A8䄵�a�c���������r�ޜ}�p��"8J���j7y(Խ���W�u�lZ�� ��X��Vx_�i�?����q//��mC���~7��ǸO)H���г|�d���<gs w�������06t�����u� ��g��/��_�C�g0�V#v1�BR������II���t]t�@!���-~�Ɇ����{7���.����E��F�8� ��Z}U�"�_4�����C) 8�D?���Y��9�g�|T>/�~@Q "��H��9X�g�B�!�B��� P!�,X͔��|��C��B�����8� ��XsPK�g�X������<��ʩ&�r,Y�֗ ��+���m��|Q�Vf�Mu[6�$� y��)�G��.B��`94p�S��q���a J�� �����}W��b-k��;P�P����z7�����V�k�d[o����Qv���B~wĖ��n��َW-ݺt�#���gL�U���q��DHq��R�!#�e l9Dݠ��O�g� F7^[��wY<�d�m��M������,���:������+-p����M�P����?�"�/X��aˁ�,�#�9y��h�� �3q��� ��˽����x^�,f�K�ՄBWq�{�0�J�h+A%4��5ϝ��,���n�_ͳ�V8-�d�i�q�ԫ��W�z�sjV��/����$D�����}5��Yt�A}*�j��7�Є"N�9�Rn�B(��!�`���i�~945�+��L~��be�=*�����1��>J���s�X5�������o0�#�7zo1�P��:O��Q6�9e�TJ\ׅ4m�Y��}�����$54Ώ���j~�r��̈́��Y��J��۲e��ɸ� �ɉ�a>���w�����@�x�.�i� `�8)�P*�R�/�8A�P�,�Q$?�GI��$ߜ���o�5���RZ<<�'$$�C��:�#�-@"a��%�l "Ǭ���S�� ���5 y�_.�ԟ����G)�:X�9>j?��D�n[s��}�]�R=��h���'H���pr���1�FM���zQr���=fV��� ���{@�%f{{Q� ���~����0���-⍓�EO� eu�V�&WI�8)3�҈���]�dqR���OC���<�f���7+q��!����x�P��&�.�pM��(����{G��U�����PK�#a�����+4��n�����w낷B �Ud�ݯTkT��C��.VЧs��D�P�uU���;���A7M��Jj�9u0�t�{�����b%SbB�W���zU�(���=l)�0O����i�s�Y�b� �+��7:�^�O��73f}\|^i�*0�8���#4��!<t����qc��ё�<z� �����y��wT�O�Y�n���Q�����Ә>%N8_Bd� bm�r�3�gI1�̊�y��W<Ul̦+RKu���O�gx���T�-�f�&aSu��5噁�<~yӜ��R��-��t�m�P���}�#�+<6J��'��4ki��K�`����JU6�{�۶��%P��^N;nU�et��?�9tU�֛�&2��Q��4��&�o\/����č,!�U�ٜ}I��za �v�.q���k���"�D�ߙ�HM���]������f|�g\�B�]�8�S�9��&���E!��{4��߈�,)ky}�X抻1,��k�d�GW��lL�!Nȵ�z1��H��{$ǧ���� b�j����Vq���+��S�F��x#�ş&���ˌ0�>�&���Ʈe���Z��w��bgvW��%��P� �-i\�Sw�<.���oP����D���Ni�aW6;��BGlT���X�\�^�.�v�&.n�@��D�aW�&�m6'����o x�+y�욪E�"�/cso:y��"��#Dj:S)*���zh����Ŗi�'�-H��(F�R$P�*:6zg�i�5���B�+{P��������W3ᘠt��_�$N���g�ֽ��SSQpO#��(�I$�aZ��f�1&mj-L�bid�[/��>b�ď���@���H�_ݓ�*��aQ�=ֹj���1�]�Ҍ.!��q���Ҝ�d�� my$hH�%��`|%@�>��'F�a�K]������Ϸ�~�V�Y�^(=��}� �կ�#��,CYw�O��k���n�l�`��ˬ�H��ky�<���^9e��aTT��f9���c�T�=�ˎ�m�,�c�(vz�dHo5��}"�s�ӛ*������ �n���|1|Y��u�iE}WFP��X2WJ���KmJ˃�|�θ�-��L7ex������?u�����q`2���d]���Z#;{��抣�Y��UH9U�7�Ub���-�<��;@_�_H��?��R�;�G���Fɥ?���R��^�rY[)��iLW ڧ��u�&��RnR|���8�?P��IN��jӿV����J;�� ���춦 ��r�P�����٪6qpve��y��sPs�6s�� ���O�D9f�D�qI�Աsa�����L�ו1�L���;Lӷ�����h� �;��`q/�h>+0�l��C�����GF�gn������+B��KA[��s�)T��. )���TBh)o��\A��nOX��a��Oܢ ��b���N���O�B=�����Rw�r>6)X@)�q��ӎu���ASp�-F]�������Mx��݄M��R�e��#��ud�������"2��#�DL�r����a���&����XMHo;��?N��5�$=L��f��ں�ܦ�=����O�Qӥ�g7�����}��V�s�G����7ysD�H �$k�z搥��SCݨs�?��J�_±؋� 쓗v�ӛ�&�D�hHfL�h�3d��0�Aw��M6WԻ����^��v�9XxJ�d}O���J٩?��=�4�t�Y9�T^�q�p�gZ���p�,�C���X�������N�����9]��&td9l��y.���>q�]�zU`/��ߙ�4����f�]:?#^��/�;��1�x�j�+��n��|^��]/+lj�O�.�S��������p{��i�9��u�qi���8���G���i�
Static task
static1
Behavioral task
behavioral1
Sample
9c8013b215e0edbab6d191800d67af6351428ef31152844f013d11d2ceb1d7cd.exe
Resource
win7-20221111-en
General
-
Target
9c8013b215e0edbab6d191800d67af6351428ef31152844f013d11d2ceb1d7cd
-
Size
1.2MB
-
MD5
d785fce83d76a75cd77ce6d648a8f1c4
-
SHA1
f1905109d1dfabdcbae792f9a13f9c7c489e5097
-
SHA256
9c8013b215e0edbab6d191800d67af6351428ef31152844f013d11d2ceb1d7cd
-
SHA512
2f1a8a2c100a8a956471d711dcd9943ffc9b0cf52dbdc76b7b153dfd14f146ae10ab27dee8b38e761642f38c97c7a918572a962ec6a829e12ca000a172973a5f
-
SSDEEP
24576:dxosmkCBh06ugIgpIE8AXL0iZUV4b7CXc9r2xuZZ/TX3qdomiTsZ/dHk49z:dxo/ZBh02IgpZdXnSVUec9q+Z/TX3qdV
Malware Config
Signatures
Files
-
9c8013b215e0edbab6d191800d67af6351428ef31152844f013d11d2ceb1d7cd.exe windows x86
ff0626c3e3aaa24dca783d65d9c99dda
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetTimeFormatW
GetDateFormatW
RtlUnwind
RaiseException
HeapQueryInformation
HeapSize
ExitThread
CreateThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
CreateFileA
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
HeapSetInformation
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesExW
lstrlenA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DeleteFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GlobalFlags
WaitForSingleObject
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
GetCurrentProcessId
GetThreadLocale
InterlockedIncrement
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
FreeResource
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
ExitProcess
TerminateThread
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
lstrlenW
FreeLibrary
lstrcpyW
GetProcAddress
GetVersionExW
LoadLibraryW
GetSystemDirectoryW
ActivateActCtx
DeactivateActCtx
SetLastError
Sleep
GetTickCount
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
SetFileTime
WriteFile
CreateDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
ReadFile
CloseHandle
SetFilePointer
CreateFileW
GlobalFree
GlobalAlloc
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
QueryPerformanceCounter
WideCharToMultiByte
LoadLibraryW
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsRectEmpty
SetRect
InvalidateRgn
UnregisterClassW
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatW
PostThreadMessageW
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetClassInfoExW
RegisterClassW
ScreenToClient
EqualRect
GetDlgCtrlID
CallWindowProcW
SetWindowPos
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
EndDialog
GetDesktopWindow
GetMenuState
DrawIcon
IsIconic
AppendMenuW
GetSystemMenu
LoadIconW
GetMenuItemID
AdjustWindowRectEx
SetWindowLongW
GetMenu
CopyAcceleratorTableW
CreateWindowExW
GetMenuItemCount
SystemParametersInfoW
EnumDisplayMonitors
SetRectEmpty
GetMonitorInfoW
GetSystemMetrics
GetClassNameW
GetWindow
DefWindowProcW
GetClassInfoW
MessageBoxW
wsprintfW
SetCapture
ReleaseCapture
KillTimer
SetTimer
PtInRect
GetCursorPos
MapWindowPoints
TrackMouseEvent
ShowCursor
DrawIconEx
GetSysColorBrush
IsWindow
LoadCursorW
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FrameRect
LoadMenuW
LoadImageW
CreateIconIndirect
GetIconInfo
ReleaseDC
GetSysColor
FillRect
DrawStateW
OffsetRect
DrawFocusRect
InflateRect
CopyRect
PostMessageW
TrackPopupMenuEx
EnableWindow
IntersectRect
GetWindowThreadProcessId
CharNextW
GetSubMenu
GetWindowRect
GetActiveWindow
WindowFromPoint
ClientToScreen
InvalidateRect
SetCursor
GetParent
GetNextDlgTabItem
GetWindowLongW
DestroyIcon
DestroyMenu
DestroyCursor
CharUpperW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetMessageW
TranslateMessage
ValidateRect
GetClientRect
SendMessageW
GetDC
RealChildWindowFromPoint
EndPaint
UnhookWindowsHookEx
GetWindowDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
BeginPaint
MessageBoxW
CharUpperBuffW
gdi32
Escape
CreateFontW
CreateFontIndirectW
CreateSolidBrush
CreatePen
Rectangle
GetDIBits
SetDIBits
GetDeviceCaps
GetTextCharsetInfo
EnumFontFamiliesW
CreatePatternBrush
GetTextMetricsW
CreateDIBitmap
CreateRectRgnIndirect
SaveDC
RestoreDC
SetBkMode
SetMapMode
GetClipBox
LineTo
MoveToEx
ExtTextOutW
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetBkColor
GetTextColor
GetMapMode
GetRgnBox
RectVisible
TextOutW
PtVisible
SetBoundsRect
GetObjectW
SetPixel
GetPixel
DeleteDC
SetTextColor
SetBkColor
SelectObject
CreateBitmap
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
GetTextExtentPoint32W
DeleteObject
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
RegDeleteKeyW
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
shell32
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteExW
comctl32
_TrackMouseEvent
InitCommonControlsEx
shlwapi
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
ole32
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
VariantClear
VariantChangeType
OleCreateFontIndirect
VariantCopy
SysAllocStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit
SysAllocString
SysStringLen
SysFreeString
oledlg
OleUIBusyW
ws2_32
send
recv
ntohs
socket
inet_addr
connect
shutdown
closesocket
WSACleanup
htonl
WSASetLastError
WSAStartup
ntohl
htons
inet_ntoa
gethostbyname
setsockopt
wininet
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
HttpSendRequestW
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetQueryDataAvailable
InternetSetCookieW
InternetQueryOptionW
InternetOpenW
DeleteUrlCacheEntryW
InternetCanonicalizeUrlW
oleacc
CreateStdAccessibleObject
LresultFromObject
Exports
Exports
Sections
.text Size: - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cde0 Size: - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cde1 Size: 942KB - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 326KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ