w�����L6Ш�z��g4�W$�Y^/��{��������E�[4n����n�����6~r��ye�v���!l�s�b �@ķ���X3�(�뷼<=�P�:��-�I�����<W��lN#��8e�=�I/�,��.t������u V�Q&O��D�ˌp��m�J ���N���A�ű>O���&���_��- �U��\�"u�ҵ.�L���n����5���X�`�� ��}��N�DlF~}�Ē1~Dȥٜ�C�p�mc[��B���QI���I�UO7��f�Ft���n[k9�]��y^Zڽ�5�B���)j����&R$��ݵf�ӮS��zSR��0�{ ���zYwo!��?��]B����|E��\]+�;�o�=%�2z��E7+�Y�F��� &���K�7�6�H��T&�-��&���2L �%���~Jb����꧞4���FF�(�����N���Z�z<�����{�W���%7�����F[w�K�]:�A �86]+C�vnt���9��Z�h,2� lc��&N��-Pxk�3>�'=�������yC&������JA1m�J]�:�r-���Mӊ��m^7�z2[ʑc��?�:6��7mm���ܣA�)�c��mr�N�$�]||�WwzwqK�|sc��1�>I�z�����簲-�� ��G��_A�$�oL���S���[�啬�5�r�����ʩ\D���ϖ�� �+�$�x�v���۷l# H��Y��sT*��a��I�N����}��"�w"�Yy�&����}mH���p�i9�F��DV�B�k*�����5*����gp^������5�����}��ige��L3�s�4� �v�b��|(�2���wGhܛ�y��"�58��?����žQ�C���`���M��j2ho����o�ek�u�ij�1��v�D-)�-�HL!�$PjE����Z*���S���dǙ�("0���ʄ�@y���w��ڞ���7�x�����s���)�w~>��c�q�cR�k�w��?2����,��C,ʒ�v_3�l���D�0 �# 3F|/�����/D�2�&"�Vw�y�X(�~�Q=������J�vc�n9F�� 4��=�+:;��"�*��*��.��%=e���i���îٴ�}eė~;��z��Q���wkG�]N���6[?1JDaÈ̗��y.��3:�59s����-�[�㹓xZC�x=X��7�gM*�2�G+���8�7> Y������ �#�ȳϠl7n{�d�O���JCu�v"�O��"��v���Ns�!�� ��ΞG���J.(&�]���U�m����$2Pg�L�I�;E 60X$9 ˿�L�i���,�u�a� |tx� Qȣ�>B��S�\�הå9�b`$���.H����+�}��H�b���QKw:�fY�ZCV ���e����J�P�ܽ�T��~���bޜ���1�3�pȝ�i1���c���o��n,���4�݆������\(Q����v��Q�&03g�{#���wo��s43�j=x����V8"�����c �j<���f9�f��7��-_�ۺM��f���y�j���O�O�����Yvwm���n6�?�����>&�d�9�����ࣥ�F�����K(R���xJ˖g̒�gV]���ג]���J�������#XN���b�[�|�c�+/3֒ OR����ak�gL�����c�^åT�}ǗW�a�B�Eq�Y���&'�c��a��n ����9/�shG�����[4Ė�Ah��.�<v���dʲLhQX�_�+A �*h�$��4�yDJU�?�l��)"{Q����$H��.X�ؚ���Bf �R_j�9�i��u<]��v5����xM�G\����|�$Sp�h_F�r�sI�����Bw��Ǿ��Av���%���S��8k˹g�Dm?I�Z��EҔw4��4��U��<���| ,6�Fu�G���z��[]d�aw�S���̎��R�>���Ķk9Rs�?](Ҋ<��Ee�d�*~�q�� ���Yf�; �KEU�FA`q��?�~�~���DX�M��)�N�j��vxco�\��T;��8��*@G��^M� ���e�P~P���D��%c�3R�SYpʃe'd{J?_����Nڲ���F�]���2��d�' �|��1����8�[�8*G��=�:@~Y6�%�G*�nB���֫���G>n��M�`�Wv���{fu��}��n����i��;�OS���y�]���� �k�4�4wg�$�{V��hv��^��U�3#�@Voȴ��f�j���Q1\3�m�4sq[����e<З�=�PR��Y��p�p���/L�jX�Q�s&�h� ;/G=�����M���2�R���Є�ƿ�qT�"��ǻm��fK�yC��O/۽���Z��w<�UC�QI�(0s䶱�2Qs@7����ꭦ{�Q��fG^Nx�����N�Z�~g�Y�H��G�iʿ&'������r�i[��Tz�7Jyu)JVt�w�L�1�x(D�� ��g�z�i��s,�Rvξ��p��������/�,oG�H�<}�O-1v����ԕ=���g��IKM��k\EF1fI�f51$�4OV1�粠B�Q3u��$p&�~�"_�A����E�p��n0H�q����m��Q@|U�<�H�˺�OV&ĄK���U�]%�����C9�� ��������%StZf�)�kFt����%���)��%�d�^�d2�dX��>qiS kln�6ܢ�.h0�#U �d�Skg��#' N}�s��2�R1dQЖ��/I1�W+2dS�R?����e|;����5�����A�b?�y2}�O`kk�O��Z�]���+�thPm7��+�z?��s؏ڲ�_������(���^�?��m�D� !�3J����V�0�B�%Im���A�θ��m�� �c�Yă{]�"�呧�ӈ�[+��"zG� ��Hk?�/��Y����1 ��������x1f���,Y@"�-�I��� k�P��O�9R}�n����g��������g>�%����ȡď�MX�����5�YN}��
Static task
static1
Behavioral task
behavioral1
Sample
03c6797a1ba7bb2176347d0b946176dec049586d054da64deddd45da820e47ca.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
03c6797a1ba7bb2176347d0b946176dec049586d054da64deddd45da820e47ca.exe
Resource
win10v2004-20220812-en
General
-
Target
03c6797a1ba7bb2176347d0b946176dec049586d054da64deddd45da820e47ca
-
Size
1.2MB
-
MD5
8034181331e631f9981852fa4e0b77c2
-
SHA1
3bd15d57674aa757102b9b1b75b2a51f73d2ea9f
-
SHA256
03c6797a1ba7bb2176347d0b946176dec049586d054da64deddd45da820e47ca
-
SHA512
78f4433c116bbac9da37036d3e5598e5a4c2ef2acc8f3a2148397d6926fe2dfd47e12ff483a6c99691a64b46beb10a35d5e206672387be24e0f3477ead8dbd22
-
SSDEEP
24576:ECh7QavvRsSazfCQ8U+6axAxy1B877vnJDwnD0JUgJAOgqDH1r6xvM:1h7Rylf2U+6k5onJqDJOgqDHivM
Malware Config
Signatures
Files
-
03c6797a1ba7bb2176347d0b946176dec049586d054da64deddd45da820e47ca.exe windows x86
5ab2e85d49c277534382b865500c2c16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCreateKeyExA
avifil32
AVIStreamInfoA
comctl32
ImageList_Create
comdlg32
ChooseColorA
gdi32
CreatePolygonRgn
iphlpapi
GetAdaptersInfo
msimg32
GradientFill
msvfw32
DrawDibDraw
ole32
CoGetClassObject
oleaut32
SafeArrayAccessData
oledlg
ord8
rasapi32
RasHangUpA
shell32
ShellExecuteA
user32
IsChild
wininet
InternetConnectA
winmm
midiOutPrepareHeader
winspool.drv
ClosePrinter
ws2_32
getpeername
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 511KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.se0 Size: - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE