aV��������}�����^�v�TF����ꋹ������ڄ�T����i�U��p=_� <p�H*����*[�q�A�p��;���86�ƈ}.������C��/p;����U'� #��F\7f�v�<���%A$N=O�2��TNH��6'g�}F}��(��Jg�a�j?���U~WV7���� �����8�G'��S}C�Ϟ ��;n#r>Ft[�g����$S�S�c��r�h��ܗ��^8hK�Kl�~Q�2C���?S�$C0{o����Q�[�Y���0-����CME���~�'ɂ `2~}�ҝ�����cA>�=ل�U�K�9j�}��gw�j�F��Az� �x�!X@m^$� �9}B�`�R�$m���Qq�:VE48w�p-��q�h;밵i7�"�N{�����k��%v$3^gr��?�c����+��*Z]@`f���h�w6$��s��N�7�Tg��`D|��Թp������7s��� �@��v�7������Z�y~���Y��I��ݚa��V�j���P��@�/yo|������7Z'd4� -��s1c5��vYy���B�7A^�b��؏��{���^פ5��"�����?����B�c�/��=�T�w.�I��-D��G�<�o�O�]���J��d����ՉEr���@4�g���e=���ca1}I���Q���]��'��a�4��t#���sqH�ٲ��6W��8��pg���\N��><�3���H�����n�s-�O���OƧݰ}��JC��� \*)�FXe�a��]��@�ngK�L~U����DF�����x�o-IwU��63�O ������[��g��7�amHZ�>���:� �?�=Ff�m��c}��_�y���c�/'����P���~$�$*Ai���@+fXxW��2y῏�ۮ�L�:y�gSX��n2�D�\��b\]�M3�yF��83�K9)*�*G]����p!$�R�����t��h�ŰO��Ƿ�v��R�~������ʎ3�c�����f+Ifk������=�d�l�Mg$���.h�ND��v 4�����>�E���a�o�Rz��u����"űA�|MBi���[�*f�b1-��{/�I�0���K:PE�X�x�1C�4e�B���Y��A��/:��Q����j[�W���G�A����$:Ғmn�}��!mG;�UN����dU��ˑ�Y'm�Ҫ&�[�-r^]Y*��Lq��;=��#�o�e�k��T�~�RD1.u��'5�@ 韉���\�^1�-���~f�*��Fg��_��w�K��m�AW:cy��Cc�l�}]�W���o���FϞ������! f?E��М���3�k8�E�gJ�9���ȗ��|ALA>[�ɔ���4�Kq�T�l�Qg(-��߶!�P �/܃ַf���&��ۓ�ڑ��AW�����P�� lz�-.p�Xţ��48��of�e�-�� ����Gd�L���I�ClH�hu i}��5u?�\�g0q�~):H��s��~�K���ևc��$�N����K^�۳3I ��=>��K�QhL~.��A<�$Z��=1����q�Vp��ݕ�i<�lO��I6rY���C��w@]��a���u��-�%8o�P\�|^[������I3(\����X�"�;�Q� �CH�����JcK��Cq�Y(���oW�<3��%�Z��,���ؘ#w9o[�Y*��iT$z#�RH�{�$=5�����U����U8<SHrp�S�ʽ)��&-��Pࡊ/�#̬,h,6M�JƊh��{���b��R�ys��(H�k�~/�� �c��9ͥ�@ͦe�bɏ���$|Ƹs(���g�z�bl��̨���8���,��'0MG��k�v�`���9�����3�"ZӇ/��0�HP�0��B$T�!��&N�?r?[+(1w5����{��U^���ե������� �1U X�M�ʖel��V+9�DmHu�����tse��1��{j<��Pbrۍ0�Z��V�M��J�1�M̅�aW�Tw~�ul� �%!���/t�3x�D\>霭:Q¦^,ŕno�yu�/t"�!��Sc9P�'D:�~T:U9k���t�[/ٺ�d,Z�8L::G�D��z���(3���_{�&����|i����߬�~���%_��``.�k���`zӀ 3��):��у�iPM�ݽ������}�E��Օg�Ri��Z;�xRj��U��Qoe�K>��l�:;��)<�#�_tQɅ�!�b�xH��+�C�D�ɡ�X��'礟qz�T�3RQ����I[)5e�7"n@/[�z�ꂻ��B�P��<�}��� ����|5�)�#(���0P��"�1!Fp�>2�%���߳D�)Тf�3r�Zq���̰B����>H���A�����g�;SX=�.�ф $~��a����'� �o��<��;���\IW+����t(�ٌ��<GD�W�\�'d~�0����V7��qQl���yw_�ī�h�өc$�������I;ͪWH����4 �S���8kkeIk$N�~#��d�U4�!#��_�I���6�I7;^�����m?s�`Ϫ�O���T�qj�:�y����10��|��<*�d�c͇�9�5��{s@Ra�)�?Mi���h�N�<ۏ�n�Ѡ�v�=�Q�N��LP���>9Pj4����X���V �~�cd�sa ��"6��&r��#%̽�=vT�/�_p��?IP?��� ����y�ԟ�gU@ �"��OT��5\r��ׄ�u���+�;kk/ 3��#�P{Wѓ��V��gC�:�\���Q�gK<��2���?��"� ��%+�]�ʙ3��B��PjUO�, k���(h.���}�/���w����֗����Zλ�(F�%���V��#��G4�Г'Ek/��X�G�}H���Vf������ބ���%;��gعǦd�ciX],�`�_k�"աX�v1M��u���K���D@��8�V L.��<���[碽�GbI@s�Z��φ̐�vJ��g)".�
Static task
static1
Behavioral task
behavioral1
Sample
24018db4442dc03766fb47c299d2f265eb45cdd22863f66454030b68bb2c187b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24018db4442dc03766fb47c299d2f265eb45cdd22863f66454030b68bb2c187b.exe
Resource
win10v2004-20220812-en
General
-
Target
24018db4442dc03766fb47c299d2f265eb45cdd22863f66454030b68bb2c187b
-
Size
3.5MB
-
MD5
1e01834dcf2db275829d6ed1f526df73
-
SHA1
bad6581b9349c0a20c7c5c916ceb443273120731
-
SHA256
24018db4442dc03766fb47c299d2f265eb45cdd22863f66454030b68bb2c187b
-
SHA512
e567051f3760196eaed07f67f001d200c17b77aa3dee1d3b6f64fe705ded4bfd1dabed42ce2e6419a4ab9b571391899633f6bffacae841c8af9f33b63f0f4110
-
SSDEEP
98304:2zgc5em3P3vJDXbYqJTMYye8H7oQ3lMbJ68xWIhvJ2smT:dcx/3RnMkU7oQ3lMr9P
Malware Config
Signatures
Files
-
24018db4442dc03766fb47c299d2f265eb45cdd22863f66454030b68bb2c187b.exe windows x86
238e6ec26f6add794bee500f0843bd80
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
comctl32
InitCommonControls
gdi32
GetSystemPaletteEntries
kernel32
GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
oleaut32
VariantInit
rasapi32
RasHangUpA
shell32
SHBrowseForFolder
user32
UpdateWindow
wininet
InternetReadFile
winmm
midiStreamOpen
winspool.drv
DocumentPropertiesA
ws2_32
gethostbyname
comdlg32
ChooseColorA
ole32
OleRun
Exports
Exports
Sections
.text Size: - Virtual size: 900KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.����͵� Size: 12KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.����͵� Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.����͵� Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ