;)/�k��n<O�Q��pw.o]�@^9����R-B��WT����܊'�i|�a�62���rtwt�{Lu�ɵ�*wp�͚0�]�7�}p���H<7�P����7�+Sv����8թ��Q��8�Ӌ�h��:��v�ؘ�K��c���w��H��o��Kn�t<7�TZwy�toe��SR�'a+�$� m� 8 F�M��+ ��X���rm u���w���Q�'=N2��e/#���pb:����'Mf\^�2a* u�J��r���-6�śA23E��B}� ���D��QK<&m%@��Q��4W�<��hx�飃�v�/Lؽ�Ǵ+�F��-{�s���/���?��H��ډ ����1�����T��`�3D�,lϴ��r��g����� ���;�Z�4C>b�g]0D��I�oK.��sk8<�(�mu6�#I�:!��=)l�[��X�o�%~Hh������t�+ڔ^���w��+�L�)<-=ɏ��3_Dq�GZQ�h��Y����/�*�̅N�ի[����J�M���>�-�eO������i�+���|y;�vI�#z����-��}qі��9>8?�x}ܠx�4�����S��}�� Ny�wf=7VJ ����ߎ`~H�~��k���V���cu�"*}�[����@wԫ��:S�!L���Xm�11B�-\��6�]/����>���O�)�˖� 7��U�LF��H����C}I^�n9I9�Ɲ.\�[�\͓���]�,ј�j��N(>�^��.�n`��� �7l͕���* m��u�s6��Χ�~z��������ǟ�9�@!_���o79H�i��1$��2�]�@� %t���|T4��h*l����ޮ翎o���Ldi� �h��G�u��jr.��1C��j�y���#G4l-�k���旉T���C�. J�G���#W9��-EP������`�ıݎ�>�n�7�D�8_�E7J(����q|�w����u���ʼn|�5���a(��o��Z���~i/"-��%�(L�$�������ǿWݫ�H��2��diD$��78\�D�H �S��$�w��ђ�P� t���!��������c7�jŰ�Rm� ��D�g;=Ojo�/�|��O�W��G�L��$�0��ޤe�{qȈ�S[O�7llC�)����#�1�>n��zt�b��}%dZ'm�r�:=��� ��T��ȢÄ����q�(�f�Z�7ܑS��Ԓ^R��@Z0��n��c%�&�r���d`���>��U�4�3s��g���*����A�w��$�H�7�n鉯�}bsqs�b+?���H"�@��Cg/,W�?��YТ0\kX�d��7���A�rc����웄t N\c�C��o���C�ٙҲ$����� ��&.���e�=��Xt�����Id(h����!0Вԟ�de$�\2L��8ے3;��ϫ�����ҫ��!��M�:���QS\5U ���DC�B����� 2�>s�3%8�����5�Jf��s�w������U/0�jg�]&@��g��B����B�(4}n#s���9?��0��%;.��dBI �?�{���ΐ�#����f8�� d�9͊6�?֏�oC��-�U:h�t� ��\M�� q����;!���<m v�n���vD`C�� ��#c��qŸ�3���O�P<����AUzx- ?�Nϭ]]+K���*�bE����'6 �l�U��3 nj��u[���"d/I�t��g�1�@�:~A܈J��%�Ue-��#��Q�K""�p�]]~�;��>��*`�ұ{�c�Y%ns�N��ei�gh��^(��]�@��ݜ!ˉ�J#����7&11����T�Ԅ�BHf������}^�4>0!C���h���3�wĴ��$��xQv��"*0&;�ј�ʷ?Sz%��hƤҖ�P���Q�BјEa�t2����Re��a>���ӈ�s�k� �<�Xْ��3����.��ӑ���B-�|aC��y;�?f��Y̤Y��̽���vW�%l��f{Fv�����1=л��T�k�!B)j�'�z�����](�,�]�O7�ߌ����r��aF����1��R��p��_�����_�V�Mo�X���M�!d*e��t�O�˹���L�qˬT{������Z)j���l�~��j n�5�i���ϒ��Ţ��ya��!G࠼U��A�\��o�����B+�������o���ψ�,�ߵj���E>�"�FH�6���M��1e��ʬ�&��xS���{���y��B�ϝ����0�Y�B��x�Y_���,�F�G��%�;�������6��[*�9��=g�f�_0�8�%0!==�G���c��3���7��݉���������?��P-��T�a���(�* ���D%*JK�$[���t�¥5@���|�I��M����P���* ��t��,���9'�U��Pi��2���.���ڝ�J��}e��������|�?��{��.��R�34����O�~�cX�'�*%�<�z����=��V���Zj=Z�����bZ�����n��8���5��a�+w���_ځmɑ��),p��@x螓V�D@�2ڽ}����K;�ȇ��1�%���X��h<S��U��\Y�pL��f"���Vo^E��k�:�Sݟ�i��#z��6����5��j���obv��]�����NX��<S;�ױrt����� ������d"i�}��ئ�� ���s1%�s�����g�EJ������'7�4�O8ۜ����d})O�����ș���\� �7q.�=J4��:�džaY�T�{>���_�!Gv����Z6}-*�� k�\�Y9�U�l�D��@A��k�����i�)��>g~�5�A*N�>$c� �Lw���h��x�H������*��i!fg�x^����o�h��o�6w���ǒw�]]���mq��7��a[��:W&8g��. �qp�vvttʿ��ҴV��a H�Q[����3�0�� ��څ,�0�^�n���B)��(j-#��C��Y�����.ϕ4��¬P��j���`JE�0�~��]K�*�!s
Static task
static1
Behavioral task
behavioral1
Sample
0490b3afc7187a1b280844d1edd68dcb464a375c31bb8f58a28c3c8924912043.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0490b3afc7187a1b280844d1edd68dcb464a375c31bb8f58a28c3c8924912043.exe
Resource
win10v2004-20220812-en
General
-
Target
0490b3afc7187a1b280844d1edd68dcb464a375c31bb8f58a28c3c8924912043
-
Size
891KB
-
MD5
bc44cb6259d881515bf8044f618f736c
-
SHA1
bb872a35244bb48c2b74845f5840d84cf62d836f
-
SHA256
0490b3afc7187a1b280844d1edd68dcb464a375c31bb8f58a28c3c8924912043
-
SHA512
9a1d01c73ba795e839bf7fb47add080a8045071bed15d70fce066125307046bfc10ec556179acf6246c759f0df653501927cfe76158a4d0848997f80ee24d7be
-
SSDEEP
12288:4BsnAmXG31Jj3UBSS29SXrj7hKPSbixjDgExX1EsYa1TDFVWbKYR4aCDwt:4BsnuR3lIj72Pj3xlE21tFYR6Dwt
Malware Config
Signatures
Files
-
0490b3afc7187a1b280844d1edd68dcb464a375c31bb8f58a28c3c8924912043.exe windows x86
ad38771ba8ecbddaa383538e6cb44cb5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
mpr
WNetGetUserA
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
OleSaveToStream
comctl32
ImageList_SetIconSize
shell32
ShellExecuteExA
wininet
InternetReadFile
urlmon
URLDownloadToFileA
wsock32
TransmitFile
ws2_32
WSAWaitForMultipleEvents
imagehlp
MakeSureDirectoryPathExists
avicap32
capGetDriverDescriptionA
winmm
waveInUnprepareHeader
quartz
AMGetErrorTextA
rasapi32
RasGetEntryDialParamsA
Exports
Exports
Sections
CODE Size: - Virtual size: 626KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 11KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp2 Size: 496KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 382KB - Virtual size: 382KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ