x{���� E �]�Qh�2 ({�0Ӣ)�4Rt��<�某��a+��fE��o�pa��Go�b�E�����e�#_�oT�)3<pT�F11X�!I�ә]1xFv2� �F���.^�Ha�X1�.#/����/ ǰ\X �>O����5}|T��RD͑'�6����&'��b��K뱥�7��Z8�`u`��MQ�E���C�ˎ-�����EmT�\����^��쮛��z��3"�U���;����G0� ��&�"#`�뇶�J�mk����e�y}-��+����D?g�x�B������#�"e1� ��VHs�|'�ʸ@���ѥL<��V6%�un���w�L�8MfƁ�H3�^�65Oh�����f��õ:]&�'�Qh���=����5���u)��V�̑���g��<�xʳ{X�����'�>� �%;ai� 8��j�K���R_,r_!�V������Ȟk״��Pts���b��A�^?��P[��U?�Qz��,�x��>�m�y��V�x�:��.���� E���H�^GNֹ������C�g��s�5���,�!x@QMћ�� ��j�����c.H��0�_���`-Yl�DCn{Ni����K���*�l��]�����8|f3�|����V�v�b^�3���/�WZo���4^���3�~�e�ӣ�i��,�yDs;Ci���` �i]wd\O.��gu}a^z��Օ���H�b��UH��bW� �K)�0I��2��*{6uUJy�����A��/��������?�� :9���Y^ �Q0�7�%z�L���AI��^�������=�U^<<����,�1��au�C��e�dЬ��,.�*2���i$j==��`�3SR[�Lz!�:mT��12�СgS`[����,���o�i���D��{B%�R�EB��'D�#��'R%��|Ȓ���E�bݠScGz���ѓ����u��>S >�Y>JB�UE$R�u��a�4z�X�P��͏ԣ�'����h,�����i{�Q�����Ō���Y5��!������0=����_�����g�wndO�w�9�D���wL�8}� ����=�!d��QG�ҋ�s�����K.{b´-�&J�w(�H���vǑƮyK ���;B#*��E.k���b��O0 �=��Uҟ���G� �2L��= !mG4+ &vX#>���4����EȨ�����DeWtJE���g�[�lckE��V�P���GCc��U��Ф�D���xЀ���፳�v�K,�n�8k� ���e*���+��� ��0.' $��#tϟ��w���b��z�Ā�o�3c�t�+��,�R���&� �V����g����vMD9�N<��6`[Lp�EX:�h�G����� @��]��?W��I4�bhԲQY'�gD���!���"b{8vߪ2�'��b4�᧧� {��ܼ� ���z���nf!y���n;Q�A��B�p�VU��> #�lMja��VURQ��B����X-=��36����G��� �`��ѳܐ���<�z�1X��#�������a�7*���Hn������^�x�����]w��P�:x��}���6�Ĝ`��9�V�E�x��a���h����Vx�O�GIn~�hJ�"?Z���x��k�=�Bu���~ DsQ{p�hD>�C:���<� ��.��m��2��L�w^���{m����i�IO=� )�͞tYZ�>�����l^QHeT�9f@�N���\}��<N[�e�I�k=tﷅ�E��%å�����xČ ��)Ӗkx���QH��bڗA�v�nیS3���m��oc����l�d�ꝲ��}F���Nԧ��舼+���AQ<s=�Ou�M��9�zτ��1�_� ) ��b��7�y�?.�1�z�NڍW!���9�&�Ѳi �!�]V�a�h�2��K��*M������9%��*�AB����8P����-�Gy��"rb�R���>v &H��������ण~�Y�Gl���D��f]�z�\�R�J�Փ%�y �Y����!���2�Xc���a��]�����_�|���e��[>;ϳ� p�6���Ii>�t���f0X[*,lR�Q�m�fe��W,#���{�${x-�}tE�X�(����i7��Pf8h~g�k��>2D��᭕4���>q1�nj�XT����� y�6�� 9��IE8���b}J*���@�����OJ��\m���%G�BA6/�1�xxKRh��Bڊ�(�Q�@O�h�a�����|q��2N��Ew����Q���es��$E~��ZV�f �J���t8Sda��W)e�SUZeO g��M8Ւw�f��|�6��Qr��3��S{k��U�Qxk�;�-�-*��"&q�tw�|���p��|�GR��U���^���1m�P{���� 2�9=�|]��'�(. �*E��ڍ�7�:�\��s��9�J�jg���'��`Q�ؚ���^܁���z���P�g#�)�}�'z�Ka��֡?3.���M�B��������T^��P�;J��Ӫ���F3�,�G7����ֶBF�P�J��3ڐ)������'~or(C�L�Y�}���,���� s�X�����K��z����fy��^��l�`��Ůe&��� س���e"ƻ:��N���j$�1����<]t�jhn/�A����F����m���U���"���^���wFG������H���d>�A.t�p��x�!)��H��ѭ�|x�8 �����������c@j*��)q������6������ ����R��Jb����p��)�)Z>*P5����Ιܹ(L�&�����l\�eoM��J����Bj��� !� ��&1O�� )���uy�┗BX� 5��]��/�Цӑ�L`S�A[Ue��\���|�sIX|���i�8~�'�/W����3�x��I%Z��)�i)?����@pwթ>�Os�c5]�y�>eU�'�l���Do_�7�{����P�(�F��[���
Static task
static1
Behavioral task
behavioral1
Sample
edcb370737db1124ba80ce265ad0cbe9271171a5399660b9032f017597cdef85.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
edcb370737db1124ba80ce265ad0cbe9271171a5399660b9032f017597cdef85.exe
Resource
win10v2004-20221111-en
General
-
Target
edcb370737db1124ba80ce265ad0cbe9271171a5399660b9032f017597cdef85
-
Size
1.9MB
-
MD5
c033052e809bd38175608f785f3c74c2
-
SHA1
e90ac55a80607978c07697778cd69b05e2ba0afa
-
SHA256
edcb370737db1124ba80ce265ad0cbe9271171a5399660b9032f017597cdef85
-
SHA512
88ccd828e58cc4ac3c3915386e91dadae997aba2fb0ca1cebf79ad5bce62157ebf5430832e166d07a470913fd8cf71e7c0b0bdaef3a06897517cb13ee39cbe1d
-
SSDEEP
49152:wpRt/vcIgc71DWyLuRGxOdCIYpzOF/HUaG:wDxvWM9nl0Ypqs
Malware Config
Signatures
Files
-
edcb370737db1124ba80ce265ad0cbe9271171a5399660b9032f017597cdef85.exe windows x86
fc76a56658737828224962705d7d8b01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutReset
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
ResumeThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemCount
gdi32
GetStretchBltMode
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
DragQueryFileA
ole32
CoTaskMemFree
oleaut32
SafeArrayGetElement
comctl32
ImageList_EndDrag
oledlg
ord8
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 716KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pptq0 Size: - Virtual size: 980KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pptq1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ