������Q���8����ǒ1�� ��F�P��֫#J2j����BA~-\��4��45��jW��y���w�-�k Ly4}�)�:��FE����Z����Ђ��4��Y���� �[���Jք�{���b��8�L)�U�A��UG�,��� ArbV�`�t��G��+�F��� �(C++Fҷ@�|�3g_���E��PHZ\R��/��E�Z�Bc��/�op�>�N�G�K�f��>��C�~_^槵�G�o�w���c�@���8B�ښ�,�R��� 7�JKN,Ğ�OT*|��MP��2�=y���q4m�L���= ���ق�Iٻ����s�o *ʦ<�q��C>���E�P�*����:�C���i����&�d�H�"�)��_`w#+�L��+@_�O��Bg�>k�쉥��n*�Wtb�����eM���a�r'��8ޛ�n/�G�+�������L���_�H�_���5퀫zm0�iɕ���b���K�q%�Π� \�5>�MD��=¿j�4� Gv&�e:��i��s!2� q�goR�)�>�=�{m�Uj?,Z����B��Ag�� �B`q���A���3�<?(��(X/K� �ʩ��lX��="BX��_�5���W���C7���ŘdK��r%�k*�j4"�v�K����9G�v��K��k:bQh��NP���Y�c-��9��G&�?�D�K�� ]N��:@g�zV8��S�� �+4���5~L^�h�3��A8�p��<6��U��B����*K��c�+@��?�&�hkK�0`hv%6 X���,���w{�D���B���6)ƅ6��I�~��V����� ���.Z�wR�n{��Vvr4��q{��;F,+��5�G�X��1G9��<U"%}��'�%�i�P����! �ãA������m���F�3>kg�r4���ୱ�q0E�����d7����fF��l�?�F<����ʆ��v^����b��[��#�SZc��ߠ0b�H��������&��#6�H�Њ��.K���gP#i�����w�[����v��O�GR��g�ۈ����zp�T ���%Ǡ����� -�@?�W����(�cjr��U���<I��������z�D���Q�6� qn�^�]���!,���VGS �z�a�;�S�ćN�s ��S����;��e�!1� ��A��O�>�*~D`���&���D��\�1��eNT���+�����*(`g�R^92�u&k[��;��c�"2>Ϥ�^��#/U�!ǧ��"�G:����_��i���j0�E��k4�_��9r��X��: ���Ofj�?!v��R���R���F��!�du��ok�Q�NV�l&햰�=}�6�f���H���A�UChyU:�E� d^�]��GŔ$���3��ҟ�T��LL��l28y�K`L�L�t^�|�E������]nE��GM�(?8s����&�g�&� ͢|oX_2I�z�����|�}g2<���rxH���i|���gJ��l*,͵LB�$l�S�ި��kM���3 af�)���C,?�7ĆU�}�H�H�6$�^��Ux�c��o�T��a�2s(^=:Gt��}� � ,Ӵ� ���%��#}D���߇0��]��������7N��%ѓK�H2�j���o58�����ee��K֟��#6_�:Q�c4J9:(���������W^+{��j�-�,D/~V\���%@ r�>� ��CC�t����n��}�~GV��[�N�\�SG���u�i��@8��2�+�\g<����H��8�[� �kxߢ�Zf�b�]y����n�% "ym�ם�>k1�t���P���-`P�3;67�A��vC���DtFQ3(��6 o��3��JB�W� #Z/�����?��Ѩ��Q�'Ur��y�e ˇg?���YJ3���(�f�"dAP&Cs�V#ʱ0�4�����qhAVk[���iA{� m/�� ���f�u�V�ǖ�}���/~7���@�"���Zr �rz_�tM:�>�qy��g����םV��h�a]m �BeH���H� ��<2p_��T���R0]�}�l�l�9�BV���h�ـ�I��լ�K\�����s���C��$�f ���Y+���4�[e�����K+�,N�c�5��\�����d���`�' �v��R�MU�*��ڭ '�2)�C�A��JS�q�L�F=��/�:�A�ϖZ���%q���E��� v�{�y��}Ș1^�x�,s�/�`,��{�B�[��T��"�'M�J�N�{������8�A��9R|d�gG8������C@���|��~�@T|_(�i� 74�0��8Q�v�Ly7% ����fMՎ?���F��ANGMJ��a'�I��ނ�d69��-���2��j��.:��Z(��1�|���� I#G>��E���G���-��x�N� [�H�2�(��?�H�1�E�{�2& *hdM��"&P�����T�y�%�Jm���Q��V+;|����\��J���@ŏl��������@��q)R���MB"�U�vdt.n ��pڟ�@��wd�L��.�����15�ym0L�S��+~|w��(�#��+7��k�s �� Q,ېqHܐ�<��`�_+I8؎b� ��B]��8tN4�M#�ɖ��(Rc�lSG�z�9�*��1�sxR�)r��+=TK���1M�]zL����u �cPV�>ѯ ޒ@�6����)��ω��.�t�ٚ��hzтs���]|j�I�r`i�b�OG}I��D���Ǫ�W,*���<y���U�r�;�~��v}涚��WC@���l��@����c;��G��'��<�[p/oâ/�G�!0^� Asg9������N��q��@�^�7�{.�)U���3�w�9������xQ���P������(HC���۾k���@����g0;���_�:*nČ8Fl��^�ΐ)'QC�8x�.<���^��5����^����֮q@ߎ���5Ǐ�߅����t4s����q��2{Α�\���G.��X"�P��
Static task
static1
Behavioral task
behavioral1
Sample
015489c719116a462e1d9cf7583cc1b662591ca72fc0790dd23eced3d9117f3a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
015489c719116a462e1d9cf7583cc1b662591ca72fc0790dd23eced3d9117f3a.exe
Resource
win10v2004-20220812-en
General
-
Target
015489c719116a462e1d9cf7583cc1b662591ca72fc0790dd23eced3d9117f3a
-
Size
1.2MB
-
MD5
072411f641e38a7da594ddca39aa70fc
-
SHA1
9fbda6461088bce556273bf4db5c347b62f18725
-
SHA256
015489c719116a462e1d9cf7583cc1b662591ca72fc0790dd23eced3d9117f3a
-
SHA512
1934dcede7c65750ea4dd93a4466bda5ec57288763a3ef357d2eb89444d3e2890a28542aa80e5f6de7edef08d4c809371bc7d975b33579c63ce09f2c0aceefbf
-
SSDEEP
24576:A9wbeiHMyJ0TxP6I3FYhNhPxMxP1KAALvA6IWRLLnijs3VNtlqPSkd:Ewbe1TxyfNhPxqQAALvA6IOji2NtYKS
Malware Config
Signatures
Files
-
015489c719116a462e1d9cf7583cc1b662591ca72fc0790dd23eced3d9117f3a.exe windows x86
fa014dd8ee5b5254474725978b8006e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
kernel32
CreateEventA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsZoomed
gdi32
ScaleViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
VariantChangeType
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 414KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE