�R(X�p�v�4��V ۜ� u����@+K>�!�]߇u��1������ʟҫ �<��"a�T���~����Ìy�5�����ւ�$���W�K������F�g#��=�]i�\����a? �t����C�%�ؒG�q:�x���"��Y$�[A+%ׄ��+Gx����,�� �U���J0w��U>R�lh' ��,�-���H��zg�\��w��XkځtP�k7��'R+�����&rH��^�#�1E�������^ڬ6r6W3uXڃ�BP^�%2�{M;I�?�E��Hu<�~.א;��� �DלcD�W�����{�˩���k�Wv�/���O�[@Ǜn�@6<�)����P7����z�u]y��l�6� ���ᝳ������ݪo4f;9��:V&G�v� [ h϶gZԳ����Y�?�/�)?��xz�'���sg�X�@O�@Ь�٘¹.@?���pխ߅X䃼���Xu������ �u�HOo�DB������%���x� � q��Q�o֍p����j�>U\ �" �\�xv�E�Sc���ม�>�us(�k]MJ7�,�2fB��k���c�;F���U� t* ��X�ba�s�8�������+�b���ٔ"��a����X��[g���π����Ks�Y��� �i̷}g���. b�`�]���smE+v�E�j�/��Y�S7�6cg���Z����i G���O���B�,���3UѲ���r÷��r����O ����E u�����D`:n`���+4P_��u�)i?N~�NkOJ��$u=T��6{S;l�E���i!��&�^4�j�@�Jo�0^}p[�0<]<'��� F��von�3yӎt��nJ�nUu6(:j�d����Y�]T�c���6�b����u�es�4H��1�t7�/�oT������<D Kt���yn#ؘ�q�u;AK�S�^+}%(3�>�eGI��|��x�R�S�5rou�H�m�^���~K������g�7�8�?�n�����L���W����{��6�D�7��V������B�~���rY� ���i�J�@�MI����̑T� zl�� ������eN��跣��16��⻳&��U��q����5��v#%1�!�y�iY܃��e[,�r�����#�䐖��gJcS�_��{o��6�wUB�.�A��,[i����_��2�@�S^iU,��O��7��5#J� fs���ˍNPb���$d�B�nU�S���7b�~�� �d+��)��(5_A,���B�F?.*�'�r��`��U����鬓�I+C�bJ�y�.S��3-ݞ�!���������Ü?�Sjx�;r�� RI-ɋj�2�9-���|�Q����\�rU�i�̔���o?�z.�|���r�k�0�K�d(�� ㍊o i5o'�����*�r�0w%�d Ax;o<e`��XGs�\��P�h� �xW���KΈrĢ�pW-��-_�MeP1G�Ѷ��X���s�[����� ,��,"!d�d��L�m��M���v&�LP�s�0%�f��q�̰��U]J�*9z�Ρ������;z������t�d��R��Q:�8<��H"^{ƿ�lS��n��.ǧR�O=/�f�ˤ�?�Tv�3U)�G41O:h�����n}��~u��2�>XL�k@`��M�ZF��^��͊4�i�o�LT��Z/�2�+����hiA��v��w \�����-`�"��W�\T� ��C�� �}����X���4�@���@�15}Hu ��J��i0�?�.l��VC���v���)Q����������:����B��-͍B����ݕ�����S���#�1�����Fʼ��G�L���e^a�̩tW2���K��6���"*�녝܄ �e�6ܴw�E�������F�տ�`�R��gs֦�|ؼh)���Bǰ�ɪ���a���X�?+�`|鶼��l�Z"U=�}`���:� ��2���$r����������r����jP9&�%-~yD�qQvV�PFH�+M��=D-��< � ����eE�����;̶����P��Lf��=���_m�I;�w���S�h�������Ax[)4(Jwb��[�۪��S����;U]�Rl�`�bp�9��O��M睢w2���;]n������W@z�UH��b�! �5ر�n�>Ńs�@�����-M�ׯ�Ml`Ǚ�V�E {�����`�l��f@���虈�k���Y�S^F�R9�T������k�u�Yȵݎ�����^��f�%��mG���;njEP�� �C��RӤ��s#7�R�c�!��qve��w�/�0�D,����F}P]d�B!�ԍ]_�~]`�r�������ׂ��"���i<'�KGN"��$@��2�&ut�: ���7LcK�qS�k|�?�y��syz>�J��1����E�FBA�9���x���� X�|� y9��H"�n���[� +C��x{=u��W,��sz�������,D���y]�X�Am��&�����%�n��b����k��5�~���_��@Ea�����[:8U�M�TA�ϲ{J���\���lC�:��w����>�#Dy�ᨁ���J�A��9���klLLJ����O�au�4)�،ƠNNP. ��WC������f?@sK��CN�0# �+{����n쟴������}���)"��#��3ob�Lږ��D!w��jd��|���L?�T�B�f�L�2�|��<�~8TjVY�������cZ-��s���t��N2��t�{ixQ�����ڠ���Jq��̽��H�=з}����� �����h��\V��{n���fM��V@����y��h+��w�8,�-��H��>!�i�b��W?�:N��� �̨[I$ �q���yn�E��)�wJ�h��7+#��Ԓ��{ ��(e/:�UV27�f%!��%��֙W�P�t{����ƴv+]���!�;���6p �4�2�](5����A283<���t����`��-�R��0�@#�Bm�:>���|+��2�C��clU�
Static task
static1
Behavioral task
behavioral1
Sample
49b2df5a78f029d9c9f5bb77306b51dfe7f68c9998afe17ecee8dd7ad3f6a455.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
49b2df5a78f029d9c9f5bb77306b51dfe7f68c9998afe17ecee8dd7ad3f6a455.exe
Resource
win10v2004-20220901-en
General
-
Target
49b2df5a78f029d9c9f5bb77306b51dfe7f68c9998afe17ecee8dd7ad3f6a455
-
Size
2.6MB
-
MD5
6b095d2fadc758b835edb184f06ceb43
-
SHA1
1a9cb3bb0866fbe35727f97dfc9be7ae44557287
-
SHA256
49b2df5a78f029d9c9f5bb77306b51dfe7f68c9998afe17ecee8dd7ad3f6a455
-
SHA512
aa522eaee75af4355f5fbae51518e5255dd0e113cc5b722d7599e6651def376c59f4e9f9e0773c62262cd54440d992c064baffe194f8d6f755409f0ab7e0a3b8
-
SSDEEP
49152:l6J/NIjyozxuF7Caz0WrbNxrQqjpYXgnYte9gWbXLS/jZLQ6NX/D3:WOpyCXWftmgnYOgWbXLS/jBQy/D3
Malware Config
Signatures
Files
-
49b2df5a78f029d9c9f5bb77306b51dfe7f68c9998afe17ecee8dd7ad3f6a455.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 747KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE