�� ���Y���]A��1~�V裈�$����E*�<f��ﶔ���DžbE�8UJ83���4nJ��8Eo�p�o����� ��IxN9�:g����1c����g:��@�7R�� 1"[OG�-3�~W�N�|79x�<"-�4胈5�e�:�~���bQ���݇���Ym 4�Z�F*-U\gz��P���筊�-N�����c�;����I����AI�������C����?���kQI��9�#�Z�N~gj ]3�ܩ������y�z�����Ɏ�'Sc,�����oxn�nw�jx*�ݘ�P+ߠ��F��b:�7džA������*���Ն�ze�v29-jM/��Ɣƣml�6�F$���"���1�h(ό����RD=$w-g�u�薀��W n�ɯTR�U�]��8}&*���w�����,٠�$FK[�����)�,�~y��y+dw�G���V�b���q)%��ys`,��VG�ʢ^���)���ϹD��V��W-��ԥ@�5��b7����"#v `�`<C2�>�wGU������*/�.Ԟ��w'��"�k�"J��$)���i��}g�Ѧ�� ﳹb�L+�]BSz�s��(�Z�zT~ �<���$7�:x�T���;T���!�����v��n�=(+N���fn������o����`m��������*ũ�q�* _�W__��λՋ^m�~�������2K�G�>/��0\ �^1�qD��jO9��Y,���]��������<"f�05� ������u�u ��u�"��D�I��Dޖ��=8ѐ��������Βwu�'aEK^X�x���Rl.���N눷�1}j�|���B�K�T���(*� ɗ�c|��s �����܅��8��X[�cة)�ٰRh�e�KsVu@ c�Pi��c`�?��<�+h�#:l�ՙ�� �.eԑ�K��Z�t�L'��k �2A5uA����q��|��xmVG:�V����p�rwb����م��wKOA����ٟ�J�_62�n6YQ�P�1�*-����X��e@i ����{���q�7 ��Y��ݛ�����ĐM����!�ѹx�s{��(F�E^d_~�zh̞?�{B�>�K�C��I_��/to���G�D���x{����Z��_QϑV������bg�:��'9��t���������h��A��&�d"�(��=2@�]Ã���zy�վ�'������p�q*rp�m-�HF�m����� ͭ ����K��h d�aõ����C��Y�5�bY�o@-�Fr3i� ~����y"�,���3��Gެ���^�26"i�����.x��`ь��rݨ����^䯒~��� j�~6W������F�r/�I��������Q۱o���D�%�M�`0������aF'�[D���N�(9n+Jť��� yQRn|�-sfa Bg8T�K>Z����Q,��F�۸�̆~ȴ�(�+9"���� ���$�,t�͊H/�%����{%����]���I�G�֛qqz� �2�Ǥ~H��n ���I�����f,i��;��s-]�/��<>'��e>�-`�w��X��g�xF�,�]f��������8!���beXM2�I���D�l���[�����'�[r+n�k���+4��f��6��q�ZA##ބ�$��4{lw��e'6ٜ��IB[�q�%J�A��3��'O'�������@����'��2��R_�/Om�ʑ�!x�[�~bg9 Լ䂻G�!-��9;3��^���*<�k�j/E� B��2'��IN�����?6+g�%F�]�Tj�9�O��6k{6ټ?�[��b�_�8����e9�ˈu�d3���HC/���D��(^8�X�����O ����y��aB�j��Y�����-����pvs�yd�q�c��ȣ�n��Tc�����$����3��S�$f�������E��r��W��z*����+ �:@X\�$s�j$�c��HY��\"r�zx��G�ؔ 6�u,�,b�T��k�q�x�R�\ٳ�'|$�k�-�G�@] ݡ�6/]��ғ�q���q��|~��8uіڽ`�rZ��y�K�rJ���'%���7��(|���9%B�~�����]�#k�˭�Wx``�ڠ����M=�T�%��EՂn�fԀ��3Ϊ�����yP{��Y���KAyKo����,}�l��F��'}�b�y��O�kw�zk�r���ga�\L�i���"<2]��:���2H��A�a�� �9�3h��O6��n�N�O\̅��H��C�)�TjA�g���G��j2�������Nq,M^���r|@F���u�.�d�>ƪ�y#�a31�e���q�}�7)*�_�.H���Z� �TH�j�?G9���$�]�dSΖ�Q]��H�I�g+�� g�}�E��Qjr/��\g���-ԶK�g���.����̼m���U&f5�D��&��^����ܙ������d�|I�<�s�9���9���e�����T�չ�*ckp]-Bm��|�R(��,10¦@k#XR�>�}�������n�L������G,U�YC������掔6w[��eҬRmpzV"�Ӥo���S4J�̍.��jT����� 4��̙���J�����<=���cd�{��V���dc�G�x��@ r�H~A����q�EبH���+F�d��@�'�f������Ǟ߭��[e���W&���� җ�o��d�@�,$�e���3�����!/Q/{�j!�Zh>zͻٶy���߀�X�ᓺ��\�����_�85H縗�A@/�t�\l�o?뀜&���Kр!���9?�2u�Pz�l�l����w˭�~�<��g�+�Nsk�\�o@D� ��ڶr�+?<-^G��G�<|}��HZ�� p���%2�* ���T�<7`k��4":꓂�6�Ѧf�Jm���ݎoO$"�e�d����8��'��0������2��M�x����,���T.C^�U9}� �>� ��U�U�rk\&lY��iLPbVc��&l}\��|�
Static task
static1
Behavioral task
behavioral1
Sample
1cf02bf80419f75d97cd533d71702914765f6fe3a9679118bdf46f5b90025fb7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1cf02bf80419f75d97cd533d71702914765f6fe3a9679118bdf46f5b90025fb7.exe
Resource
win10v2004-20220812-en
General
-
Target
1cf02bf80419f75d97cd533d71702914765f6fe3a9679118bdf46f5b90025fb7
-
Size
680KB
-
MD5
7242b39e772ea13c4ac06faed2ad35a9
-
SHA1
f88e6cf6fa0618441d53552572cc293016d1204a
-
SHA256
1cf02bf80419f75d97cd533d71702914765f6fe3a9679118bdf46f5b90025fb7
-
SHA512
d2d59745066d5f2f37e59b84e670600b0433856ce91c741eb566024d20b9078d293a10ce827df1475a3cca5d6d3dc2a50bc987d97ed0437c24dbb822b24cc972
-
SSDEEP
12288:QkHoUmYb4681nT2YzG3GPnMDY4lbSFXjBc7ksxdW2PaAqSZ:MUm5nnCsmGEDfRSFXjBcoW+
Malware Config
Signatures
Files
-
1cf02bf80419f75d97cd533d71702914765f6fe3a9679118bdf46f5b90025fb7.exe windows x86
ac9ca109f6df213673d9574e2003a067
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
kernel32
lstrcpyA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadBitmapA
gdi32
SetWindowExtEx
winspool.drv
ClosePrinter
advapi32
AdjustTokenPrivileges
shell32
ShellExecuteA
comctl32
ord17
urlmon
URLDownloadToFileA
wsock32
WSACleanup
wininet
FindNextUrlCacheEntryA
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dts0 Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dts1 Size: 668KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE