���� Mՠ��K�� ��Y5�ޤ�N*��]�x�'?ou��0�E%|(婘5xA�:��K�? �]�,KX��K��[�d�c�eV����J�5��J��8���L(?^���]�@�Ħ�]IC�;�_�L�}�<�g��ɂ^��K�n}��_�b,S���M쌵wF�a���قG�i&ا%�{���&��.����>Y���ˢϨJNg�;��#�]�z�Ee�AV����-�?� 2��cR,z���$�~��ͅ�H+Uy��Y���*�`q �����K� ���NCs� ���9�@��0<DEd�x�!3js��i�>�Mc@a~�����Ń!c��)�T(!|�~�?��Pj� �����Q[t�ݰn���-�]����:.+'!����C���дA�x�'�7~pڇr�+�ʐ^tcpE��1�����M��A���Q�m�7_��O�Ǔ���9�����g�}96�����1� y�%D�5v�\*B�(��)y�y��d����)M�����8P��Q �w*ᦀ�8u:R�(�Y9�f�C�}n& 0� �Q*{IHG�e��ޢ�}�,9�Q�C�!��6 }�v��C�߫�y�>=��/��^P�Z�|h� �b�e����;�`�F�~}K��C�Þ�WX�Z8/ݱ@;$�I�u�,�U� oS�E�c���-���#�<��-.����ԅ�&Қ<�F�zo�t��)jri����I"Y��#��YG�L��N��?���S�a�/�c��?�fo���Ms4c9DĿe���?��[.�8�Op�<�`��!������!s�r� ^:S.f۲=7�jAs���.�ZX,]��}]�YT��$~�\�i�SA�8��r���׀�=Зh.��K�/Nʿ�U����HaT�Zs� Rd��r�x����m6��9Cg�$��6K�K�uA�~D^O_�AT��J��KM �4���=�)�,�YV!]��Z �5���˙����5B�@����by^�C����k�7C��X}��q�9.�8��3i�C��`���uZi߱�PN�o͊�C0&Z}Fؾ려h�� ����20ǒ����5�bB�&�:��*|^���ږ���{��wɇy�g�l��0�h�YǑa�.���.�U�!����o�+3�Q�H���M�Y�;W^xa�r��p�u�J۹� � �o@W�h�Q���%�T�i��*���T�hm���в0��'9�g�8Ն��y�����/�J\��$<���R�xP>�R]�"��:N*�)k<��-(�;������~<�Ϲ��4���|������4G���⻤�[������܇���r$�C/��ӽŧ^���&� ��A,ZU o4�z)l�y&x���#�R�;2�C�����)Y8�I��� _9�J#�~AEfZnv�K���{6n��5cǐ�вڠ x�.eH�W2���v���t���t�)�z���Pf��ll�m�&�P~�[�?�����`5V <��ˎf4�(�O��x� -NLa����*�2�WiZY�ɮ��D�*���P���7�����r�-#p�^���?,Ғ��z�-��0��q�Oa'������-�䩆9������L�ևʺ��Vg#�-ֹٚ;5T�ܩ�9M<�I� ����*��_@��sj��s,Y����m��oi֗��Pd�Sm�dd��M��SxA��P�b���o� ���e��kI���h�o����������D�6�5��zY}���?|/"=�����ƀ�f��ݚ�\p�R��i<W��Q*��ߟ�HCrt6��Q�(�R0�r� �\����Ǵ�f������$G��C���ѹ�R#�]�/z�S��~���u(s�P7m��������T"J2��ɏ��ݖ6f��ElK=v�� '��Ư�k`_�;o}���^����F��W=1JY_1����!��} ׳?�gm�l���zί)��H��Ӥ��~�G����Gs$�,��t���b��X��)�����d`)d-;y�&,^���f����k]V3��(ġt�J��k���s�gױN�#'���Q��� �j� �ݼRĝ�h�LP�; N���G�HP>���0�F1�-t� �<G� %�>Β+�� �r��8�g��}��FAi������y��-}8�}�ٳ ;zu�f=X���A9�D�S�C@�]�%�� ��6�/tkGQ��L/ �@0�}�^!f�]�شo�� ���[uK X�znM�Kb~b�t�)O�[�f�~�lj���Y"[3���:"�E��)<x(�����A�Q\��Z�s �Jf�3Tm��0����Y6Rn6������Q< ��G>�( d���I�:JcdS�i���p�JYY8 j��oQ��'8�X=m��8�kzԫBY���Γ��6���e���]����.��Gy�9r�j���:��ǩAb�ݱ)u�1s�V�.7<Y�\�S�h��������BtS��H �;o�t��./��SA��4���$��^WNJY� r�.í����Ԥ����My�ka��!���D��@��0���B��C�K���T(�@pֽ���@|�g��,`�|%�@x�(B�Uy����C_����~ZF��FH��ܤ�V�`<i�- �7� e�J`��B�y=\� ka�x'�s>��G�g�+�������5�/��Q9�DT��ܺC�1K���@�؆SȻ��Lt��x�>qL��sE�����r�t��iQ�U���k���4S��Y�Q������'�q��������!(9N�WP ���Tf]�;��Re����w����jB����I�P��=�p�s� �Y��7w4 E�wcmM��t%�9 sش�ҁ���c�I��&����\o*k���!�c?��qxN�c�gr�r�{y{� &�Q �ױU}[ ɣ��]�n\���Z ��e �d:�ޠg������I������`�t��VS�@���ר�Q����U�r ��6cE{ ߦ����$��n�oF�����X�f/�����[�0c��� ��R�J�&`F�h���o��Ve�b��Ӽ��2���!��կ����Fo��jӀ
Static task
static1
Behavioral task
behavioral1
Sample
7c2fe1e7b8fa04b38895c554183799e933564d896a0e669a9e3c63dd4651d99e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7c2fe1e7b8fa04b38895c554183799e933564d896a0e669a9e3c63dd4651d99e.exe
Resource
win10v2004-20220812-en
General
-
Target
7c2fe1e7b8fa04b38895c554183799e933564d896a0e669a9e3c63dd4651d99e
-
Size
4.5MB
-
MD5
44edec7620ddad001de18ffe35a72787
-
SHA1
a88f9e63aa98d2fc403e15e2b5093bd68642474d
-
SHA256
7c2fe1e7b8fa04b38895c554183799e933564d896a0e669a9e3c63dd4651d99e
-
SHA512
9ba940bacf38012c93a47f0b3fcf0cbe128fc12b685a3b3f5ebbdb07bdb058528d5b27d9375f0d7623a9759ef9ec02afbed7c0673453cab76690f52b3c7dd39b
-
SSDEEP
98304:tqeGdBt7eGBUFQ25THxEJosEce6Zjr7R:oeGntqGaQ20Ksjt5
Malware Config
Signatures
Files
-
7c2fe1e7b8fa04b38895c554183799e933564d896a0e669a9e3c63dd4651d99e.exe windows x86
821ab39f6247ae9c0bf95abe3281a448
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
advapi32
OpenServiceA
oleaut32
VariantCopyInd
mpr
WNetGetConnectionA
version
GetFileVersionInfoA
gdi32
GetPixel
ole32
StringFromCLSID
comctl32
ImageList_DrawEx
shell32
SHFileOperationA
urlmon
URLDownloadToFileA
comdlg32
GetOpenFileNameA
wsock32
WSAAsyncSelect
Exports
Exports
Sections
CODE Size: - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ