����s�!ڎf�h�9�m�[�*Ae�!S��rݩmC��� �����ﮒC�o�k��Dž������(��L���؍ b��$N&���B�u�?\�b�'^T�Z����Dל�f�$�E�g��fnPJE\U'�������Q���b�ϗ��y�3ͧ�wx��,:�����w�1U#� �ۤaF��^��Qd=lٳ������*��Z���v*ú���� ���p!����s �=�K���*.��{k���Cjp��?,��e��P���g���l��S�� �O�+��+�z��$m�v��g�����i�־���8 t�%�Xӂ�,NјU���$�.,��4� 3����_v�r��G���� ̕�a�8Ȥ$Gh���+��#��a���Օ�g�=R�婄l)Ʈm� IpA����a!/�Vl�1�e���l���R�� �����"�"�� E��M��Q�:~|���I�@�ϩ:)I<3�0`���4f;�j��>���=�~��������͢q���pHyH����NDb���I�<R䐫�� ����ou"���<���&��������o�QI���)�6�)���Xq�jQbu0��I:|03���^�$1��+�����Z�*b:LFHQ�L�)� �c���ⶒ~̖4�����7���3j���Y0y<���u���l��s��K��H��G}Լ�j��4�rVt�M�3�5��9��6|���Fwqՙ.����a���Y,t"6,k��*����ɀ�t���{&7�іx1��|X\�Cd{��dz�́;����z�H�$�&g�� w�=�_%l���)�/K�Ȇ�oަ�е���?�@�m¦��;I!fO�dɚ a�y�7�Z��6��rn?�&����?o�p5Ŵ^�INFݟ�j͏l�4����&���}�kFĺ� ��F����@����|l�Cs~��3-�J�I�3lY^#R�T��W-~�ܻ�����~9��>��-�1O���i#�ƅ]���/Sl�x�2B�s�L|����%���M���5�H�ΊEv�0����A�|��U�����x����}�@*�/p��ՔV��gU�T�{(�P�IS)����b:�Y�k��˭V��[�4��o��֑�x��>�Ts���4�:�%@�?�z�2�4_XC⚈�9.ˎ�=T�2�2�@t3_B�y�o�w R�fY���t���jn��kJd� ������Y�kJ��0��|��i�Aq��H5��8�p�b�0����=�uC9\ڤ.��=@tM�`�J���1ӕ���]���uVzi���]��� u���� ��?�!�*��s#�m�T�A�%{�ս_���~�~��5���[��N��ie�"���Ch�� ����\������Fd�����^���ڞu^&�Ð���L���5�w��'��ܳ����� ���'��hƨ�� ���=�pɶ�/7M ^�u ��3���D���9��(�q�K������y"�����{��S��>���0M�̿74� �^��%��5C�AʦÂ��/1}mo�Z�,zz�w�2Qƻ��Og�}�c�tʌy(��SJ��_�a�����LK-�9G�F�r�IZ���2�� ��=�)낞C�g�lڿUH�j�Լ���gᶍCȖ�\���*��}"�k��C�x!������юC;�9��i_�E��ʍ��8�0J�ž�呸m ����)����3&�~-�_�����3)o��p�Z�.�6T���9@�[�*P*�����j�#�Ƕ:�����c�zݶM�.�������nr���nhl������1�i<|�h2�qiBЫ���%��)�I�&��݈d�ϒx/��4�[�mqGϑr���ߓ��|D�:\D�|�@����������=lKrc����X/�i����lۦ���˻�Y"x�0'�o#��6*�u���PR��O� ��!�_�YNW�REB�_��J���7IlӺp60Yj^m������_��)�ފCEu5���n-�.'[�@�?\z����=��=�D�'�#r���;���V��_�zh���.��h�+�y=��4����i�j�t �L�A��x����g�Ŋ�5�y)R]6��p&e��\��DL j8b�R�"�n�'���� ��7�Њl��?�I��#$�,�w� �2��[���,ω�G:�Ws�%�g��hg@c����P���T���P�E�ۜ�Lׄ� ���(/�G��+@{V�� �z�@fIi7>��I�d�p�NC�\�G�b3���6�!��m�kiyWLk�� ���b��>��f"���ZlȬDrD[I���E��g�|���_�|*jdF"�>��T�!_�Dȡ�Z�'g-�г��,��M-'TM"�) <��h>�sKu��|�\�&V���Dl�!�%!���� d�ٙ�u'��[�N-Y�^5��m�zm�|�g�r"���d��R?S ]�T�C^���]����5�<���K@cO���7VY)��8FZHL�Y��T��)�?��;�� �4����@��^:�$ �t�H�ѻ��?y�s�'5�;]��Hsq��@�0�i�t��:�g�A��q�x�}䞗�����x:�~�o�v�]x���Z�S��2�że�PQ�,r�n�K�$�;�GJ�]�쮳��:�H��LR��1����l�1�C��P��;a�&��̊[��}�H��>q�$�?���r����#���?��t=s�l�a�}��s�6&��.�H�3��2�'8����FG�+�,i�<�h%�1�����Ⱥ��7������l�wS�J� �?ߌQ�~���t��T�����&6��(���uH�]i��N��M[�/�P����u��V��뺣sl#��ʵP�$��]a��g[[ȜX��~u?�=��@��$���S�1n:;�A�V�o�ۡ��ka=����4���U��=�g�#yI ����}s7�5AU������7�Dt���pXi+:�,������*F��礿pPE���R�����I/ŗ��&��P��Ź5��
Static task
static1
Behavioral task
behavioral1
Sample
557e4fbbf93ca5bb82ab83d48c644f2c427e1785349868b3bfdf4b0b8a0651e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
557e4fbbf93ca5bb82ab83d48c644f2c427e1785349868b3bfdf4b0b8a0651e6.exe
Resource
win10v2004-20220901-en
General
-
Target
557e4fbbf93ca5bb82ab83d48c644f2c427e1785349868b3bfdf4b0b8a0651e6
-
Size
2.3MB
-
MD5
7f10cedcc873cf1f102ba9700e81d514
-
SHA1
63048228b1e98ccf785ca5508c911c581c9a542d
-
SHA256
557e4fbbf93ca5bb82ab83d48c644f2c427e1785349868b3bfdf4b0b8a0651e6
-
SHA512
2751e5c79b6263c97513e572d10d89854fc2bbd931eaee0ac972e6354b2aaf22ebb0625b87cdf7043187660256d8f1ab431ef6b0c8796b781316c60312d52bb3
-
SSDEEP
49152:/O8qd2K6j1XU8VxD+Do0Cs/MzCox/mpRgP6nUCMkijl:/C6BU8vqxSCq/GgP6UCY
Malware Config
Signatures
Files
-
557e4fbbf93ca5bb82ab83d48c644f2c427e1785349868b3bfdf4b0b8a0651e6.exe windows x86
59dec0e41090a68568119198530bc1e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3305
msvcrt
free
kernel32
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
gdi32
CombineRgn
advapi32
RegEnumValueA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
ole32
CoInitializeSecurity
oleaut32
VariantClear
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
psapi
EnumProcessModules
dlqmodule
KillProcessPID
wininet
GetUrlCacheEntryInfoA
iphlpapi
GetTcpTable
ws2_32
ntohl
msvcp60
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 598KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95271 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ