%P[b����������x���b:_��{r��)��ɒ�1J�,��H<ǩLK�.O��r�+��ZѨ���#y��^ĨiU�����N�5��ǔ��b;b�d�>�r:q�+G��|�n��q��j��������*nV�dZ&l���U˲�s����㿖���t��U�&��P��P�c^����b''���-k��١՛"���(M�'*oe�J������u�y��jAo��W�d�l2�k���Kװ�V��jW��z�4�ݮ��b�*~�-���FV���Ӭ&�>DQ�j�h���}� >��3�Q�ک\�A����_�����A�B�}���_X*��.�� q=^$4�����Y��λ-��k�Z����鼒M����u�fz�C ��,"����|X�T/�T��Yf}^M��_F�l�����7��@KW_˵�W���W�EWV��]+��mm��is\mGu��* �$HF������%��\羳J��+��u��O��/l�eozi����ALg���DA�?3#3����e�����뿘Zq�^J��'�ɻ�&O�ʛC����V�;��tj�X��T%3����B ����p�|(���VF�� lAF���H3d��7 ; ����1����i)j������1��5�3) s_�Ђ�ࠊn���DEK�a��T��������uL��1$5k��L�Al�0hO�`e]D�b㡑5ɻ���FQS���P�����l��.,�y��������3��I��*UUh]�|3>��[,v�֍j[i��=]�3�b�6��֤ i ��\~��D�eB8-w�m��j��z8|�@A�!A5Tg��аR/��M���Z`���&LP8��D��y;�_b0��{cPG+�iW��������Q粔���mv\&�?U���}@q��_��d��w��\���`N}̣oz�Aǝ�qRL���f���zz<�K�����F�4 �m]�H�Z�2ƄC��Κ��ė�k�z�K��O� �����ӺH�()5~��ᚎ�����E���%�-[n�Y��S��~��J;ȵ�j=$ �Ug�*D�E�xP�O�5���zyu���`���Z/� "�TL�</��m�]������W�B��d쨒Q�_�'�E�_�����1����8�}�� |-9�'����H;Q�a"dŲ��X�`��VЯ��[���]=m6�D۬=ge�iPA�s���"Ue�������@x�i�2���Q��'!�'��r�@�˓ex��. ��D2*��1�2������<��%)էNmP��#Nje����ٴ�ڢr� %��#f-�QT�ϴ�l�9��Sz��h���2���ۢ���W��m�]}A,��;���&�`Z ��K�f�V��t'����\��<���FlWݪY�rF�B�A���-6�3@��������=�F��p���0��%��L8Ƕ+_�P�$���{}�iJS�v�&�D�H������8�N��{� �t����w�����x���0�:`�R�r��a���Z+��~�e������Mw�K�ιP��Cf�u�hL���^ v�-�e�$��z��Jr��m��~�RH�+'��G_A����/��@:�=�0�����t<�ԄX]�E��,-�x��;�#C�ꍉ��s����?��=�VH�7/�X r{��P�9���x��-i?�c\-��=N�Rt��/���'��~Ly�� T�g�8.�{� +�PȨj5ᦂ �DUW�4Z��N�_ig��q�yk���V�E�W��Ǽ)S��ع 5ܓ��7�m����D��/�s�5q�;k&O� dR�����ܵ �f��/�K�vZɵ@�~,�f���)^r ��-Ti��8�+ņ�����1�39q�K��% �+��i0q_��B� �r��RfP��R��]]�8H���?������M���� 5�I��AY�$��4�Q�KD�bw��>��q�M>�eO���yH��~F�U"��F+U�9��s�ffVsРA�g�X`�Z��9>*F��:��^x�)�+c��R��#g��Lm�:�0S��=�ҙ�ԯq#�^{�!��1S�Hf��9�n��u�4��;�!�"��N��u�� :Q.���Fb��<D��G�9l�~Б����e���#4a����5���A��)�ͫ�"y�<�" ����.�V�[��[l&��k���N��I���:żC�H�%Y��U�ԃ���r�����P����� �2بӥ~����˱on���`�������ӭ߰��`���]�BH��� � !2��T�y��r��Yh��IP��ܜ���w ��,h��9Ӧ�J��nr������V0��v�jV�1���Cu�K��j*���m��?��RqG��/��_X���?�(��J��!`�έ��j:�~��Q���x��ڎg�$Ԗ�S���������6阹�f,ڇ���+L�}כ���(N�l�-�)Pes����A��������f!Z������Yh��&�d-�� l�+#A{$)r� |%elĿ��#�ZҐ�J˵�sh������jn��J`�qc��g��,B���Am���xkңd�'M3n�ڊfe��$@��n������زL��e���_=���h�����J�j�������iH+�9�$��qTt�`��E>C����̶��=�ZR�Ȯd/� kE��XZ�3�;�ʇ�{o��W���uA0�� K�C���Y����Vdv'9���~��N|��c�T��/��0��u�k]\��S�-̗�RnEp�tat���'�x�C;�;7X����LpK}?<�Dg�o��C����H���4�'IYg�F⚤�^��f�9����ma�qƹ��T�rϫ���3�e����O�kK/��o���j��}�}P�tR�Z4�^o㲠�h��wvI|���W�E��ͶY�c���+/�Mj|h"@���;��ɨ� 0���le�Qe�v�Q���Y���~>�������.x��L�û��6��d�tF�E��r!���5�+r[2E��� W;�8+)��'�]��J�YI�*�x�"C=�%(�~�9�I�Jv�]
Static task
static1
Behavioral task
behavioral1
Sample
e0ba947620f2c51539d298185a23d7ecc27df7966a3e05b6052de40ebe113d03.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e0ba947620f2c51539d298185a23d7ecc27df7966a3e05b6052de40ebe113d03.exe
Resource
win10v2004-20221111-en
General
-
Target
e0ba947620f2c51539d298185a23d7ecc27df7966a3e05b6052de40ebe113d03
-
Size
1.2MB
-
MD5
9b6977b7dbb5fca9952504b4df2d4359
-
SHA1
a1038e088cbbc98d9adc2a8e915a841da865de4f
-
SHA256
e0ba947620f2c51539d298185a23d7ecc27df7966a3e05b6052de40ebe113d03
-
SHA512
6a3183f36b60a2c985f609a60d78c48ac136fff7abff7b4f339006dc270f5eeab8ab5898ccef5cc08da41e0db6ec7790c32f04914444543d27f7f192ac445bbd
-
SSDEEP
24576:uhBNFcaMc6EJ8nljggYwsswMOKlwYXq6gN9dKl4cwrz9e:QDunBEJ8pmIqH9dClw1e
Malware Config
Signatures
Files
-
e0ba947620f2c51539d298185a23d7ecc27df7966a3e05b6052de40ebe113d03.exe windows x86
c273b92d7d270f829fe6a83e81dc775f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
bind
kernel32
FreeEnvironmentStringsA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBeep
gdi32
CreateFontIndirectA
winspool.drv
ClosePrinter
advapi32
RegCreateKeyA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
SafeArrayCreate
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE