mt����!а!���y5�����!(��P m尧�m$6Wj����K�M� �<���Ʀ���{C�6�L�f�)ɂ i��T·���L�T ����3@$�e����b��h^.��r@/�\^�}bc����md�B���v�t���&f:��2��N�3y����Ug��)x���o��-�\D�X�?��L�+;�� ]e�?��z�T��7o���%;���r6��r��3�tv�/.������"Z�:��Y�5�f�WΫ�|���c3�kd\��������� �χ��%��ש5n��/RS�S�h���,c�sv�y�V�I�^O�����#�%9Boﶝa7=(CB(����@l�p�N@��CN��vW�^vp�� E��*��P�a\oO0�5�{�`��|ɘ��/pAEl:��e�#�h�T��,m����*��K��85n��e�jĆ��h�x��гtΙ�b _���e��z��v���/��� f0[�os+�lR��T����@�+�e�J�s={5ӷ[�Ă%�0 ^P���m�S�@�>��,2O2^�.��zċ��*y�����|�%�i��~�F)MN�;+t��KbV�v�r����P)��54�2B%�������\a�;�ۗ���U�r��*ߤ��!Q#ȹx�^�����\#X}c+EfJA@|Q����xnc@~0�O��p��z+��T�H���Ą�a�7����dʪ�F������e��2�(S?�������v�wr}��� �ʳ6�8 a�wS[(��D�4S�����R��oX��k�"Ա��U�s�84��}�+�#?kj�²zo�į\��Ѧ�XJ9M)̕J�lmܩ�0�4TAJ�q$x��{o���/���b���^�ニD�K��(��U�W�|��0�r�zko�2`lp��Gc�փp+�2�$Q������@���"�_�zpEH3�x�K�Y��4���Q��i2aW��3���`��,L� 1 �����v���mJ*e}M]E��N28��raۣhU�K�K��~{�p)~{\�I�������#So7�Mr��\P�'�E 8�Wn7xyŔsb�ĩ$�_M�_Y�1T��{Ԍ� 5�?:�(�6N���� �45��l�u����l��1����_g�&�["��Ʒv3k����g�Q�U���&H����e���\�rG\��U�g�d7N���*)�Uy���a\{�}F�=�U�%�a�*�pD�-a��\3��K�x�:(�Trq�^�w���k@� �\6R\�a��ˤY��@&Lf����c��%&Q��:�w#Ψ�#�ݚ%���`��|X"ݡ@�CT�R��N�H?ׯfI�g�<*j�/ΤYy8��O��ߤL�아�(�]������f�t7n�6��F<�?�ĥ��ƥ�G,8Z��G�pCk��*��u;T@k�eR9ͫG`�eF���h���"NCz��=������%9*�\li� ��)�+�vW���u�_����d52�ī,���Y`�0;���v���Ro�Q�c�Z��p/��B5}c���z�5vKE<]*Nә��A�#U�/X�g#P���^�������x���krP�&��z?�������}k��_������!�W-���ﰇ[�cg|QA��"˛��K�^��2���՜� 8M��S��:��}��V��=A&�1��/]��bΤ�>{����D2� π�@�A- ���I YI�Qqc\D �,0%�R4���ƍy�C�bd�H��9��t+g�0� �ڳ���?缱��s/�� �c@��HS6b�X�B�M�=�T����.v��ƛ�d��0�5.�_O����`���Y��=;��2llq�a�����×D��ϥL77���C��lV�۾k��H z���f�說��0��[S�;&�Z4��^��i� >w��&��n�e��0v:S�s����A���?R���"��,]+�U��|���ϋw�&�i��>�c:=.�X��\�l{6�.�����Љ�R��呰}$i�]D���ov��$u�=���������@��"1�o������fEzd&�&<�]��Z���H���oc����������<+-�����i��X3,����N��(/,���'�f��L䬍��R�k.5(���4�����m6����͜>�<{�����]�&cR|ମ!��>��&�5B^�����sR��a:M��� �����&G�́�>���0�C�����9� Z�@H-�^|��̴� �q��j4+?��ùm0��Q��E�7���,� <P����_���C �����%/jy T14���CQ�����3�?����Y`�U���O�,��&��-sj?��Z�������a�FFkF���h����?`�VS>��X/ �������Gz t�|��wG���ٰ��TЅ �����Ô��o��ngx�{VUO��c�B]*)����3��y�QPw���]Rh�V�]��2�������)����(%9���.�b����y�3nRvW`�� $��ԧ�YE�4��I�8S��k]�h֔�v���; Y�+��H̝�Q:��3��j�,�2�1v����˒���]�ov���_���u]�^�v��dDU��wf.��FRۑ��9퓡��D��IZ4j�EF�d��5m�� ��<����7��z|l�߅}���y63O0�Dfɿ���7h���^vL�[���fn�o�\�����리/�ڿ����1�ܓ�u �k6l��d��n�G�1��7�i(�W��F�[�d.����~�L�%���p�}i��Ѣ�3��y�@E��Q���R$x[�JI���ľڲ6�̿���p�6��il��E@ے�h�sE����*iÑn~���ݰ�鉨y��J@E0U[����aܽ�}ߑª�����]y}P��gm����u�f^Cy|��><�*�̕�?�&�,(�/�,9pSOñ�dž���ѫb~��}W���Rr1��"(�Q�Jׂ�� �}u�w� �����L'��1%���}���x��k����/���C3��M�@#���E���J�1>d#ź"�O
Static task
static1
Behavioral task
behavioral1
Sample
7667f2ed0f7719974b8073d4c135e3d16179e2979f52e91336f78549f8c6b36e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7667f2ed0f7719974b8073d4c135e3d16179e2979f52e91336f78549f8c6b36e.exe
Resource
win10v2004-20221111-en
General
-
Target
7667f2ed0f7719974b8073d4c135e3d16179e2979f52e91336f78549f8c6b36e
-
Size
2.0MB
-
MD5
ed729049902a3928dd9b28e40334182a
-
SHA1
e37f878f45ae384b6c551fc06659ba442684c0d8
-
SHA256
7667f2ed0f7719974b8073d4c135e3d16179e2979f52e91336f78549f8c6b36e
-
SHA512
199d49353efbd5f4327b4c873b0ade04ee8098a98a8d3ca33bf20f39d75a8993dae8e0b32ce7a57a4cae82fd2d919f466a20aa604bbf8711675576a33b5b3e31
-
SSDEEP
49152:2eJExF3dvFlon61sS1/XiIpqcapIsZzu04/3n:2+ExFNDdd34bpIEuRfn
Malware Config
Signatures
Files
-
7667f2ed0f7719974b8073d4c135e3d16179e2979f52e91336f78549f8c6b36e.exe windows x86
a3a6dadeb47b8e0868a3c43b7dc9a0b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4218
msvcrt
exit
kernel32
OpenMutexA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
MessageBoxA
gdi32
CreatePen
advapi32
StartServiceA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
ole32
CoInitializeSecurity
oleaut32
SysFreeString
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
psapi
EnumProcesses
dlqmodule
KillProcess
wininet
InternetOpenA
iphlpapi
GetTcpTable
ws2_32
htons
msvcp60
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 634KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95271 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ