�����v&����� ��6� ������z�ރ���k��m��b)����V(h5R�.�h��I3&����}�����E�1�����u� �����-��^]Z�g�ي[l;��`�Е&�ta%T���KnpS�,����|@ti�͐���h���������2Ead����ݏk�����N���x(������$��BV�5�#;���ݯ��B0�e��B_����Kj�fK�����{�J�hڑ�s/w�ϥ��Rƃ����_!<E{���@d+2Eng;��<���A�U�@�K�=��7hY�j�pz&�z®V���$�vKr��p ��S/�]��$/wn�5�K�܊4OI��l�A�O������m�3�ĝd?�|��+�*'T��,hB+�r�S�h.Tɖ7���Ӡ��:�߿I��%g5��~�]h��v�f�6���[ G� ���m��=M"NC�%(c��Wβ2�J��z����^9a4�sr%�,3�=����5��֏��-jJ7��̷�dv>��Y�D���ɗ��4y�j��ے��P�7>�)4pI��,w����D2�qv �R1��qeY&%�\��1�����_e8�;xӆS_́�)2�Q~��ߞ�)�P�S��� �����NT���Y��L�J�����X:�"fk���ћ���T�j�*\z������ף��{w�hC3 �o�r��-!�v�7�h1Zapv�~�����1�'�fK�a�)us�d�Ȑ�Q��-���Y��l�D�&P�B�l9g��I�������{J��\uƳ暻��2��;` ���a'���Ay7��2]�|�N��t�?��6;�r���a��r.�R�+ՅB�N�s��iV���B����n>frڕ4��������;gX��PmwGQ��ef�����$.kK�'��#�����mg � �0�XD�j�T��P?��|��y�Eւ�cA���ΰl���s �cvәa"u����yUG�@���/)9XEh�~�6.����&�|�c��e��Hu-�P\� {�����A7�h�Or�x��^<W��еV4��3�� sV��=Yy���G Qu\��Z���d�!�@��5�wݍ5\�N��� �}[�Z�@��Tj� �P��+�z�C���i�̿H�_�cn����'�cI҅\����G�[�?��ḳm2�$�{ef�j��@�^-^���VN������`r8o��ŧ�8(O $���d���"'ruѲO��8���q�j�~��1+�)��%��/~��50��9[HBXN����j~�['qsϚ���&ô��ט9i�!��g�{�e�1GE�8>C����.'��%��K�WŔ��dM�Q�65�M)�V����������VkOz ��\C���KB9v�b�ȧD��������'�4`҄_ �G�!JAuX[�udh���U�aWkk+Nc8�^���T���a&��4-O^<X�7?3�,â���Htw��i��2�&���U��i<�b<�M[lP�,��v�Oܘ�F�NZ�Q� }����|361YD�Z�ǟ���l�^Ȯ�����k���kZ�d\���Zsw�H�d^.�z��6h=[1��]�=EC OСc������^�yj����/ݕ���m�}I�ޮ8�I�Q�� B�K� ��ө��'��r�'��V�p,gb=~y��X�(L��P4L���k nٿ�XL7"�Cd�:+��F�θc^5�X��x[l̰{��a�!��}d���31SZ���6á���$/H1([T��"E���F���F��D��ů�N�gˑ�����lIRZ(�1l�[�p�j��^��q �y|g��p��V�o�;~�s��X�lhsX<��?1�!r�JA��`���2y�TOr7�؇$��� ���gI�I��c���C�C�+����lR���ODz���F�8,�ihM�� �����v�����1HtUkz̡h;�ԿI��O��r-F�Z��\����Y���E;E��Fә��]Дer�tO�U��� o��d*�{;�j��h-XU(j� �`�w,{�'�CC��XT5�-'�Ejg��W+��1�c�YpRM ���N{{��|�Jr�T|���j��+�F��j~� ��1&5i�Uβ�,c�SgҿhHd�D{m�t+�P��h6�#:f�����qB�����u��k�k�AWx�]Uh!�u���\B1yE$��.�Y�ۜ��?�sﵠ{i�Lp@����������$S��kGø �`@�j��P�ުe���9��J���4��F>#��|Z��h�B'e�R�CͨZZ��4�8���.��!¯��iG��-PF�tI���R�y6Q�<�5��^5@[��X)̭�"�(�6@���jw$��_�A ����z��o=�q�@)RǴ��J���� ��� ���6i ��ҟ���5| ����Y� 24G)q��Xe�|6���y꾛I|��f*x��O��%�Qm�p���ǿI�j�Lm&u�s<�7m`?%��P��[�g+�O��iL8����: I�X����������� ��M]�kO���<����tn�Oł����B,ڹ7�*�L�WRH��ջ" �����*�"�̸��|:��W�7W4��T:-����(M�������X* �U���Z�x�p%=�T(U���AIG0ɍI{������$�����]V��/c����D��]� �! �ߋ3gNH_��6��a�߾�q{�D��J��L4�¸N.�w��C��E+o�04~��R&��FA8C��J�=\��a.]���&%�>�d����cY����Df���I�;�@�ZjQi�M|GM���|K���/���<��h�L��]dG���d����[3��L�b���[���v���k�W���q�4��@[�I5)\;� �!3�3�h˘�h�����=��/ޙ�I�Ϸeh�Vk���X�ғuYe_����Xչ��)�W,ێ^�N���o35c s?��~�ce��<Wͫ��z����h�k��{��*GJS�@.��Z���s�8(i��ŅM"3���N� T$Y�-�z5PD41 ��#�S�+�!Ɲg�j�7b���@���<b̺�N�����f�1䀖t��/om�H>�� A�@J�d���F�����=��$���P�-ޘ8��h�ѝ:PyEdy��w�k화/���.0���M�R��|��ߴ\��ה�x|���[��"d�;\9}G|�gb��o��;�Aa�5vR���$z���=��8Z�c�A�f����TV��OB-�X\ t(�*P���%e[P}���1�Ld�"S�1�1Xd4Y����h�;��rQIsVZU�P8cK���� ET��2��0��&�����c�3TZ|pY�_7�X �EL�H��UP�Xc�oF��pc䌲�ٌW�����+#H�O1,r$PA����� @��(���þM'��@�%ܔLd۸���P�,F}0����m��YA�� t%�bB,�)4,X"�}n���|e���\ȵ�w;j�Q�b����BMË�BӚB�� l3@t mH��*�'>iP��6���U0�����COrJ9�|���q ��O���D&0 i6�I%.m�gI�+�hj�Es���������Te�H�c��!f*c�[}c�� �ˁo�%V��m,�&s ����������fj
Static task
static1
Behavioral task
behavioral1
Sample
8edd8ccaca8acb2081b84d9be1e87dea4b1064235d68a61d7700e3fa3d97ea2f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8edd8ccaca8acb2081b84d9be1e87dea4b1064235d68a61d7700e3fa3d97ea2f.exe
Resource
win10v2004-20220812-en
General
-
Target
8edd8ccaca8acb2081b84d9be1e87dea4b1064235d68a61d7700e3fa3d97ea2f
-
Size
9.3MB
-
MD5
d00e3bf396d692d6ac91ece61aff7b70
-
SHA1
c1d4b54b1ccdbfbf1825810625fa57d32f89ec12
-
SHA256
8edd8ccaca8acb2081b84d9be1e87dea4b1064235d68a61d7700e3fa3d97ea2f
-
SHA512
fab7df1dbcb7fc17b67eb5cbf6ab0f51ed67d445b1f8c281ebfcd1275c0f4479768939a7276da0f00ea74bcf33df134cd95820cad87658912aa5666e2fa4f4fb
-
SSDEEP
196608:Aam8f0HU6td21E94CsIeNULoXt9aMz/7zLXBaGdTNclPJgLQ2Ge3Y8Ay+kOURwO:AES21E9x/YzHzVjdTN6gQ2NpOhO
Malware Config
Signatures
Files
-
8edd8ccaca8acb2081b84d9be1e87dea4b1064235d68a61d7700e3fa3d97ea2f.exe windows x86
ddc07fde797888c0c614bad42e092e15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
RegCloseKey
oleaut32
SysFreeString
gdi32
CreateFontA
shell32
ShellExecuteA
version
GetFileVersionInfoA
msvcrt
__getmainargs
Exports
Exports
Sections
Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.smJ Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 7.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iDQ Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.w,Y Size: 1024B - Virtual size: 956B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|V\ Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ