.O��7Mx���CU�|�>���f���[A��u'��E��[�w~�&��٤v�-HX�.�;���!ܖIP��)߬�x������L��/Y*_�t�j�G��g��)gv=贠���݇A�s��I}���Ë+mV����zm�8K�+��� ��;�����~%ɝ;�Ξ�U����7��@��Dfʞ��e����DTR�=������� ��h&)�1d`���VD��J�Q�����utr߁�����m"������S&K �Uh����]lZ�9�$+C����~�h,p��& �,D�Gj�o[��.���a[)|�G�`:�/?�[{`���^u����h"gL�_���Q���(�86�Y ��l�@����C�y��=�rh����e�U�zn��[FY)yY�!�̰� �Y�?B`�� ��[`���L���)�h���a[7k�lM�h��j�d둓xk�1�ӌ�nkuc���X� ������tG&饃��ԕe��Ջ�� [&��iW��u�M�>�O���d��P,����B�����O,M��ؽ�W*V���7�4p�ܡXr4�3L��W걽*q�^Z��P����s�A���ǝ�J��hJ����NxU0������YI�º��~\�����G�_pvu"��@�"���GaTq��Ь�X'S��-�!ŏG`čIUc���p�~���۶M��ZTb_��U�ٽ\��ũ<-ϳ\7ҁI�Q<���@�.KsUˍ���V��g +�>�sO��F�#-���������)`�P�]tG��f�"� #Ƅi^g������l��RP��v"�^���s6����:Ŭ��Ijr�rҰ���P��5�X���I�RWi"j�TN��U`�ђx��l�)�k�*����k��ymW�&�(/��������tu1�� G;F�x�X�&��Y�-�[��vZ{ģ�C���('�s�B#'��C׃�̣��iV�IC�F&��a1�E4m�cgv\��3R��\��;U�j7f�����Lz��R�Q�i�=�_ϝ�5�{�������J|����S��~���=�B��KڨޒCk_4�C��ވ����6nYP1��϶���<�6,�)���n"7���3��'��1��� ��|��������D�������<<�IH�)�]��'�N!�YB��Yi|r�?��R2\�H�����y�:ek��7�_��~�5u��xԾ]���Z���ct�z ���=c �"���m������B������K��-��Jd��*���bl8B-�<���B���]�#����,��_X.7�2�s�����n\�1��Nb�'Ƅ���O���=[z�� ���ps�|W-��������6Y����I����� �<�WO�����0Nj�G� �WN�('ӗ8�y��Q�Ǐ���� Hj[�㵑��+�^��]��F��7�X=��9;'��p9./H,+�(v�U��{4��]�q���}�i*�1�R�.�3[�.سen��oܳ������L�0����yS��I����g;������an�h J���i��X�y��R!�p�#H������%���o�}n-w��VV����!�3�V��~�ǁ����/:��B�&���H��%�4��P�J�V~��ȉ�-w/N�{A!��F��ЉэL�DG�:|�r�5z؇�Ȱ�1+�ӓ�t$�-I�kb���~�� X������!�ư�$;}��Lb�Ƴ�ܱT��$]aw`OU*9�Q��π�a�F���%�yd�����~�h��>QJ�a'9��$�(�f2��R����Ӧ���\�`-8��a/^���&�h��:��˜oQ��:�p���d������L��.1���m%��Ȩ��iANc�`�����y5$��#X�[屋coE�ku�c�+����֩i�<E�$�IФ��J�2���YZ�x��%,�4��'\6_0_�h'��$)�C3�2���W��o�*y�)���4���ʊ�cg���X���Z�|:�_�)��j�-]�)��UL, uj���r��^pM�~{L��O����Y�;�����O�u����.��uI�,�Q�7�wQmƤ�b���i#���3F?�2J@/��}�os��98T,J��2�I��m������_L����u'��A�ͫpl�N=a�)<D��p��}��Q'��t����ӱʰ"�8��+"�DVK)�֣Š;��5$VQ+��t�cm�������R�a�Mh�B�գ��r��A�<�D�;�z%��*/��82S�(��Q:���(��x��#����Y3�x�� ����x]<��K?��T�.�&��'ҞY���^[���ORX�l�C9E�_-��L�JJ�!�$ \����虸���H$=6�Z6(��V`�d�0��=�4��N�oM������A$Ȭ]0����'�O�v�{e��0B� ��e��;�E?� {�$ I<���46<Y�+O��BU�M2�����Z ?����~���F�cr����� ��S�ná�������Eȱ��NT*s��2��s�6�(�c�}��e���<���@�dl�F��l�]֚ �%:��t�;Q�p�1�Yj���*`�q�j!5Õ�Iv0���-I��j��?f�����Y7���]O9�y/�h�82@H��x��knLv�����M���Ll��~Uq��A�G�Ax���%�~����`�<<�G3c�M������jD�[�*�` ��������a��eLklZ��e�3������<��Y�:��u��� U����0��kjlT��{5g׃W���M_���g��4��f�#�7q�W��y:9�y��'^�|U$���F�$�L��Qn���Sl6*������K���W�=ל�w��l���Ȕ���4�e�m��ݖ� �\r��tˆ�%TW�'1����"��6�Gk�̦�j�2=͌T�E�C>��=.� ge�p���:�6�]Pt�:0�],���W���W�G����v�J��|H����d��Ih�`d8z���7�1L]��0�4k��n����J�l�
Static task
static1
Behavioral task
behavioral1
Sample
8dab0529866812b14ef1fe9edaa0ab8d58199644b5d8f27eb4ae1353f624d8ca.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8dab0529866812b14ef1fe9edaa0ab8d58199644b5d8f27eb4ae1353f624d8ca.exe
Resource
win10v2004-20220812-en
General
-
Target
8dab0529866812b14ef1fe9edaa0ab8d58199644b5d8f27eb4ae1353f624d8ca
-
Size
1.4MB
-
MD5
74628464fba9da46b94d980f035f483a
-
SHA1
d836599c97413c3dc25ddce235e9635f7ac6609a
-
SHA256
8dab0529866812b14ef1fe9edaa0ab8d58199644b5d8f27eb4ae1353f624d8ca
-
SHA512
3022b7cbf16c07d3e6eee8c746f8f53f66fff81f81d06dab28f621aee8ebb23f2572b38c419739fd65c567a37928f399441fe603c778fc68a4285656477a4d48
-
SSDEEP
24576:p23KuNWsbEddfs2HBAvA3gMNhxcgBvxZkC2TM9La1mx1jXP6LJDqU15Zbx:JNRdts2hv3gMNfdPk1mL2LJV5n
Malware Config
Signatures
Files
-
8dab0529866812b14ef1fe9edaa0ab8d58199644b5d8f27eb4ae1353f624d8ca.exe windows x86
179dd8604d9199fc5d8a67376c796a06
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
recvfrom
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemID
gdi32
CreateCompatibleDC
winspool.drv
ClosePrinter
advapi32
InitializeSecurityDescriptor
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
SafeArrayUnaccessData
comctl32
ord17
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE