�m�8P.��?u0Oh��GưÛ��k�� �E�Le��e/��k��D����b�*TW���ef���T�ON/� �Z��Y v+�\�~6���Jh,7Ɍ��t�3ȿs(�]���M\7K�o���^������f���%��:�ǔW�798�K ��?V��i��O�ry0SوѮ��3����)�],:D���)�7f;�p i�قim�n���;QUN�ӳk����Z6~v�dj��v�h�>�W��o��� �{���W��H��7'��¼�%u�v�Du�q~f��ޭ/�Qڜr>�ɖ|���`Z�t�ƧZ>|������l��6�5�y��6r��M�c>5E��D�*�9Y�=#����pzbjUy�<�Mt�n�v�eTq��{+�0VcA%.<2�j�LX����;�Zc��|ӜS�xs�[��wכ@������������A�T[�j9�j�}�G�sS���N�2M����5!���*]�� �뭯����<����2�mK�=�U3���U�n1e��*M�~,Y#�� )�te �]�XS�5}7�"�/��bj�Lk�!�W=TLO���<{4���k�T�d��s�$Y����F5�N���ǭ��e���%�,/���8@qt5�J�����}�B�g�����2�)�o#�f�O�s*��8o���}u3b��G�� Ȁ���3��bjp7�:>���6�R�U*�� �;�f��i ����\�<�4�N�`��r�Y���%���� �����iEn��M���z�6��:W�bӻbxd婛:Ah���c�( �Bt2C�3N"m��s��\�N��.�H����@i�Q����؈��Qi��v^��aïBk0n��b����(��z�!�2�\�Z���fi����������M�Fh�Qlk @8����|��_���� �8��,���(����Z;�y߫u���'�Ν���?K��eb= 6�ݷ϶S�_��1�e�Lm�"��ΨR8���h�r�aj_ԗ��фH���d ��զQ����� �����&N�?L<�EF�Ѽ�Ze;2��߿o�����k9�+����� ����+�rja��k���5N��p@茣ᆐ��|�D����!�N�ʅV9�� |�r-��,��M[#.�C�{L$�80�� b~?Y� uL��?�?p�A�+� ��ݣ%�&�o�YK"h��|����C���n�Lľq�'�W=`�l%�����Z��F0&���^���i��$<��@�W:���Q����� �0����ZR�ͭnp�g��fp\��K�i�UB���eZ��ո�!2���8�d깈��Π_�1�G�������H0"��`�Y�=-.���D�L}��6H�� �R��!�y�_r��ڡ���f�ZnK[{Wf彄0�� �!�g�)q�� CЭ���e���o���"ُ�_'$ķ����g`������C�7��{��0��=�Q_.��̋�9���tQ��Rq���9���B@�@���LOC�n3���p�a�-)�g���vT�E��zn��g|u�6:�Kh,m�QN�k�/9 l^i�iЧzj��/_xD���m�#}⨺���5l��=Rp8&礕�n����t'8���z�����`�溽���<����r���Vﶅ�@�$L���J]H��Wÿ��;h��v>0������ap��a/nr.F�ܓ��~�G�K�B֊�㔒7�����o_5�T�������Q��9����6����h�ˍ}�X+��<gGû�(��^���^�VwU->vh�gQ,%��6~�-P$���P��x?��=�����V���h���"4Ԑ2|�3oc������Y�]h�ޯ��Ɋn���,��q����̒��l��}<��ʷR� A�%e�\j�;]f�!�I����њ�[-��0bU���-��8~��QI�>��^��OR�BqZ�1s�T���Y��)HRKЭ*t#���ɨ?y؍x���7��� VQӷDڿty���9�G>��ǀ�ҥ�b��6���Ijg��=Z�������5C�4��z�B�*Ʈ!�{T��Rf�5ܢ3���!����joď�H[���9u����D��y^�$/�Zx�]9������*$�`�8�JjF�%�0����.u�F��S�ُy��-g�wъ��IH��-�X�PP�\����<�%��BJպ�D��J̈́?Ƣ �z�1i�mZ��g����ۤ���l�A����T�K��� f�Z ���.���P�fM>�q�ɧ�u$��)�����Y�8n#j�n����u[%��H/&���m(�M(���D�ZX��jpUG��R��B����y1ǒ/����w�>�P@�+6�2��^h�f �c�oS�x<_v����0FI���%�KǒЦw�t{�������������k�v�m���,4��/ռ�K������$�C4�ސFwܢ�6���ao�Yz�L!��� z��暜��ˤ|G$a�H� |,���RI�I" 0�����a��,oA�3��ּ1��A�}=��[���g��.F��b#.H��:��Bm�֙����4c��� �O=�����Rc�!d��=]��d%0H ��썖*��q��c)k���r�wu]{/���Z]��z9*�'e�~K8����/��Jʖ���ξ �X�&���;��Ym9�b�F Yf!![X�� ����@M%��>�5XHt���wP(% Ѵ|GxqkO�gJ��������M�'����ӽ���F��{�f�T.���Ĺv�:��a]�ӱ�i���(�"��v��{�J'X*H�:�$�'�5���QI�J��j���~��Vu����Y<_ ���s��d���,<#;���ˑ.�LS"�kE�!Z�5��<�z�l(o��K�ƌO3R��&u�?�=D�l+�ɖ��X���Ɂ@����ت�a��UZ�c�Yh>��_5rJ/aCf���ƶ�Ra�`��-��KWI�0���q�Ks��V��&0����(��=�S$9�,]r⃤��Z�]� �m K�ٯ�T@/�\<r�ΰ�vM��
Static task
static1
Behavioral task
behavioral1
Sample
c5a0958fe1645912e96b80743fd1f4daa0986e32896ff713865bd99f3fbb7a56.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5a0958fe1645912e96b80743fd1f4daa0986e32896ff713865bd99f3fbb7a56.exe
Resource
win10v2004-20221111-en
General
-
Target
c5a0958fe1645912e96b80743fd1f4daa0986e32896ff713865bd99f3fbb7a56
-
Size
1.2MB
-
MD5
ef56be5f56bcb459f8d2655148b4bf07
-
SHA1
8a367bd3ea34f08d3f99309e444aa33f907fec67
-
SHA256
c5a0958fe1645912e96b80743fd1f4daa0986e32896ff713865bd99f3fbb7a56
-
SHA512
6ffafcee7fa405544ffe09a735f5fe92503e867b5dd075f4e0b60489255f92465584c2dedf874c8eb0b6e84ce4ddd5d6b4b10278234f48e1fc6e024bebb17ad5
-
SSDEEP
24576:eQsX+nbs47oXH1bd8BTN8i2cjHUN7DhIZyKPpvIyW1DSI:y+gfXH1bdwTmizHWn057qG
Malware Config
Signatures
Files
-
c5a0958fe1645912e96b80743fd1f4daa0986e32896ff713865bd99f3fbb7a56.exe windows x86
3a58a281a3cd4ced46eefc2cdfd98e26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
WSAAsyncSelect
kernel32
RaiseException
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostQuitMessage
gdi32
Ellipse
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 414KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE