"���h���!�;����X��I�k��jX�����_t.�X��L��T�i�l�������T�+����7,�Nq���eG�yLл gY%$���sa�q �>���(�9��O��r��D�f��� jOu3L�J�Sx�R�]�M&�[X7��-d| �r� |�1�[� �}���S+��UwK2�W#'����;�9��n�u�&�OUK�iO�Nȡ���pϛ!������Z���N�&'����*��c~!���^G��uc��a�a����Czȯ���V�P�-� ����l��Fs�y���x��&pdǵD"�U�%X p��F�M�0yt^��Urdy��T�iY���aB��sp��:�(�p�=�ea� �Nh���듑gA��u��6_�$���t���F}���q��lT��E��=��4Ïɥ:��6i��>(��.z��zVK'��u�i�V�F ��S�_���'�8b�ϑ�������=���#IN[D�����W�c���8��Ma�B���s{R��K�p�U����)��q� �E�2������v��t��h�յ��U��TZ���T��iO�{z֔T�=�|�6��u��ъȿ �� �3�L���)^��%N��"�'�������\�m��1 {N�J&��4��zX�M�.��j�{�O��0\����x�5ׁH����)���%B`�4w���� D7�rQh\��fVDqFr��>�W��s��v��z�pE?̔�|��<`K�'&g�U�pS{��q�yv�Ն4�������J���`DB $��c�m{�gM4����7~������߰��7�LUH4J��PJ��F�F�������5�D�N�A0iO�}U�*+��6bTG�.�-O�#1]���R�������I��x9z��!�БƁ����j�n.fB�Ԉ��[4���/��0�4���UG:cS�!7=U\=M�}E�����D�r�,e� 6 ���+6D9'S��o'�n���Ȍ�>ʔ�K�=dl{�*��A>M���y�`E�/�V�JO=MB�w2��j�ڮKU{�C����,��Ϫm�#W��r�nJ���Kkt�SQ�1OAa����H��pɦ�H}�ͣ����WR(|�U��F��<w ��c��蕱�`�&<(����ek�ba�"���]�s1ۿFr ;�'�ƍ62"��>�MݻJ�-����*Q/���f��Şlc��볧ɖ.���$�@�˫s�s;��s�P@抎��[cgIe����� +h� ǯ�sݵM��~n����C8�,�Ԃn��XLD��Q#�cU���[�Ӱr=�u7-���D���*(���ظ��,�Nw�<�����! ����w W�^��b�I=���Xy�~�������8z��!��:�_(�h���B�(f\��iT �vl~���t)�v!��-�H����yN�m�k#�C�X�eB��y=�{�}�*PQ����"�=��P�'D�+��c�/����iީ�ˮ�������q��B��ӷTS'���Ėmh����8�5�PE�z���U�:r���c�����W�N��}�m��3S�U������x�94��0;���fV9��Ur��z��KU�]-Es�n �Ğ�$�����Ls�_Rh����t���;�(N��= �L����*�ܞ%1�x�³ڻm�;+_��o�v�h�3.��n��b)�{0"y��9J�%��.4*s�w��8Y �V^,�����*���$>�L�]�5e݅b�LN��Q�"O)ۉ�f�9�:�f�/ �PX4��w@QT���+é������*4D���>Q�8��U�G�4@^���6� ��M�]<R�ǁ�w?NR�V�&:NW�[�5���oH T���ye�[�" d��]T �Y�Oɜ���^��m����l� �6�շ���zd�i�.<^,H�|]F�rR�B\&p��8Ϝ��qYUm��NK�ϰ�}��Ti�FaV)�]�_��ٳ���2%��7c���cr�N3;)z��v�mb���������v��8NA�<`}@�pۘ 1S=��`��u�Ŋ��~xT)E���C�~��F!�t��7�����i�R�,�k���;�pDQ�<�: ��J.�M�� s|��6�J�}uN)�:�4���0~�8��e�>i��:X�����?)�R��5�=R�������zJ�<�J���7��O��1%T��";MeiiYn�:-���/e��=��^+�j�_DPc��=����n}����Y��k5B�0�x�-���uv��q;��.:�GmCH�I�KƁ�lH��;�-�٪(������%��sA��p�1$#��ވ�չO���X�E�V�xb�0S:6 b�X��S�S�PB!�gf�(&ay����_<��"�f�g�\�;�?�s�Kd�sfW��� 0'_U$�����-T�Ui;L��wh�6��t_��&@w�k`R��uR�I�`:��x۞��́2�%�aj4�ޮ�O�5Ip����2��e����I����E�9�$ Y0f8y�e��ҧK�F���.%*��n8���(��nn c�&�q]����N�é�ౡ���4E7͡܅3�*:t\?O$W}t��w\�����"O�f�h��vx�L��rLO}!�G���zq���'ҨD��9�؍�#�7I�R;D��?�[3d� �����ܩFk�EfY����CcCPl���_��� ��$����;t��r��IhQ���w��h�ߝV�r3�~��$=\������q����$u���Xd̃��)т�;ylٔN�jŗ�+��q���[�r.c;O'b��0Ә���E��Ml8=��H{hpqX��F�oX��PLUV ������n���.�����aE��.}�G�B_nJ<ƙ�`���b���O�����ap3ˌ6��h��L�;C�����5簑g�&2AdI�B{���zD��G�a�g{R�;M{����a�ž�e�n���t�D�dwP�.��H<�I���{�S5p7 y� ���>'f����f芕�;�������1�lI@��Xӑ��
Static task
static1
Behavioral task
behavioral1
Sample
affdbc2fe2027277d00127fecf69162fa806b7df58fc20454f5c5b9867ac1df6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
affdbc2fe2027277d00127fecf69162fa806b7df58fc20454f5c5b9867ac1df6.exe
Resource
win10v2004-20220812-en
General
-
Target
affdbc2fe2027277d00127fecf69162fa806b7df58fc20454f5c5b9867ac1df6
-
Size
1.6MB
-
MD5
023a2524054c0276e982548173ec3138
-
SHA1
fd0a5c58163d69747ed46b6c5d402bc5dae84de9
-
SHA256
affdbc2fe2027277d00127fecf69162fa806b7df58fc20454f5c5b9867ac1df6
-
SHA512
69fe145f4f58ca1b7414add92878c474be86fcfd171bf02441c80232d14bd1ffc04681b63aa825c6efea7b4b1b4546a7e8fed3a0b2bc0f132a3d3e941c01bfd5
-
SSDEEP
49152:BxbpdzFAEvhQMbqsSTKWyOxZr1RgVlPJbBio76Np:fTCEWMbqsSTKyZrwVlPJbMj
Malware Config
Signatures
Files
-
affdbc2fe2027277d00127fecf69162fa806b7df58fc20454f5c5b9867ac1df6.exe windows x86
774320dd84608625b394b11a9c031a29
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
LoadLibraryExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
comctl32
ImageList_GetImageCount
comdlg32
GetOpenFileNameA
gdi32
CreateEnhMetaFileA
imagehlp
CheckSumMappedFile
ole32
CoTaskMemFree
oleaut32
VariantCopy
shell32
SHGetSpecialFolderPathA
user32
DrawTextA
version
GetFileVersionInfoSizeA
wininet
InternetOpenUrlA
winmm
timeGetTime
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 35KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 64B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 981KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ