1j���{��[_j�%Q�E{�`��\Sd��#�GoO?�&w&�-R�N�(A��c�h��%՛���i�|�fvĐ�tn��i��`�Nʰ"�J���G\- �5��]Op�"�@E_�G}�r-7��B�d �pl��;��� ��,+�l�CޫN�{u��4ז;�����J�-1��!�κ�)M�o/�m[/� ��ѺS���B�)� �ܕ;Q�F�����A��w��M�z�,E�ըes�ŕ�<��_G��qY���j6�C����~p�z�H} �}�䘭 ���T_��2Jy h�� ���XMN`��!���xփ@�M^�������R<��q��r$ͼ&��Z�����jn����\�:�C���Bc�noJ������>�w�Y}�}��mM���ƻ���[3jM�����3c��������}Q�4�]��C��g�瀯/�(5��8&�a�Φ����s��~����e�g�[-���K�out�I.���=��I{�Mn�(����̻{�ղ��E�f5���?ϋ����i��S�~b�\BW&�l2k�9/��^����S��k,9M6���Ǖ�V(p��74�$H�m�F{���"e����zϴHc~%�> 4*���D�7}Z�G��l�4���93�U�x֮U�R��� �Nç�TF�z���/���2�&�����T}�UUb��y�.ն�e��Z#��2���m;L!(ōLH >3݉��<��LR���L|�3VV�0��sv֡�=$D�6� �L�#�߶����\����&��Zl�@�]�l�Icl���!2�E��,�[b��tj)��+��Ű��9���d��v�:�z�;H_� S���&v���ˉ��y���B�-(��<ݷ*��$z�Y���ˈ�+#�_�"z�A�V/"&Y���Y��l�d#ć"��G[��'p�j����|��&&؛�Z�\'LV�CA����?����&Ŧ&�N3�$���ɫQ�V}%�i���U;��qix���[jp��8����F�Aη�E��bc��諎$��K����!1 4+1����s����Lj�y[�$0K3\+�7�o��V�dT��r����)¸�í���[���c{%��λ��X��{�4��V*R����,@U\�_�&�բ�di �U�z�Z"���O��� �t�@ �ڿϙ Q�M�ʨ�� �ߣ����j��~�w����8�nJ�u��\�e>)��z��=ݤ��B�xxF~�w���������Uy��ɧ�3(��_�3N**�����c5�Z,'G�I �䬆Q�� ��ooY��ZYf/oHYl�OY�̐�#� �m���WJ(8[�]ϹS��K{��"�u��,-�WW��-;��bv��ڦ2_��) �ߞ�a���h������d���t����3Σ�iUaK��T��KƉ-u5Y=�O6�t1�DO��#����P}�9�@��n�R�6���^�u�ve�Ӿ�wr�{*��8�Çg���3��5LG�Kx�X֧�a殛�W��ξxu��9��.�E�����6.��x�B�l��b�EJ ����Ohūd��������U4��M:xUm��U��%N�������i�[8J�n����a �/��l3�;k�R���)K��z dr!z�����"h ��p�8��Ѧ*��xK�2�/��ۉp]���,�����s��S�?s~�R�i��ZU�1�cS�sG�GYF95�V�ʵL�>��l�.~P�9��lj�� �H��̋���et8c���~�{����>��f����M����B�Qy��9��$�ci���M^X����i���1��w�W$��[�4~+��5J�X4�K��sm<��JE�W���_$�<N�A��6-@��ʾ�q(ʎ��Z��N���{�.C�e4��V�I[_!����+x�� �!ǴQ0�+���� �����~j�����p�����1�*1���N���Y���HR�x��t����b����� �����K��7��n����˃���9Fj��T�l�as�v졗ڀE�x�RD�(#y�GOHmc>dK���8:~�'�|�\��� ��;8x[�e 8/<�(*sw~*��3 <RB�� �}����c��T/��Y��̖��M&��i@��a?������7�0h<*���@Dri䘠���I�|:�鵗 f�����ܤ7��\z���b���0'\�B���!���'��Nx�QP�"��<Y�U?NB3�Ζ+l!�N�$��F��ن���������l>�~:@���pC�l�t''#PoV[;͗�#�;��͂�f{�+�;@T�������~���� ��f�0���CwJ���z�9��;��dɨ�` �yOdF�Fʔ�v�"�B)�i���EuZ��������?��ga�R�$�Ea�oBo. �e4Φb�����\-�{eGG�1��Jt���A4���ة(�7��y��"�2+?E�����>歌ND���C���Z�b+�Q��=�������ry���f��z�.�.ಾk�-^ �g@����w��(�ib��|��'6�B���gQD����މqE�x4I>��˼���)�6��v���ќxT�h�LW}q�vud�a4#��ڍ~�7ydg�C=l�c"��9�B4AE|�G��r�!�j%��w"?�3&�hT o�ԈJ�P�Oe�$��!�m��E�8�Lp'Zy��Gh�D��֯�k��t���:�h��NL�*�c ���C ��y�s���5�][uRCGW�����@��)�P4��G�vw^�6������JjF���1F��+�̳X1q7`YZ�Z_e�L�@.�-rbQ��L�:������.�ejE3�4cWI��/�@:F(:�ݮ���+ �?�<0�5�v��7���L�y��Z�t������V�IG�5�-� �c�����W�] M>v���x��/Q�*���H��;���N�Q����V[�^�Q�����r^��΄���ѶM�r ?�%I\�k0�'�O"��~7��vt�� �)��3c �81b����]Sw��g��O~�#o-q�M���+2�%F��� w��oL$̞��.dž
Static task
static1
Behavioral task
behavioral1
Sample
b997c754e3086f75a71dfb80b903da9367981afa41adfef59e107f7e11c104d3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b997c754e3086f75a71dfb80b903da9367981afa41adfef59e107f7e11c104d3.exe
Resource
win10v2004-20221111-en
General
-
Target
b997c754e3086f75a71dfb80b903da9367981afa41adfef59e107f7e11c104d3
-
Size
136KB
-
MD5
d0e5faf8168ff97f4bb8820407e9bb64
-
SHA1
bc3b8623fd628f1db894b15502617907b765eb91
-
SHA256
b997c754e3086f75a71dfb80b903da9367981afa41adfef59e107f7e11c104d3
-
SHA512
16bbec0f809e3a2efb45ebce7e46f135a156fdc9a16cbb37029b9230bdcbeec3a3d0fbcd8c462161473b60c713b2c6940bd2e8281d1a313c4f950612de8b3b4d
-
SSDEEP
3072:/pMEZiv5syv18HVSfqU4LhcWJ4bqsypXT+bzPq6m1iW54fHOA8D:/pZnyNISoLh14bqLpybzrm1iW54fuT
Malware Config
Signatures
Files
-
b997c754e3086f75a71dfb80b903da9367981afa41adfef59e107f7e11c104d3.exe windows x86
67ef5a0be7df2394a7a4821712f8afba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord561
msvcrt
strcspn
kernel32
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ws2_32
WSASocketA
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uvv0 Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uvv1 Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ