�XW�N����j��<r���e�@�!\vC��2"��D@]j�m��3{m �����F�}I��K�a�5�\�`^��"'�/�5���Xc���=�;H����IX@�ȹ��^U'�W�S��s��+ "�DG���#����-jem��^�E2�V�0f�^�'N r4!]m7t����� 3��C�� ���w'��ch�b�?"���Ϲ�j12�}L���.*����i��?�j\��Y+�qC���EH7�����GgH#Z�!��Z MNT�U/KѼ��X�o�oL�����W&[�,���-2�$ܱ訸�<P���M�c��0~uʏA�w�G�.x�� �k,��ι��m��-YȺI<Di� �Q\�l�LIU�uQ�'�Ojod��L����t<��;V����"�tۋ����P�����Z@O��^0Yq"2尢��'�}�"C���DŻ��%EQ. �>��H����<t"� �(�O��#� aK˘q�cȟ�� �_��t��Y�����'��)Y͊;]5OU���AI�^��QҐnE��Gyl�I��)/���d��w�M7d��@b�<�Q(YBrQ�|����y��Q!���~��]H������(��Jf��%R��f��1{fe0��Ʒ�ي��'3��D�.=Z��L�|����lJ[�e���W�9��5K i~�X���~=�0�كþJP�^���p���jRs�n��5���pQ�;��b�0��H=��s+]H�e�K͎�|���q��Z��o�`�3R�/�61��a֥]���+m�%Ye�����~&v'��0�t-�I���$զ�gT�O�2��^� z!������Y Q�n��`j�:��o��}ʠ�Ë���q?��ȕm�Qtc�z����.Y�̽!�l|�L�Z;so]�nB���'e.51C^��%$5�iugK��v��d�L?���Ճ&_�X2xZ&�g���x�� �/��e�880~��]��2�:?�G��B�j2N�qG��4_A�Q�����)��ᵈH;k��Y��N�d��ӹc����2���d����3kx�n��9�yf �& ӗ_v��U�������v��R�W��Dt�g��Jx$�h�����+(�{̜H��1S��n����NG}��p�h#����������ϟ�EV��@��}>{���ӈ$yH����f�ì��r霎\ބ��뇠}z������-b1tnl��xG�!�3a9��Y�cX����{:�0�l�ԕ��� ��<� t8�t�^F�x5u_7j���j�Oxf�����u��%��� ��U����("n�۰���3�I<�p�J>}��&n�����P��XFs�c�}^�%yW���6LC�[�����rW�'F4A��� �w �rti`����`w7��?��#���m�I�g`�-%�`'�D�c*&��\��,���yGך���0��>��TYk���D��s?�Ӷ��$N�]=�p��4ȆЗ����o�@a�rWiv��T������q�Y�?�J��/��ݧ���b��}�)؈z '����t� ���{��e궒�N�1Z�l{4�)�{uæAo��O��^��BG��uX ir(>e5�\�I�Ww5�%��L~�N#���pe�&�D����=�g�^�]<秦i��}���R7L�ҥ&��:�/#��_�-� �7O�~:���o��R)A{�l�Kl�zj�ubs�·s����GLA��X��m��ȣf0����F�K9ʳ�`\���������� M��Д�l�v��g���}���&d�3�nm�ݯ������#+ue��9.KH�E]M�5���T��4�[��� �JT������׀��˱�Ɏ���_b��wη�.2*pdgU �q6����cp�N$ʁ'Qd��몁�8�S�9���+%��Ki��+��^YP���q�I|���i�ty���F,#>}8`�~/��8r��Y���x�%\��H�8(�]�}.79R��|���|ws4_9N�U��B����b�]��{����\!#|���������_������l��G�E�.���)�5���Q���N�r���smcv|+� �Iv�-E��gX`�:��n�^P��+y�8Պw��{G��U����'����r�*��J����;�F��Uq�چ�����R(z8��oDt�kieZ�һ�QE��ܬW\���{s���7c�S7c� �|��]dz���P%�7mb��=@*�˓0c���Bа��,g��ߕ�C��b���y����_!��˟d��E�m#T�Q�K�(�D�@j(�;����C�ϊ|�@嘷��e���#����Ō, ��9�=��e��u��.�[��m?�s"��t��sH "����o����2�4|�e����J�1o?d�X bq�������,x���>E��/���2(�:6t����Sa���$�a=&��y� 0���NN��j9�x�C��6�̈���ي�����I��}������s/ SQz';�4�^E/O�|�i�O��tz�Hƅ���"���7z�H}?9J���7�Ӷ��*"l�K�P�_�����y4<�K¯�z���j �'!�� n�.�u�}~;d���E[�<��^QqqK�濼�;^b'�bV��c�X��`^�N��x�}X\f�Z؉��9��#LM��q ���u�I_����C�� U��,��zce�����D�����DI��*�RC �D�0�`%z�y\n�H��#�����:�Q�����\e��h�,��������/�1 ����lZԛޒ��d5V'�Z���|Z~�< a,N�[%��E�?\O����R ���\[�?�?$f�-.ƴ'����D�q�/v��ջY\��}��o5㑀��Ş���l,�u�M������v���:�ʐ� ���\ݰ�MU����8���v0�سy9��Q�#�絇�� ���Pل��ؗk��nJc�X�KL&۴�J�ܤg�00D| �7����P�T!��\�D�$ݱ�S-�U�*��ꤰ���֝�B�(<�A
Behavioral task
behavioral1
Sample
67f2c207c4e94db10833a1159bfcddfa3de713d83988670d730bd43faccb139e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
67f2c207c4e94db10833a1159bfcddfa3de713d83988670d730bd43faccb139e.exe
Resource
win10v2004-20220901-en
General
-
Target
67f2c207c4e94db10833a1159bfcddfa3de713d83988670d730bd43faccb139e
-
Size
796KB
-
MD5
baf4b6cb5b78252db3bc100ae662b32f
-
SHA1
0f0fe15d42ef1d37c4294c771e8d19a55bfa584e
-
SHA256
67f2c207c4e94db10833a1159bfcddfa3de713d83988670d730bd43faccb139e
-
SHA512
a7cd6aa9caefdebddbda5dd39795af80356bfa965cf9d7e7c1c2176a1ee84d35bb5abe4915e66b5cb1b08d89e499765c84d1fe11e2cca17f82ffa0f6e97eba8c
-
SSDEEP
24576:6jUDkPB+JZDP1drAh6qQzhTVYOSZ1rPVvcfa3r7:Gt4ZT11A0VYDPr7
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
67f2c207c4e94db10833a1159bfcddfa3de713d83988670d730bd43faccb139e.exe windows x86
7a7a10280b248063b927c959db51dca1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExA
comctl32
InitCommonControls
gdi32
ScaleViewportExtEx
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
netapi32
Netbios
oleaut32
VariantInit
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
user32
GetClassInfoA
MessageBoxA
winspool.drv
DocumentPropertiesA
ws2_32
WSAStartup
comdlg32
GetFileTitleA
ole32
OleIsCurrentClipboard
oledlg
OleUIBusyA
axpspy
ord1
Exports
Exports
Sections
Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 447KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 776KB - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ