�K�L��Q��tl�����v`����*i�]����)�6���\�<��VF��T"����v��J�X���[pz� O���:cT�YY�}ïW�\����r���c G�����AC�1�ȡ���pb�~z����l�8-�<�������<���(�O���7���N�O������{CA�`�d� ��e��U�9�L�}l7��?�E��.�[kV�ʳ)a��v{�-�����,{N���#���124�7�>�jZ�NB�Q�+ _6[N��[rX��4���»�r��Y�Ģ��hA?��C+��y8�ʕ��9;��Su$f��_`���U@�q������J����|uU��m�����w[�� �'&&�9��(����l��]�?<N/��]��J�7��8(��UB��9��u�_g��Um����:0c �D�K��j�k��-��*�Z�K3�]�S��+�)��?��ks[�2+bJ&|�������R��=eqx�.Kq3��js��q"�T�[��U�Ӑ��T��K�BNʔ]�\���פUݞ,�)���b�����Ckء.W߃Uh�5�g�Ϋ�)���&�zz7�3)����L�Ƃ8FT�2[���ˀ�� ��y|�ă�7NOX<~�6&��_�Ц�-T�Ó����!�;�g��Kk�He2{��kJЃZ_N2�ha�N��$��v�SLY�#]1�1:�'�q�u�Z���ah{qS�-�{�|�os�n��{�h�P6�'{��~����U���v����dL��.���8�v�a���L��HLk����KG�Ti�)���� ����L��%�D�G�"MF�����v鎦���$f�[�d����4VNg|g��5͓�^c-Ѧ�����a>��/�6��a�!R��?P9��ͫ;�<GYd|ч�N�%��^x���_����ӂvǢXI{{ Л�`�%R�>c��}<����{�KgEA�jH�g�µ���i������@����q�y�,y�!�4̢=���e�s{��x��e�"�'{��B�n��duԙ`�؍�+��~������q�Eq�[�=z[�S_�^�]��ߤ*,[b��@"�Eg��F�s��ݧ�ZYt���\��I^���1�"m�s�S�n�k*�tsI� cH�����:]A[����}tʁ���ʝkP5�����Q(��cu>ۧט[�=q�1��e/�`�:d*$Yݑ[��:�{���K�����t;�{�v(k��q[��f,Y�d���P�cɐvtլD����[W���`>�3��1Z�q}�Vz��|Cw�Ft���`ކ��sj`�p%����`#��J���ap>�@�y�$� �G�C�|}��G�1�&�%�glU3��������>����Ŭ�$���.�c+5@P�- �%�?�_J�-nJ���<�U����5<���Kl�s�7k��������.N�ۜO�'j�5���= j68!���e���bR9��핻ͶǮG�%$�C("14 RF������eM%�/�HZ�z?��f��r����cF�v��bA����6��|[FJZ�~��dC5\w&�=/��Y�xF�&�ß֟���{������#VoZ��W\���pf�`�Z[o ˔�c��J�y�5 ��q���Ӏ���Ac�?\�ĥ���Mq�F!�P��ş���f0J��;9�hQ��̀@S�;h��g~��Q�D �*Ɨ�Z� ���6��ÆC�n�/�N9\���3���ݶ����xQ��Y'���c�㙾3���;�m����1h (�2g��I�2��j�$�i���#���?<3�u���ȷϹ�������&X��?� �p� =l�\z�-��Tb������(��G�PMۅ\Q�[^M+OBb������������FT��N b�z2�c��h�L��s���=���Ý7�`^'�O����N����}65��0����^۫#�%?�D�|V��Z�$�ּr/9��:���Q�%�@f䰍8*�۲�u?jr��D��51�B�,���lUa�>��b�f�pڸރ�%�� �a@�6IȾ>h�Cj�N��*��Q#�4>^���#s��X�;�ŖO�d@B4G�O�'����݈�|��1��l�D��)M�� ���vwL����H���)[��)��<��3G�q�h���u�:���ta�-��̑^�ߤ���"�;��\+[��Z��S��6.��z l�؞��=69�w�n�m���K?��:w�i�"rw��h�h��_]W{�U>�+�u�bJh �Z�& Z�~O��椥�ԯ�����H��ە�G/N0%WN�n����q�G�;�j-fQ/����(<��^ڝ����x��o&�r�4�t��쪈kF��l9d�1��~q�ƕ��6��mu>���lq��Hq���Zy�y��։kmF�\v������[#��B�X�N����k����pB-(��t`��Q��ɥ�L�b���2���#� �W5L�%��{�U������ �L���T�5�D5C'�a%,�S2R��W��������k���5��|'��7���5U=�_��<�3?J(�덤ۓ�$���Yi�ޮ�G�� �����]E<F�������҈����s�T���t���-��<��!�-K�@3����ǨӳX���ߍ52�e�ߌx-��4CјT<�.A�Cr���E�4Q������=�R?�A���W�Y�Y���i@�"���C�5��uC�dwW�W�{sp��D#��0A;O���X2��j<����}�W��T��E�|m�Zʛ�����p(���R��+o�ъ�O}�a_��%W�PC!m�fc��8@�PJSq�,�N�7�F���(5�l��:͕���bb�E��f�YƑ���� mP�rq�a6XI�p�I�����y(|R=/�F�F-v�U_���ex��и� J�� f�lM��%3�)߈�<�8� c����O�'���q<-]�o��y��-X�j��N꺋z7�r�f�5 3����C�L�tg��1"%�Y��i���M����+�8*��b1�Cj9J�gpon-;](���&�B����"ղw� �
Static task
static1
Behavioral task
behavioral1
Sample
6417c777fa2f0920ad8cb031d79ace02b17163f3afc2b8913d1ff9318367988d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6417c777fa2f0920ad8cb031d79ace02b17163f3afc2b8913d1ff9318367988d.exe
Resource
win10v2004-20221111-en
General
-
Target
6417c777fa2f0920ad8cb031d79ace02b17163f3afc2b8913d1ff9318367988d
-
Size
1.8MB
-
MD5
7b7e5f15d51fb2580388c2845e2c049c
-
SHA1
f225de1790f4a059fdd884c0ca253c8abaf55a91
-
SHA256
6417c777fa2f0920ad8cb031d79ace02b17163f3afc2b8913d1ff9318367988d
-
SHA512
f70229901d3eeb820980e115a5b5c3d7364e54c2e6be4be73b0e67bc89beb9940c1a3226774e067ce0687ea7df7e7381af3b6694b5d09f3386674faef71877c7
-
SSDEEP
24576:o07hvYLrMNRuyPDc7Urx395d18R2rlI5Qz/LSCHihp3bNd7RhX9LZb2TUMge2FCl:ohLrMaH7UrB7sc//dihp32rgtC
Malware Config
Signatures
Files
-
6417c777fa2f0920ad8cb031d79ace02b17163f3afc2b8913d1ff9318367988d.exe windows x86
0b2464aa7bc257e499a14c02f29a9c25
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3310
msvcrt
_initterm
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
gdi32
SelectObject
advapi32
OpenServiceA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
ole32
CoCreateInstance
oleaut32
SysAllocString
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
psapi
GetModuleFileNameExA
dlqmodule
GetMACaddress
wininet
InternetOpenUrlA
iphlpapi
GetTcpTable
ws2_32
htonl
msvcp60
??0_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95271 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ