�I�"BQ�)u����"ջD57'a��Qm >ѧ=e'|C�IR.t;��yD�A�;�g����a�1 a�Ɖ�7Ef��Jݘ��~���Ǣ'��zr0��;'�iT^C�2u� d)�����nhYY��칐��ꠑ���OZz�V�FU�=�Bm+Q�g��$ˡԅ�┲ڊ2O�(ڎ9������r-[���謓#P� ��R��n��1�~�y;G���.J�d�Js]�����5��0U�0���_�B��:d���^c�T7;j��G� �tCpM_]{K*A��к�:��2:9��u�0����r�_'���/M���"�ʾ!��N�Ȅ�9G�9�$}#���v��rG9"��a~6ޜ���t7'��R�!�����ֻ��0�����_�qKy�0y�80���^r93;6Y��o�ѣI�<M�I�˽��+� ���Zt���� ��i#Al��YH1���(� x³��c]S���?e�l3m��0U��I'�GT��ټ��r�2���4�#�r��7�t>M�9�ܗt5Έ�>($����'�x��o��#!Rs��++��~:߫�#��f�x������#�p��1 ����"�a���������l����A��8s;'��� Kf�����i��|�Sz{ZAtw��L�����)�f�ܯ�f��b���m۪��B���/���1KV�2X\7����*��˹���� �;n����W��1����$������f���C�Ϊ�غ�F{�'ȍ[ ,���OTs�����g���d/]�ӧ���O�Kِ�Ǿ��t�'�̆��;s��E<����C� 6wJ$Nl�M�FU�����r�� �X��ԛ)�߷=4W'�z�g����u���<�ƖI�N�MV�k�$[u�� �N����;S/!��03�d���W�y�^C�՛�O� ���7��Nٵg�� ��)��L-�_I?���ƀ_-��+r�*1��!���X�1��J�R)hf<'��U�+�'K?���e�m��l�`5�)��M��-��^���}�c��گ�nKCB�v�Sg�#��?�[�5��0^�[���Y�������:�K�D=v�o�[�r�q�ū�Ԛ�f�*��ԭ/�r୯�a���U%'���"���seY�9 ��/�j���I��G���R;�j�������L��aO�7�8\����YEN�<�KkY�y����TE�{�Ѐa �"���y����Upf`]��bh��ij���Ջ��ύ\���"/�ظ�`����o�DԼ?�����t��%<!��}V�ӖTl�*اW�o�@���J� �w��2��s�����\U�8�χ�. a�h�m�M,U%t� 8I�Ű��i�[��貖�����R`v%�g��A$�CI�b��1v�]��p>|뒬�"g��,qiGN�|��J�!4����g�m��7|�al۱KD_�����˦��`r�̮>T%T�̾͋2)u&��P7�ij��>�yP2�~T����\�4�IO��,�^9<~ ���k�^����n �jω��a��9˭�<�N�z5�س�+.�{��j����(B~o�j\��l�����[q��7@e8PD������j�7{��Sv��� ��a%r��`_Pd�WrM�]�!#RCF�yl�;4��U]� =��u� ��0�Q����s���IF����&Ob'W-�c���E���(�*����JQ�Paq3�l>����PhvgF��P�]��+ �j��\������xN�pe��AʐR����$����L0��]��V�I$�k��'W��Y>XM�j.,�_+��G/;t�0�k�#�=����QrtG�uJ�6��ͩ�{���o��N��i3=��o����D�����l��/,����-�I01eF���}�1�������S��� �����_�� ���r%���ivV�5{r�cW�J��g��oX��� {&���d�d�}Q ��֤��y҂���ks������n���3@hJJ����l�*��k���� ܺ�/�<����e�?F�j�ǜ���q�t��Xw]O[�jt?�bb�ϖ?��!˻j4��m,�}��Y��zq� ��������t�*���H�Ju ��� �&Y�pY�8c9��ϵ��g�i�u�!>U����՟�����d�I?����*���� ��7��x'��N?����5Y�K.Zෞ����5K%r�~n�e��vf-'�j���ޣA024?\��V��Y��%�PLL��0#��|��a(���A� ��e��@u]e<X�ɓ��U��������wc����w��kn���w�T����85]kZنS<&>�3���!���L��x�`���ꦭ�����_> ���0 ��l:�7�Ǽ��o�]�7��y�A1��C��:��DZ�3��S����}���~��M5����wE$ȡP�5f�Q���\�<��nL��n^dG��wؐ;� tY��3�{6�3'�;>�0\��{�F�8Ņ�{�:*lH"��Z��)�)��:EPF$ָ�#;x�7�ڎ��������!^�p�M�������{���/�wÿ���7wC/JFaA T)�"/�<"XK�o�g�i�b�2��92�L!C_�D��r1���w���}ۉ�x��L�������y���b6�`Kb�V���I ���=o4����՚�q�\Q�ZFuA�5$�����q=��*(GUw���X2J�`� ���lT���W���*���Z�<S|DCo� �";���$�z���<6r��W<h`�.7��w�F-�,)�r�!68yZ�Xg)dXy�7��o��f���P;��4���a��$��:y��B5 ܗ;et����0Ƽ��N�[H�X)�U=x��pw�P�W��?�}����-��D~���z�?��T�N���3��c���E�~h�я!��O��X0A��:�u�-�8(ST6Y��+��T�Ei��,J�'���|F�[e_��+�J��L�Z��̚����l����GE�"�֖�,�X��䙨��?D����J��l^Ĩ�ۙcDp��LR �[���X*X�y~�`.�?�d
Static task
static1
Behavioral task
behavioral1
Sample
07fe9456e794b6ef4f754e34c50f085ababb73178d01a734a7c1bf817252e70c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
07fe9456e794b6ef4f754e34c50f085ababb73178d01a734a7c1bf817252e70c.exe
Resource
win10v2004-20220812-en
General
-
Target
07fe9456e794b6ef4f754e34c50f085ababb73178d01a734a7c1bf817252e70c
-
Size
1.3MB
-
MD5
4075207a4b81bca4a0e4083cb2137aef
-
SHA1
b3a3e87fcf427370e1e50321daea02983834b162
-
SHA256
07fe9456e794b6ef4f754e34c50f085ababb73178d01a734a7c1bf817252e70c
-
SHA512
a1a0a93b4586816e427ddce8d74b6cc971bc9d77973c67630ed05b249e8c0b55f625fbfa856eb9c190bfba2ecbac17f465f900bd70534bfb28431ed0ee632aa0
-
SSDEEP
24576:ca6jsJTnR9Q6lfijV9rrvRzGGvxF/5eTB60ygTnvtqV6z4rn:X62TR9Q6AjVJT8gGB6KvtqV6zm
Malware Config
Signatures
Files
-
07fe9456e794b6ef4f754e34c50f085ababb73178d01a734a7c1bf817252e70c.exe windows x86
092e5b114933aa150d238a9a75f65673
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
recv
kernel32
SetCurrentDirectoryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassLongA
gdi32
ExtSelectClipRgn
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
SysAllocStringLen
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 402KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE