�nB����(����SF]�/Y}X��-��ُ�m2��jw�zQ�G�����A�Zޑ��V��E�v�AO^E�뎏���AI���P�-��zP�a��.�/�˭����g���z���!>˺�3;-z7#�����)L�l/a˘�B3֔�u�-�������AO<��=�������:�8�>��]*{M46��x��͒.���T��w2݆xi;.~qJ�k��Ky�5/v���&q���Z��y8o�Zo F�K��>�ɢ!��Ϫ�����5`��>H������!� v�(_�aw��W^�7�0����s��մst��<_�1� ?�2��pD;љp�G5�}h����M�k��w�(���nt��(�c��:Ip.o6��%vDtbS��myA+����n�9ըq�ZD1l��^����������;��b��6��z�[8�4@��F��f�M��c��I��ԏ"Z����cvk2����yz�5T��dԨ�*m�\�0%A��EΊÜd��i%��HE��o7�d�K��C\����w��1��y��7#�0��f��Y�X�E~KV��Z� {'_�r״��;�23 ���V˃���̹��܋n��.�:��D��[a����fDN���h�L'���N���iRQ� TXL�����# ��,���3W|fn@N�[���}h�B�t�ͦ���Q�O�c��i�;n������\�ċDz��nݖ�~��9�>`�q*��N�������9 6n?Gc| G1W�@�^E4����ap��*a�>y�=��`����*#6��Y�MW�c�sf!f�E�g+6�(3����|���ˤ��n�p�?����2.�"�f"���h�D��WZ�v?F4単Ff�BWgF� ��~�Y��O^ιx��,X�����å��_4�Y� ��E�{��a�M��H�� ��/iջ$ՠ|�����j��!W�Ӫ��aR�����į����W�M����4�R�-�����j��Yv��� �x��f���A��0�J[W�1��n�n�,!{߇���S|�ST����ГU$�#�My�.ų4§ht��N�@F\�@� ^+D�3C_<��v�3!� ��H~�A|�(�U��S{���e��<U�I�UX������(�}S5+�8z1�Ÿ+�x�_f���+��'��1�s&�;�8:�O�v�rkfĮ�&�`�B�7���&�ͩ��8�9����]�Nz�������#��<�I]C��51�5K���U�(�@9[7<��_lک��]�8��k��[P@��ǥ�W����}�����£de^R]AP0?Bz�(�l h��pf~-�svE�엊�X�Z�ܭe<�����j=�DjG��j��7�I A��L�:*.����v�K��<��L�n�y_��t`y�l/M�*P+�?�[��+���̓�]�;�#�PF�<�G����z�b1gP=���M�&I#�:���?ud��5s�������*�Q�f��;x�t�x��������� ��3�C����� ��ǦT��<��g�ꜽ�7 �xㄑ!4����k`\=y�` _��'$��hD97ȧ�/ɠぴW:�l!����Pɣ�v��-�1�@�}%�Xw?]�'���.2锌]r�Ɯڜ���TmFOE����pn����#���`6I}l"۔�_7t������ߦ�u���<��Aُ o��)�8�T�|�A��[�S�t�Xժ�〻T�t�/�,�ǥ҄ *��f� �+^��ͨ�w�(��i��R��$�t�~A���Y�)���$'g�jSd�,J�FTjg����#)����"�M���m���D�� �������m�BA������$P���" ��/\[�D�B�1�漨4�xl�.f]���^��y��d�X���ajv�TB2/�^u�� 8��IBb����yŶ�\ʴ{����B��~Җ_�hyY��zf�K��:��8����S������v���6ٔĤ+p�/�s^�F���ХJP�w*��$�A9(9py�YE�nGז��x:���й���e�צ��=b[���L\�R 6���k�ans�Ei��x�w����5���?3��d�� |��[��z��w�%F��Ӵr��?��gc��1��Z�d���X �2�iᛘ����D)� L-Qmx+#Ս�����Xot,d ��}%��x��I��v�ǚ|�����c_j;��)& �<$��?��<n6� ��_Y 놾�#�]���$���� ���Y�7n�/^�h���og/%<g���7AQ&<y�7��՛C��.�Y#3pG2E��b��#{�S0���b>�� H=M]����"8.OO�}&��6͞���~C4}��S a��#]zC��3u�g��!��u�\�=�>��s�;�4r���8��%���U�<�g��D�[Ú�#�CL�iU{��l��A�ٍ��o� �|��x7/<���=ԲF��*;�,���]N��(�[���}��7�cSȠ�2���FQ���8�F�.�5%G�!�U��6��Ɲ���8�˧����r�O�������3�j���(�$�������+wJ��)}�jpC]�{D�!�b������V_&D$E.V`�l��q1���tַ�SP���~S�ڞ[��|w2��D��< �f��?�z�C���0�Z���dʥi`V;������{��1��K �.��YJ�AnӖ�XH|Qt�d�+��әehn�T��7�������]�����h�$�BzO���rnZ�N+�Eز3P���t�i���^^��y�Vы��Qa|�=���K��T"3Л�����;4��k%n$2��k� ��̓�(�N�`e����A������CKL5�6�|DD�$0�PfƲ��+�b�5d�ڙ�g���{ Ц�N(��BաU;�"��(��Sê�?�|?�e\���t/�2��� i!��(δ����Zd#��zJ�I�-�o�u5 V���������g!��w�(����a9�h�M�4W|.���駡�S�N,�z9�P�?����;��
Static task
static1
Behavioral task
behavioral1
Sample
c8e5b91394b90adbe047852c1af73b22818a32fef8ef9ca721004cb8c0ff1c8c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c8e5b91394b90adbe047852c1af73b22818a32fef8ef9ca721004cb8c0ff1c8c.exe
Resource
win10v2004-20221111-en
General
-
Target
c8e5b91394b90adbe047852c1af73b22818a32fef8ef9ca721004cb8c0ff1c8c
-
Size
2.4MB
-
MD5
28f6fb84f1979e72132bbde27a760bf5
-
SHA1
d6dc2c6fd1db693be15d767ccd14003b3cbda5d8
-
SHA256
c8e5b91394b90adbe047852c1af73b22818a32fef8ef9ca721004cb8c0ff1c8c
-
SHA512
15b1ed50fd7e085240f407d73e1c051a21bd893c57e09150d74186a80d668c93af3049345c7fd827c6ad57a3cf8b3c5bdcd6501c9a94d384dc20da0bf9a33f97
-
SSDEEP
49152:+BZXDIgbaLjtXRYEqYTooc3A92y8iVroAnudVCZQGOsd7ZgsvHrm4:+fTz2LbXqYTcw89i6dVCZQGOsdNg6rm4
Malware Config
Signatures
Files
-
c8e5b91394b90adbe047852c1af73b22818a32fef8ef9ca721004cb8c0ff1c8c.exe windows x86
5eb505154a847ad72f62a8dfcb40a32c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI4Str
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE