v�3�� �&~�J��p��'����n��� ё)x%� HV7�CQV����1Vz�N��k�PHC�L4&���e��!��i<���������`WY�+�l�����g���P*�W�I�r R��u�Ow��z�l��������"|fE�!���JN�s�g�F7���Td���?f�<<ة{]x���2L��!vlD*+��Gw�d�K\Qq��D.���y�4R�@�{���hYNތ"�L,F�d�I�T����P�[����'�Z�y���JW�R$~��8�G�P�v\xV�ts��� *���^�;���s�֧�����n�������n��Φ��͐;�}0�ޱk1�z��Z�"��4C�S)؛��aᓗ�����5?�wp���8I�̊�ʽ;�-`���^F̒Eu�V\�̩7�.ͮ�y��,WIo�S��e�,o�2�,O�H��!(����� ̀�fZ�D����̨M{ƒ���4n�(i3�V���*��G����e^�F|G��9p���*����gǐ�K��\MɎr��?z{4ˠ��Z��5���1Lt�d&A��E���93_�f�r�'���X̿? �����=�'�����N{YE<y��V�~���:�h�fQ4�U?A�ꩥU%r{���t�u����( �rB3��g���������(ܚ%&t׳�6��,�E�ӆ�vO����F��|%��t����v�f0�0�tx���i��u$���,�j�D�$i�/#� l�x�ɪ�xc��tw���LJ���`t�Ӊ� Ԧ���u�������)f���0G���d��O~�@wܢxLf�y��W3}(.�����O�(닎�1g��PK�,4ˑ�,�p7x�ɫ&C+:��#M ?�Tȿ�٪�J� �et@����&<��R;�Ђ�ݽxj, %� e7���dw�*��˘=|�g����27@%+��51�њl$���?�K��*��Ri!�ײ����ſ�Ooͣ6�=���A:ýzX��T��A|��<շuk��z��4h5|ߡ�XpyM�M�ŵ���x�"$����j�{��=|L)N��A+��|�?P��=�0�o��<�@��U�H��/,h�-٢�Ɂ�'���A�&���Dj�����\�Խ��E,9!���� ��P��&4h�G��*$��Wȳ�_���KZ6�;6+�Vdsyf��F�T�� t�����.�x��m��p���ڡCO"���Z>�&�Nj�l��s*e�=}�\`��B!<Kռ�Ώ��j�:�R� ��4���֦�f��兺���u3�K�H�'���Y�K���Q���s�XF�0g��-K<�ةaa�]�����Ds��O>m�yJ�1� ���qC;I2�W����㺧\�~m�v&�DHt�a���e�ʿs2V�+�/�w`��#<8����돧�� ��W+���m�a��vEeUH���tt�W)�W�j ����!�L�l�Uܱ�Ġi2s�j����xoS)�|�CY��*|�_�4�Q������?����Pg�ԫ�������z8�A1.��(���~�\��Ybes�fe��_���K����ު�_ߊ�m�����7x,')<(��ι[�˦�2=��[�:5o�)r�1�fE Tr�u�S+;�$��ȳdd�����p�w��G�3�*6���)��%;��|�~GL��+�@zA��E�x�HI��:�g� ����9��l7ݱYM���e2�e�o�/���M�Ǚw��H]*1v>�!(�F��'�^��TC�d�;`U1v�w[C���w~�W�zA:QǒOĤX����'�������㡏h����ӈ"��,k�w���J0�3��%�\�� �T��Z��I6����`�==�w�p-�w��ZN�/�c������نֵ��`���'[�v��p��[i�� >�]D2�앵�"�g�5A��ƹ艴n7G %h#�n[[ $�%?V��KHM�p��ޝa��pWt"����80I���/wp�0z�� ���يE����w/�\W���&L�ADo���`�(�L�W�y�9X ��q���P'����|Յ���bEϱ��b*n�tB((���xC�����k�\�r+����GFU�0��t_KUM�i���]�}/�S�g�A|h��i|��7��|��L��6g_�����K�!lk�� <�k �?�4"���H^=T���VY��<S >�a����&�@>������q�m�U� p3�@������ "i���A�,��j0���y����[��`1��Q�g������ �F���ݠ���vHh��m���6��iֻm��0)��|(��Wq����ܬ�=~�<�9A��H26Z8Q$rٲ��k���S2�*�bs�,�k���n�D$z��}�{�ӄ���6������m�J�Pw��ΒL���3��A�j��n> ƴ���~�By{��f�DϿ���؆M{���g�o�c����1�z���?�b�� t��]H-.��Y�o��q�����A�uJ�:����t�Z��[�� 7W�5�X��b��=�і�䧇�/�����LV�dj���[ܻ>���~�!�sU##��ˉ߉l̫�J���ئ��C%~<�v�aQ�d����F�]�=��@ʝ�� K�{Ķ�'Q�\A��L_'����~R���P -�VIv�2B��X�}��i�6����USYg�g9��yw��[_�A����R#I#> �nx�(��W����]:B�y����t��t�A�@ ]��z[����Y��yª��V�ǣ7�vF���AbT���� s�h�_���<A5ih;@�^��Vwr��� } 1ӷ{��I,���ѯ �����胵u�'Z[�*t�:"���c����7#�k���[%h�A�l��6`Q��~~>?��q;����Um�*����h��M�y�3�+��u4p'��K���3�L�v��^|�\�����S��?���+u-�Uor�Nh���T7B��}�-��OeЊ��0ڸ,�.����N.��>�C6�lH� ������3?�wsx��#����w�O�[�j�f�
Static task
static1
Behavioral task
behavioral1
Sample
7fa7f9d6b85cfb7f14cf75b50077e95ad09177a498a9b72b3eb627bff0d7895f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7fa7f9d6b85cfb7f14cf75b50077e95ad09177a498a9b72b3eb627bff0d7895f.exe
Resource
win10v2004-20220901-en
General
-
Target
7fa7f9d6b85cfb7f14cf75b50077e95ad09177a498a9b72b3eb627bff0d7895f
-
Size
611KB
-
MD5
7ff32eef6d9c511d586c4a31746326e0
-
SHA1
06302bdf5a484fca794646df608d0c921c565ffc
-
SHA256
7fa7f9d6b85cfb7f14cf75b50077e95ad09177a498a9b72b3eb627bff0d7895f
-
SHA512
5fc4e326ee24b190a3722b1969f196cdcd612af2b4e720012d43a6500239f4b7cc8422ba90d85c58b396d771dddec75b4dcc7851346166a5cbb659211d8dbd34
-
SSDEEP
12288:uq+EQbnhBYh99B6LH+04+QhRbgY/UiRs2AV1KrvEZ4uj8d1C:1+9bnzy936nIRR9xrsbojC
Malware Config
Signatures
Files
-
7fa7f9d6b85cfb7f14cf75b50077e95ad09177a498a9b72b3eb627bff0d7895f.exe windows x86
1e81731fc2842f36d2c050b678e82e3a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
CreateServiceA
Exports
Exports
Sections
.text Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 568KB - Virtual size: 565KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE