸ca"���+�� ?$^����hە�1R�;;��"��OM�[���Ya��N�ufN>���p��&ð��i�I��r&�~���KH[��5�ut��mѬ�y��k���?��bg�ޏ�K*B�|���26#M|���7Y���̬�<=���ԑ�Ҙ����6��V&߲��d���5Gc���,�i�Q���AX��z�ynM`��¡����@Ӥ�G;9Ư1���8�(����v��@dwr@��f�M�L��a*�ٝ�%|�Bo�T����"�0��Fc� Lv��v����t����i��\G=g)I�� ��Ҵ߭率��7UQ翭d�j��JX�"���~�R=J�.y��+���<b z2�'��6}c*� @ͱ�kC�2���T5�Κj���A,+1��8Ys/N������'ID*Կ��6M�ﱒAT��v��������H<�.@��� ax�rs����+�[���k�t?i^\�H�Ѡ�1�:�Tf?rؼ_�<"�7���]��I���vX�Uv�Ä�����b�y�k�m�����,���D��T�ӆ|�IU��I�T����ʨw�y����=�n��x�j³h�> ��g(5i�Qt1�xL��B?����}��\-[���ڥ��ݢ�����i&<�S.]��p��?�?aIwu��@+ R%��]̋�/�ٽ�ϝVÅrG7�FK �:�sD:����o��4�P\�ƨ��(��F>��FF��Z���x�K��A#QT\�dm��<�H������9�u��|�u&�+���Q��&��(�o2�V�e]qv0�p�z�`7�d�D�2��g�`�b9�Sφld��h�׳��q^c:0��W����`�iiц)�>���Ztŷ*���Ѐj��E�Zs,�8o����\��J�$~p����55? �_,�ڏJ"7�����a. �|p����F��� ��md;K��Az�r����� `��FG�_܅��r���g��λ���w4�9i�~����#�:�%nx|ɝ�x ���*)�:``��ݚ)f�����,e�2��,�� d�g��,0a��~�����}��7�TD$����jUf����Њ����&I���Βx|xd��N �E.I���y����t!�!�m�c`o� d�{�ʓ�ټ� ��K���iꂝ�۹_,�= �HlRV�����~��[N6����{�]p��pHa��91@l���0[�m%PO��L�<�zX2���`V�����s�z��r�X4���^��D�b�]�6�^�ĜWXQ�]��44��8��Pb�������ޏ�Ll��I��(d��WfA�,�a ���v���5\��i7��?���)���M%~*/�W�����-�(d�V���2s2��Ẁ�>�g c�>R���ڋV��w��ukΌֱ>�,��s��e^�5&%��NX�1���Oެ�\�8��)��J��7\��c"� ��E�Xv1�����t9�a�s�RUT�I��K���i��ɼq�[�S����<址�]��Y�,�Q�����\�X�*+�O3�H3#�+�]���]vP�R;��{������',�q�fX�QI�q�ELb�F��{�t�R*U�R���p'T4�R�B k5�uF�^W|t�'�qolk��Q�Qb����,G�5F%�$�[��a���OAq��������ə@9��,^u�KXa _��#��ڋ�1�� �| �h�h���ȝL(�tI/�k.�>�^������#w���Mi.�����]�t?���h�D]�g�D_��Ǽ�b.o� "��t��Mx1���������e� _6��`��RA_��~�j[���q��Ϳ2���e~0]�V��ܦ���AS�$�+I�s�#1����q,�O�.�b�����`l��2E�x�m!��ID�)�X0��t9x}��~��m�56�R��e �¢易p7��4w�SGS�@9OPL�Y�D ����(�i��h� �|;BR����w�q�K{ �e�S�R)���;�3��$ߪ%2y9�4֚d�n���5�+ѧS��.o��!A��C���ת+��Vz�4E�!�R��N�d�1\�c)�˒)�į��Y�N��&�1����)杵b�/;/��E��ƺ����mCȷ�G|.�>�� 7�Y��B+ڡ����L� ��ѹy�L08�q����6�'����g��(�M��t�Dd��Ng�=G��pI���O�yWo~ʦ�e8H��DFКSp����ʧ+��R^�{�H��vI��\r��-�%Cb�+Q+=k�U&oBAE�#��k����z�聕x�(�w;.g�YT��Nh�����]�`ظ�sz&n1T����I���$9�-�) ނ�Z�lo6�,���1�~�����g�er��_#pf�f����G�K���J�Ga�����9��G�gO�ߢ�/9nm�A7�,MnL@�<��v4����TS�ƹE#�0DV��a��j�������m�КqV?�f�z�A�� �xy��+5Q ���;��-�@7�O0��ʱ S������c��h������%�L��s[���0�(ThL�J��?]ZyAG�ˣ��!��L%�L)�� �@9�˰���p��WsBg��L�o��X���H��}���| GU~�p�+�W�P,>�c����֕�Ȳ&��Ӆ��H��D)��)jQQ�9�D�Ձv+�wV{+�ӭ�\���= c���Ϊ�w\f�����y�����dv����M�-���2�W� i�[ ��*��ʡl��[1���=(lk�h�����0�0�z����1n�}����lA7��]x3�m���ƫN+��{��-$��������V��t������s�1>ɖ����I9�� -�@��L@�wռou�eƿ������dVW�͓:�����4�q��9e��wW��q�S��aʂ�i�qv� Vei�_W
Static task
static1
Behavioral task
behavioral1
Sample
94b79faf1b28447b5dd36956c574a2839a55e99ffd2242a7a25d91880f9e35f5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
94b79faf1b28447b5dd36956c574a2839a55e99ffd2242a7a25d91880f9e35f5.exe
Resource
win10v2004-20221111-en
General
-
Target
94b79faf1b28447b5dd36956c574a2839a55e99ffd2242a7a25d91880f9e35f5
-
Size
2.0MB
-
MD5
655f8c7c7a2abfe9a013347df600f751
-
SHA1
d42579397091318cc486e46266408fbc5abe84dd
-
SHA256
94b79faf1b28447b5dd36956c574a2839a55e99ffd2242a7a25d91880f9e35f5
-
SHA512
90dff773e9617fe922eaeba3b443667a378bf0734b60c910d501f474b0483c114e4424ca23212dd17fda48fd63ec613e9541ac4f92276fad58672da8c616932f
-
SSDEEP
49152:DUgq5oTkqfoDJeJCrq0caGB/9nvork0bVpwjY+SgvR30aQXJd+UOAInp:DbTuekwa8lgrV8Ylg53GXOUOAU
Malware Config
Signatures
Files
-
94b79faf1b28447b5dd36956c574a2839a55e99ffd2242a7a25d91880f9e35f5.exe windows x86
0c3026a8941b0f527540d0ad90e44793
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrVarCopy
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 943KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE