}p���e�G�>ʭ#�:ł��u^��aɒݗ�� 5w��m��&g�%f�DB�5�C�p/��]/�P9�A����r4�a5��1����Ip����Qd/k���s�AO.��?ؑy}ҝ��������¢���5�4x[�a�b��di�T=�;�7��m�+���N*4��&߈` ��80��h5��ـ��6�j3��?z`��G��ơU��|\�X�>$�.+'��7n�r�#^�����d�� ��u��}8 -&�S�UV��j+|��C�l%N�N����������>�n�������2<�r{2e.�"K��(���MXvBu�1�<3��!�P��"�z��:硝9��͖!��Ox~ ]�q���<UgӜ�j���9�,��Oݤ�eL����c/��0 �m�ܛ��G{�0��-]eB���JA�����H��m����h"yWCun�d��͗���p�O�m�q�m�)P�qI�7M���� {`x�'�(���^?�~��.��Iy� ��k\�յ��rbv�p�h�i�$���GU�eX��\s�����f��,__�����cظu��ϗN�<B�mmXi1�.��e�d�b[Ŕ���ˬ(�؞A&1��= j��l�@7o��!�7:ls��Ж��4��,rr�d{���,��{Ib�j��V*��Yu^�*��e��T�y���%��h����Č.ΰL�\�_�:FO�Ǡ[ù�ܩO> �Y�f�)w� ҅�k�Ͱ:� '��^���@oNʃ�8/��Ƅ�8H=XX�fv� �+ը"泥+�1��Z�`3\�D�kr3�,�={+T�ķ�@�L0����hց`��6���E���Z�FL������D~�^Z�|���px�RL���xwƟ�_�/�g�oɄ!���(�� ��[)h�X%S��.�� [���h�]���ڂ*(U��d��Վ� �W_H�DB"5D�h7�[���{���Ռpx5��.���Τؾ*�2��@��� �큘Lc{<��n���c�J$���y��ӉFF6![4\�i4�+���=��\M��Lc^z�zc����Y1�b`Ж[�?f��8 ^@k�}ux�?�U��>h=���8�g&.�D�oY�l�/OIX�����(HUIR> y��E�Y�}�=l�`�Y���K�1�eݕ/�1L��O�v*�r\��A�aX�����Ua�F!��XQ�'Q���D()��_|�Ͳ���?;3���kb�5Yl��į{�1���b���a�}a�<R-k�$s�~����YJ�A ��G��@)d�����YȠ�?!~�?2f/[�TnaL�&�LBD�ߝ v�c���C|]T��ilsB�̺�� �=�o�y!�'��v���(J u��/3��5�0�㉍x��2��Qc��?�Y��U���&�<W�ء��r1Sk�hg�8���@O�J��_\�l�y�C܍�l'��0x��rp߈�. ���X(�wéN�Zlr���4��k�M��o�5��6g��VIƱ�,r/�.'�9���a� k���5��h������8��Zۨ5-���}���l�}���)�(�6���v>I�jG�o� �S|�A�8L���/�P��2B,���5]千m�ِDt���4�|m�-b���Z�{���m� �;�L~�� �,C���!��F��^����BCj�o�|�����קd������Z�월 �£�z�N�M�ҡ�-� n,[>����W�`�e�~>vd3��9��E<���A�v��Fp-�M<0��� �d��y�3\��k����_�{@X�Gv��;��e,M�D����v��`��uW����鹃o����X���2T�U�I5 ���6���d�߫���撰�:���l���ch�; �H�V9L�;�+��$���m^ ^7&n�W��CG��|-��"��Ĭ@�J_��@>� ���0���'؋.�SR��y=E���z~���I��bʊTwp��.2��:D�U^���5����m�m��'�g_�N�#*.���$��iy++��+ϑ��]�Y�P�Y�V��L]��#�ս)UvX^��\�>&�uv�p������YYOQT*_�垙��D������{�����Y�Ev� -�x���ե�h��P���<6ߴ�<�$���[�` �~ʽ�<����n�qK���Q��RČe~n2����6 ����F[F�`:E� �*Ȱ**�|�+$�E���z(��I�e�^KI�zqf���Wk#�R�~��[iF�E�7��%q����/4s/>��Rzu��Ŋ٢�QZMT �� �=?���>� ���t��ܟ6~�{ycM�h҈j��H*�#��Y��UO��n�+���#?;0˿�nI�_ذ�'�:����H-��Osr$\�0�?�*�seS)���1���%���.? ���\'��܉^���X��ɠ�T[�c��aIa�T<2��e҇H��hd��g+A8A��USe�=�I���rdn�*��f�J�߫�4Syy���}��V�W��������z�ܷ� O���lȇ��(~��2��NK���@��#f��9��B�C)g��-���|��Po�Г���ylݬD�vT)T��\0!nNN�)�l�o�m8x0O�,��_�^Gb:S���q1:J���-�[����ixN��d���^E��|��q~�M����P�D�`���;���6�m35��عf���B!�C�i�������j R�����Z�\��g�%� άA�J��*:�3q��M ( `O����+s�z�-k�-l+)��i1'��^s���h�Bd�e�^uznc�N�À�����5��<3f��)��a����q����?сŇ�B���d�&�HG��b���/sX���P�M� ��<��� �0��&a�LC���+����态��KQ������r ������Kl� �j%�� ��&c�ry&�q�%-xz\ ;{X�S8_��T�3sP���74��ٙp�o:Q�.�<d�5���K�;�H�'��J��������J9��X��"&��D���p��f�]
Static task
static1
Behavioral task
behavioral1
Sample
89511370d2165e93968a5402a90b5047ec339b12dd0b0a2fa98ee2534811fdac.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
89511370d2165e93968a5402a90b5047ec339b12dd0b0a2fa98ee2534811fdac.exe
Resource
win10v2004-20221111-en
General
-
Target
89511370d2165e93968a5402a90b5047ec339b12dd0b0a2fa98ee2534811fdac
-
Size
785KB
-
MD5
b87d24bad10daa6483a77dd414808a98
-
SHA1
2da82b4136e99c127a9937a3c5c3d3096d52bf54
-
SHA256
89511370d2165e93968a5402a90b5047ec339b12dd0b0a2fa98ee2534811fdac
-
SHA512
661eb2ffc7c3532dd62ac30f11d51a8f66d80df2fae3d9e78c128fe2a6f315a576a8d22b7dd0b215d1b4e5f5bc56143a0a117c1dca05af8d56f2fdd4e8ced8d8
-
SSDEEP
12288:t4LMEviAs2MaNwkyAkvKZDNKG4nACmkhjl95JzjV2YasFlUa1QSUaZ7rFCpf13g9:OMEZ0nLcNknACmijllxHaWO1apM3v2
Malware Config
Signatures
Files
-
89511370d2165e93968a5402a90b5047ec339b12dd0b0a2fa98ee2534811fdac.exe windows x86
72bbc7eff9f34855cb9800cad01889c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDriveTypeA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ExitWindowsEx
advapi32
LookupPrivilegeValueA
oleaut32
VariantInit
version
VerQueryValueA
gdi32
GetCurrentPositionEx
comctl32
ImageList_GetIconSize
shell32
ShellExecuteA
wininet
InternetCloseHandle
ws2_32
WSACleanup
winmm
waveInClose
netapi32
Netbios
wsock32
ioctlsocket
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibDraw
Exports
Exports
Sections
CODE Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 616KB - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ