6�b#�h����(�N����v���f�M_`��\g��K�nE��hM�^@'���5��c ��q"�* �fOE6�AǓs���z�)Ώ�X�-����-�E����1����̇�o/��)rJ����7��c�C�,��U����AZ�t��<�ʈa��͆��F3th5�7F�v��q���ґO7���bе����T�/v���S�����2��h�_Ky��r�=xt�A�/�n/�V�+���2K@�'��&�����VSQ��v�����:��9yL��O��r]J��<w���y4���9@�^M����c�5�B|��a:�dF����u��OM'sy)�Q��g��9K�Zt� T�&o;M�<��9�o���g�K���G��-����}=���^��ZN���;�� ��?ͤ� ��Ѵqq�Í/@Q˂ڙD�{�d�e��x,S��`>��o�F����:ڒ�M�h�skn�q~B��ϼ�{��t�@�l�g���,�KŅ�!-���;}��y�d�$Jg�=n"��4l)���W��m�5�����eU'�y����]�TM9�8���`���<ܙg�i*R�_;_����%�_,��f�L��;�qW5��������B켐�0B��9�EVI��D�Fp!��j������ߤ��[���II֥�����2�CZ�(p��:��+��[Y%���Zl����âb��|!�f��|����$b-��N~����ް�ƈ�����A�L�t�T�KC3�������O}�R�B�5*��SW̝��Q��b=��n��l��l`"��0 2N*ucCL���o2��Q��p���}S� �\�t�\o�`9N��P`]��Ő��5$�z�a�s�-���2Ȇ�[���abl���/!B�EQ��|X�+���[C��}G��� ��qu�iE�J�GXO�羁y`��P).^�W1���"�Sީ1Q����sx������� ��K�r4�4���qv�,S�z��U�� Z2g��X�O�.W(�r�XFEj�_��������"йLT�c�`gŌwN:c�Z%&m*dM�-q_A��+�RUEs����RBN���Jj�Ó�G���� �r�>�(Z!$EyY���V��My�K����[�'=�� ���7mK�P�3�}w!0����H�SWj-o8`<���\�A��5��p[���H�6�]�n`@[����8�(�xs,�Xqћ��M��2�kj���v?yȧ`����*�P\�S����/�a'��6|��H�[�=�WEx$<*i\ٛ�[�����d�f�.��M�J�_��O� 1%q�C,_�I;7�͍U�c�匙�4��3���h��Ed��}%ņ��:�P��d�F1?<�0�\��խ�����1�8�~Κ�-[q_����W�'#��+2�l��S����c#+��+�b�]�|����oSK�ź%_��5��,�iR����<q�.�M����~%aApxL�����[�����H*��t�u4vM,�h�%�J�(��X&�ʙxo�������`����E� �yK-.�4_�p�M^�b�5�����ܘ��:x�Dp �7�G���eDv�{�m�t N����Vg�cн�Ȅ�Y$��K�+@0 ���� �c�U�=(7���$��3K>D~�".F��N�_ ��*&c(-�+/L�&!F�M"��~��e`���c�7��.�i��ո���0IJw�~�`S~�^N������t�aMQ���J��K�_�T���\Wſl���hn�joOQ�f�;rB��h��-Q����z� �skg�Q�j9R��uo}�ML{U �T�� ��xS���_@;1�v�Ad�i��d7������rR����e� ��g�8R�����Ƙ����i�G�KZKty���i%0�)M�o��z���6�n{/Jq ���G��������~|�L}Y��'-����4��p�rԍ47`�0�/n��o(��Ɇ��peu��-.f�W�t$Qi��% �]�_.�_߹��o��sH�$�����2�?4XR�HyQ6��;��j�s�C5� K`����*ɍ����͓��ש���z�z�]l�������y�&�������4�z��x�o��e Y~h=u=�`���ׁO��Q �����RA��7�b_47Z�;�Y��}�܆ �P�4�M����e���gܤ��o��x�<��?+��I&;\`� Mۑ�J��E�gvIw��-���l5�^�wW�T��h��A�z�a���I��W��G�X����#� �j+X@��s�)��(Xn�Kő �������1�)�c�f�~̌� ����E��l�*&YӜ0�F��P��H���.�_���d��H&�/"���Uڅ��?Y���ܣ�%�X,k�N7Gi�G� ��E>��1�)��qm��|����%��b���c[�{�j+=}���|#�J�7;2�i��cc&���9�@NrY�}ECXj���z$�����0C��8%���b+��ĦM�ʧ�Ȯ�&���������E��/�!�/ د~Ai����u�0��E쌷� ;���/##��ʴ�N��N5ְ騲F�����c[Q����Eox扪M�Q1|�{a$_�/r%<��y�ږ����j��5����o�P�FA��b�� tĀ�OZ+t���>�td q6Rf(�������[S�;@ �6�{��;Hl M5�h] <F^��(���0Ȃ"�9��[�}٤dK\*{� }o�'Cq�KX"G��̧�⮢׳s"g�Q�D-�y�h{Mgo��p�i���6�m{�s�۳&��P�1�KX��y%:J���&C^=.�,Gd�o&�!��("�͐7��W~��̶m�JN�W�&37e��/PV�UT5d��#�}���-'�e-́R��w�k�v���3)I��.c�@F��JF���S�Ϲ/Ι�|�m���bw*� Z�szw�L-�w[=J{��Km����<� �L�pӴ�ć��>|&���_�Mꬉ����ρ���|O��3� 5)*p~V�Ȏ&o�NYb������e�j��<��}��fC
Static task
static1
Behavioral task
behavioral1
Sample
08d55f213da7b8a1bc52731efe453cce7a005836743ca1b6a58687ac32b5b5c3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
08d55f213da7b8a1bc52731efe453cce7a005836743ca1b6a58687ac32b5b5c3.exe
Resource
win10v2004-20220812-en
General
-
Target
08d55f213da7b8a1bc52731efe453cce7a005836743ca1b6a58687ac32b5b5c3
-
Size
769KB
-
MD5
d6f63ee0db75e625038672ac9d7a66e6
-
SHA1
797794bed53443afbc6c840cda5c5e19934bfed2
-
SHA256
08d55f213da7b8a1bc52731efe453cce7a005836743ca1b6a58687ac32b5b5c3
-
SHA512
712f3bb4a274dfa9c33290470abc7b8c0a0e3caa7a94b50b35080aefbbafad0f72d73c6f718ee98156f93f234222eb5c876ab67bd2ef906663811c3f68c364af
-
SSDEEP
12288:k23zLpk2+TMXnbJl75P+P08MWmBYPi8thDQu0WS4bN4IhpMoWLLiRK6yLp:NjLmNMXnbP75P+DoOhDQUlbJfMJKs
Malware Config
Signatures
Files
-
08d55f213da7b8a1bc52731efe453cce7a005836743ca1b6a58687ac32b5b5c3.exe windows x86
07c95bfd5c94db8f4f22c455f8fd4349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefWindowProcA
advapi32
RegCloseKey
oleaut32
SysFreeString
version
GetFileVersionInfoSizeA
gdi32
GetDIBColorTable
ole32
CoUninitialize
comctl32
ImageList_ReplaceIcon
shell32
SHGetSpecialFolderLocation
Exports
Exports
Sections
CODE Size: - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 463KB - Virtual size: 463KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ