�f��@�R�D����d�5�p�{I�J �WJ���ǾF � Af)�v�8�c����^��Kz�-����ۅ�{0�jh7�Ϡt�B��&���g������:���T���K��C�T �,K�"�.J�ȫ���p��w�!7a#.�!�e� �����|5�6���['�g{Z7�~S�YU��]�ȔV�ks���yj�v^��<�:k�Ҩo~�Sg�f�髰2R���D����F��H=�;(��t���r�)/�I�Ĕ��d��ġ�,Ys�n}��Aw� ���{�ԡG+��5YnޏtY/�4���k��[����\���(�*��V�î��'>��%��8P5T@�yq;�_�7qGD<|mCt�mXX����� b�X~d݆5$W �<>�ԝI���B��>����~y�%���c�GM�*�S�$���lcq#�8��ߢ�W����_A��/��M����p�E@Д�慒 x(�"[�����߃o�Y�M �BZ���`�� �I�� �����6���[(v����H���.5١�_��,�G}������@K��>�>i�����`MG<G?�Լ��j�duIl��?�_|"ʖ* �nd��3�w�N1�3x̿K���h�2�n���Q�⢪��:�� �W�)�N�ҙ�2�� .`�A��uV�a�9L�Ʒ� �S��a�lJ�[)jR��� z�S#v���T/P�"'�l�3�;����\�Ol-rC�F�K����������� r��;8��v�*������(�d�u�Q��Ӝ���a3�uo_�%�8p��+9'��M�a�k+�9P�j~'�V�H�y��KH!���[��K���hp�C6{X⇉D���!���j2w~+�)G���ND��h��"���re�}��B�Ĭ��6<\�2-1?0`����׆zI��J��u��*͡2��՜�F�g|��靻��g��.�;�KO]�v��@�"<@9x@�� ���1�Nt�~�%��p.5r�����D�X,�잤18�R��=�lk�S1��N�8i�'V+Ň�_z�������.�S+���)�S�t<G{T����Z>��"@�#�J>��օ _�x��>���+�A��<� �j��a���uiH�aƫ�;J���9U�l2e�/̅�,�mNy�趰��:?�d)i~�WD��ԁ=�s�Rg�7��1�#�&:K ��s�� �^���� �N\�[�շ�m�� �b��݀��L��8s�7��5&��J^�)�hZ�ga�=�}���-o��5��n/�f& ��z�Q��MY��V�ȴ&�B��b*�P|������ Ut6��/v�-FE&%��2���cۨ�\ٿ�cԙU.��9�[ѭ�L#��(Q��<����H��εKT�p���Qj#�"Vm� ϴ|"��Kh?��4�y��7��� S���k��Vɉ��B���[��bp(AG��tp(^���a�ۖ��H'kX���ǙsA�@������:�$�p�<�����Jlk�r���mJ���L�/7��05X�3N8?0B��H� s\�\V�<���m��7N�� ��;7�g���3w�aqU��Z�\it�P�ЛE�W1���d��iF��sـ6~x'�U0ȓ���SG���Ӻ�(J�?0��m�8�b�y���)���AT��n�y�2�K�.��D�6�W����bRb�g6_/=���5i-��H.�;�:!�:e�Q%�'���k6(�� o��gدe߹ �`���Q�X��|����Jy}ke�X�OSuP�&��C�B1�:�P��Ieϕ����J��� \�TX��f��&���9L�ck�Ʊ��L��3^� �ܔ��Q7eE�X�����Z>��KÄP���`�|+�G���� td�kD��p�~�<S;���ރ���z�c�����M\�"5�\��%���.�k��,v�5,�6C�Y\k�!����'��:��'��^$k��4\��i��{�ߚ��Բٿ�>���4 n�G<q�� ��Fk�6��KƷ2� ���/mWH�Ƕ���j�Т5*Z�AN5U��Yf��5��&��e�'i5w���������-gǭN�Ga(Z�ρ\�fB8�<I=�/d�Cphp����F��i����=5���[m��eͫ �M��ӝ����\|NNy��y=�`o���ӱ�KA���_v7��Q �?��:_�g���3�h����hR5����V�*�?N��Y���`K���%����KX�Fe�ʨ�.84<�ө~tv���kև-zݮcӛ�~���mZ���W5��!gc���'m��|�"����-dohď;�qw�61n��]�l�}=8�6O2Tގ7'�)7D����8�hQ���U� <�뗔8#(��aQp[��`���q�,�'$"�d�Ь[��Q_Acb�JR=`Ow�~÷/"��Z:�Y�9���a<�����y4[�yb�?� gb*�#��֗m;N>���ߵ��Eg�4���#�N��������_ԾXg�ù+6ymȞv����D+2�� �����c�3�'Os����"V�!u��Y2��1��,P��2�a����'�O� �r=Oݶ \���Ǝ��� �&��`�X���|+,м��G�ϕm�������L"z�d�o�0#���e�n(d �JN�##˞9��Z�@{h��|��:��@�̪NA'Z�/�A��|�_7L�#;L�[~�`�a�������}�{����$�� �J'�4�m5B ��L���f,���K�C4��� 8 "Ųưr"L_�ȯ/~�1i�n���C��|D(_���9SV�� J�D�_�H�O�)?T@�}����4���TD� &S�����q�~�����;1�Xe�@x�>~��g>�{J��,���!�!ȭתgv�E9ئEh����yxq��J�������3a�r&�I��j�A1���:z �e�d������L���6z�u�KA����XSL$5��T���¬O�T)���FV�A&�9�Z�s��-�g�p/�*��Ps�4@�+ƙ�$#��8��Xp����zYL�ȧ=-g�c�]�@��r�
Static task
static1
Behavioral task
behavioral1
Sample
7c8f4825687a3a9dc58abd10c3e989353a3f250ea85caeed09d70216dc948d78.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7c8f4825687a3a9dc58abd10c3e989353a3f250ea85caeed09d70216dc948d78.exe
Resource
win10v2004-20220812-en
General
-
Target
7c8f4825687a3a9dc58abd10c3e989353a3f250ea85caeed09d70216dc948d78
-
Size
1.3MB
-
MD5
06bf3e097cfed14578df1bdad6ebc395
-
SHA1
364a07bb79f40b1809f3e60af299ee1e5fb567a2
-
SHA256
7c8f4825687a3a9dc58abd10c3e989353a3f250ea85caeed09d70216dc948d78
-
SHA512
f5bf9a472077499baf64c5cf73e5f41ee03b8f4a2681901d5bc6564ccd189f6be24dda2280904318d5522e9f8790cf53eea6d44856124b32ce767553d5afdb82
-
SSDEEP
24576:XZTEE0ZVUp7BndHy24zlOvvqCR9aW32z+UegXuSAeyGB/UTGtS7IQfFQI:XZTEEMKG9lIS+p30olsyi/I
Malware Config
Signatures
Files
-
7c8f4825687a3a9dc58abd10c3e989353a3f250ea85caeed09d70216dc948d78.exe windows x86
3a5fe5f9217a6ee9f28f994e76f1aa71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharLowerBuffA
advapi32
OpenProcessToken
oleaut32
SysReAllocStringLen
version
GetFileVersionInfoA
gdi32
GetWindowOrgEx
ole32
OleDraw
comctl32
ImageList_LoadImageA
wininet
InternetOpenA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
CODE Size: - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ms0 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms1 Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms2 Size: - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ms3 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ