��z��|���b�`U}V��}���c�k����4w�-3��� h�ne=�ܠ��^D�j��C'D#d���P�V��ZE�p�@��E7� �M�l����[���K�*i����(eD�o�aPOg��+Fx�а���s��R)������)|����'���6�2 6���{�+�R/sq���l d5�~óX�����a%��o�Ҵ˿�Ķ��>��D��#�(�o��6ƈ����a���U��8��G��6���tl4�ho��B��6 �Y�=���f�S��]��z�\/�~L��Z&��*�=�� 2�.��2}��� Ά?���! 9�\��gq+�@��hb��c3��O+j&�^Ӻy#|Y�^p���Z؊�P«.(X#��+;�%����.��c��ϓ3�����}-�f�/Z�jU{��g4���Aj����J��k��FӒCR��L���L�VyFY�I�G�ru����Ϻ�u��M�чNw;s{1Z����?�VڒA�����������R�ƌ��4�8 ����3�<����~���� _�� ��;m����Pw �"wS�I^�B�;��B<��&��]�(�AW��#�/C# \"�ʘ��U���ų��8� �js�L�u@�q�^)��rrBxb䊟��h�Gw.2D�� 4۟�$�`k� 7�W���ͨ��ȡx�P�C�+���-GV�$F$ܫ�@YB>^��ύ�aM�$����>6 z�G)�A�=��_n~"40�&r���y�lJ L}�1����rB��݄%9N�:�L��k�"�!ZJv�aN��NT�&n8���Ӹ��F�-I1���������ޙB���u���F?�0�y�}���@���=�,6ƣ!+�}��VY�Gg�9��5��*��=JɤdM�o���0i�C�o��'������;5J��s�������G��נjty�9P�H�r�v���D��c 9����U��e&�&��s��(�j��4q�븯7�?�&�)�.��2��� �������N����u�,m����s ]�(�'K_!���j�<�W8�*��l��*,�EZ� `���H��g�T�ke�����4q�a��^���ϔ�eg�˨^����杝N�����R�f�<��b��H|z�}�(�"ㆃ�i�̾�V���-_��t�%���w�Ebx���O�.���v�[14��֍��p�k�\�$Y<k @�m�c('~�`���]�>h*�Y�J�Z./���'t��>O\�Q߭����S\���lю5� q����ϧ��EQ E�� ��经��Z�C���IzUkWQ�Y�N�)�l��Q�K�M T�M�$�ݐcץ�-}<�-̇��pdK���l�}�U:'���Zl�����������x FWI�Z:�5$�b��ͨ�R�� ���Nm����)n�CA�ӑ�"X ��k9�T{��M���TH��J]����� �7�۲~=����ȶ�㎑k&�3KZ<�cV���}=����Q�q�N�:D�,��F�I9��Ve�T��읒/��PG-�ד�q�LR0���<�X��H�5�{��\��^0#|*y`ʚ;:6.I*� ���n8��m�T+CB��F�7lS.i�μ?��|�!%�s�C=.�����?��M{*���Qްl-} �*L���^Uj!� �e��l�(����lM��̉��l5��~0�W(�W4i�����c�tѹ�]��y��Ʒ t�̷fL�5ى^�[Ij��;�w�_�Bb!�C����'��� D㭂tҹ�$�V��K���^��N�lŭ'��b��R�H�W1w7�W��<�V�_�2CmE8q@��[���h��t.�ϟ��T�F�j�Z�q=s��`�}��u#d����ok������n�(�� ��a���G����d�$�뗴 U��u-;VV�H<� իv�ޓ]�Imn�N>���9o��o�`�5���QE�����8$���i\��CࠈvL��<&fg���.���Xt"��;��3 ����U����]fۯ[�{��Z �P)�7�z����S��?C�x��0~�b���!�}�;�������@���[�²ht��@�]N���i+��� �%���5�BP�~U�1��[9:&�^�~@� ��y��u��H4b ��'��k � ��t�-�/$P/������:��ǟ"|�P���N�\��y�:l�H��<��\ч���s��BiM��2s��/��m���^6��y�ߨ�(\O ���U��^��������.��GR��)�C��R4�J��Z�� |%��=Z�Ƈ���!Ɔ̝#4�:�ky(w����@���m�|��{p�y4ˋ����+Q��U�њ�"P_*8�<[��2���sX�k��{��}:�כ0���TO������H��2�PsW�����L�q�B��-�����ż�v�3(��=�M��ħtR����GO�R�}�$�P�jt�*�*��s��`b?�I���}Zlf+|�O�W�0vG�Z<���pfWixn�)��-�"+�b�f������x��hT1B"XQ�=��"�3�,��}��oC��0]+�A��Ul|P����u���I�m����sZ�T�Z��`T���zZ�x�����=6/$S��M��C/�I�N�_�X���!r6d8!K|OB��,ʿH��]O�魃9'?K\oK������V���6�ĥ�X��+\��6?��*��#2�Y\w�T�?9�e�μ&�#�ՄU�:(%�KC�rF�|ϙ$�G�[�q�������&M�G����3�\�E�d��tx�ݿLZ4L\�����h,5^q��4���=�=V-r�+w�N��B.�JA���M�,v�"=,��<�Ͱ�8�#�N�Qu8���㲡T���h��$���nEjp@��[�'�q �!L�#]�G@Hs�KD��M�G����,Z7�`����t%����!�Ư��%� �3��p:;�-��c% ���]��+h���߽g���'�����k�0��p�?�-��b��BX?1�����LzS� �m*�� Sa6��{Aa�"�$1m
Static task
static1
Behavioral task
behavioral1
Sample
e8b3e045aa5999fb963d030f810a563c253b2f7d72f950a26b721c807647e571.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e8b3e045aa5999fb963d030f810a563c253b2f7d72f950a26b721c807647e571.exe
Resource
win10v2004-20220812-en
General
-
Target
e8b3e045aa5999fb963d030f810a563c253b2f7d72f950a26b721c807647e571
-
Size
888KB
-
MD5
9cdd83ca34bbc30eec6257edb8968462
-
SHA1
5f0d6e1802cb6cfec3e5da364ea3e7910831f18e
-
SHA256
e8b3e045aa5999fb963d030f810a563c253b2f7d72f950a26b721c807647e571
-
SHA512
1baca56d8c2cd0b6bc179af0416433f2e706f58b4ee45f39afb1297d7350778a58db87c9aeef0bc9d01b843b6e95b743e14dec93c2cf27fc5fbae5c27e5626bb
-
SSDEEP
24576:BfAu+uRPVSY+Pvryc3NeUYU7X9AFUpz3m3sAKeAEw62D:BfDPVS/Pvh9e/U7Xu8Rr7L62
Malware Config
Signatures
Files
-
e8b3e045aa5999fb963d030f810a563c253b2f7d72f950a26b721c807647e571.exe windows x86
f9886898c85a063f0ca7eb238bcd9baa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
FormatMessageA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DrawIconEx
gdi32
ScaleWindowExtEx
winmm
midiOutPrepareHeader
winspool.drv
ClosePrinter
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoGetClassObject
oleaut32
VariantChangeType
comctl32
ord17
oledlg
ord8
ws2_32
select
wininet
InternetSetOptionA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mhtw0 Size: - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mhtw1 Size: 852KB - Virtual size: 848KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE