8�T���Z��dBuI��Nۅ�R�h1�ЧY�8��z�V��4�����쮟zЧ���4�����,kfq�'d _���g��%�*n�<���D���*3��l1s���tm'#�i�bu����YBL\��)H��sH<���Q Y/���Ň���*��t�>q"�~��M��U���s�c�cV~�>���̄Mf�H�s����2�oü �j�+��h��`�����=�c�3�Ciϖ����8�/8�Sk9U�_�f��������$o`�Dop1ͱ��!SUt�CE�"��P�c��(�y3�"_�6sy����n�w >��J�Ug�Q8iG��z�a�G�t؇G��2�@�{���Ї��kpz>��8Y�"K�c@v)1��F��8��Ja}��;Mȅ�(Vc2�H�#^B�[�{��P�����+'�:�n\��;4��s�� i����>���&��MX��ZKvj)D �=Q�@�ֻo�͐ y:��j�nV��?�C��1<�7�eA����� Vw������7��li���_q���m�Bղnl %z��O�{ġw ;9���%,���<�kRp���l�It�r�$٧S�Sh�^�3&���M�Ω�h���bEMI��OwЇ�>Jx8�?:��ȓ0���ђR�8�p.�nI������D��Cĭ���W�!܊�N5E�E����a�.&��ƦX�(���� [{���́��������H�d�ط��]N�_[y�!��8D&���E�h�$�w�T�/L%4Ce�O���]�����dB��|0߿nO���48�� `�?2��1I>�GZ(�������?��P�f��T�k2�9��r`6���HJp�?p;�҉�N~$5X�^~�:O�NS�ժ�D"��6H;^�/�b�.���џN;8ݍ�I���L��-A�3]��,�I��ӬPݓ���fw��{x�fJ����_����r�~F�FF���܂Kd"t;��h�?��)x4�`�_Prsa�K�&��j��'�w��ly�X���HD��엹ϲ0��˷ϓbc�����'�Q�cG�!�5 #��GF�v�A9�ܾ�=d%�+��Λ�*��(��=����^��ӟm�W�0�o�R$�}��������ZD�����how+|)І�=�vK�*�S� >z0_�q+�"dw|1��^6X�'� � r;���~�R]��9���"s'����&�/홞\$�#(�.�C�K�y�.�+���,|P��[�.��U`qb���B7�*����z�������F5���.xm��;�q�ڭ��*,�V �S'tE#M�OI>��ڦz��k��#��x��?\dᤊu��'���nj��De:�eZ���w�tV�ZM�妐��k܈��*�nFo̔9V� ���Љwxig�1S�6b�Ν�T�@X�Ş�c���R���a�I�S�m\ ����R��������//����O�3šԍ����6r�Z�/��"�䃛��}��+{#��<�*�#��)�� <�,��$��{V&v��%�����0���ʖ.q�铚r�GN|���� x���e�=�]��mMy�K)��~�0�� �fm� qZ. Ȁs��5p�'����G7�T��$��[�6�>N^O�!�:CU� �˻>��y��!��Zl� 5Xu��5B!�J`��2�w�f ���[A�}�"{YHd����6}{`>�B��N0̠mڄ�Z�i V����Y3u�5�z:�R��Lwi5�-#^~���m!}m����_+�v����z��9`&�%F�c�nq�De+�a��a@х: �� �������$t��K�zwr`��&x�a�&K�K�~/mg�3V�&����آ���<���onF�����+R�P1>�Q����J$x��8�lL�=�Փ��խr^��ܠ�Y�:�̙ټ��8���Sr+�b�Ŧ�OS'����%j��(,�9�.Eo�Sk�\X���"��P��@�Ua�u��oQF,�^g�+��{|�4�z�ݻ����#��(V��*q�"�p���u���D�"ՙ�[��"�~��^4$L6�e:A��h���83��T���s��_��3yPy0�=�{��ez!�$���[ V����᭤�ʥ;*���g�y���i� p�zTJ��,�jdR��p��+ӊ7�!;a6a�7%y(��A�C�3ǔ��zQi�+~ ʰ}�~\�S�ŗ��d�����c4� �K��%��E�+�v�,϶����&����áݕ�K�T!� ���J_q���Σ���;�XL�ꢱE� ����+]Q��C����:�(���Q��q�'y��Z(_�n��~�Q�|��wv뉮JxN:��G|�|�mz=k>�����ȗ�բ���0v��K/�E�w���z���r��I���.t%�*َ�,�>�^sdY�p;���:�פ�il�@ѧ�^����b_�Q7���e��c��d&}:�B�{�y]��b���G�sG koy<��n3V���hP�^���Z�P9��� �u_N�|07�=��{��oi���Ծ �w��oQ�/1"��!o�|V���65���4��[����ѣ���b�h��S�mI+%���?�4%%�< �2�V����&:� ��I�Z2�,ԻV��s2z&�6ӸV�ASjR���� �tg '�w����V̞���VW�����S��0��M�N�A/D��BU9�U)�p<+�>Oub�ŋӂ�a2�L?��BW�FS��l s���yK�b�A$^Y��j�`)�3�4!�wOf���W;�@R��d�Y ~���r�[Q��,_'�%���k�%r�C�F�h�Lp8Լ��S���T�����d���I���յ�����!X�;g�-���Q������$_������<�� nn2����/�N�@G4P��%5}Lw�~I�+��B��o��xP�L�.!Z�%�]���&�H��f^tg��Y�.�1�Wp�2� �2I�[�$���b�*�3�p���h���r� ��P`�� �����(O�v����.#����2��.�cRFK�(������
Static task
static1
Behavioral task
behavioral1
Sample
e2747670efd5e7a2cfdc4f60aabcdcb0c1869158276ee7ab9182968a4bd7ddec.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e2747670efd5e7a2cfdc4f60aabcdcb0c1869158276ee7ab9182968a4bd7ddec.exe
Resource
win10v2004-20220812-en
General
-
Target
e2747670efd5e7a2cfdc4f60aabcdcb0c1869158276ee7ab9182968a4bd7ddec
-
Size
2.1MB
-
MD5
77c670d849fca10d972ec0900fd872c6
-
SHA1
d589be198617f6f0ac449bf5011f2a087f18a192
-
SHA256
e2747670efd5e7a2cfdc4f60aabcdcb0c1869158276ee7ab9182968a4bd7ddec
-
SHA512
da2874a9d60e0795ed152144286e4b6872d8d131798d140b81a15636cdf5dc09a0b80f893ee062763cb7237072ee89d83750846f2e837500cf8eabaa1f4cefa6
-
SSDEEP
49152:cXgGd2oQDuXhCb5S18h0zKx/gu/U/Q71GA:cHJhc+8ecgu+w1G
Malware Config
Signatures
Files
-
e2747670efd5e7a2cfdc4f60aabcdcb0c1869158276ee7ab9182968a4bd7ddec.exe windows x86
77ccefa410a8099b306281ef72aed508
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord520
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE