$��a�:����$�}�^\7�IC���.�s�iR��EG��6������m��$��S-�����#�x���ƥ*F�ܝC���ˍ7k]�/P�_�����YE!4�1����M�R��Qf��dF�pǠ����I�}l�@���ԗ�}.��Jx�q.��n�����6��3�/�D��yp���X]�3��^(7m�M�p,�`�B�/+��B s�r�|O���_��%_U$̀����m��nއ��Xx<uq�X��X�I"°lz��R���C���c�P+�:ʌ���0.oL���W��Y��9&���� ����v�����Q��,B&s�~��迕v%:��A���\W̘��L���oI����>�q��˘]�_��q�er ��+��',���N� ݔ^��p���D�g��2����1��F�U�?:&|@q�B|�����drć� (�� G����(����bǮ�`Z`��u��U�ћq��P0r7>f�dp��hن�g�����^�ؾ��p��e1��D!|����Z�1G����ʩ�a`Q�m�S���92��t�<H��B��q@n���[�D�V��Ĺ=�h5���������.���$�̃�柄���ZC p�oa�0��]q몼��߭���O�y(SRz���8TE���k�8p�IZ��.�,��^]r�kA��'�o�(�'o�/�Č�� 0����F�^�|)F.����Dr��n���4������lv��+���{_V�R��|hk9}��$���0��eG�)�%ne�_�w�����x�IQ�o����څR�"�:����w�� bJ�~��F���@(�ƒNՊs,����/���wy7Ʀ���U'{i��z5��wb�$lǴ��w.��@(B{MW��J$ƌ.�h.p�_hz�y����*s܆�y�\�c ��n`�u�-&C�n� ?������\���������Ř��*����:��32��aI�:�����y�'�ʞ�Y{�F�+ÃɪՑ k@���iW2���$��>��i��,/M�$���z�7�/�;YJӼ������k�KQJ�H��zX�٣MW���o�N���7<�Pt9*J �� ��n��{� iH�gS�o5��K��2MP�9=6zT��/4/����,�Wa!�YԬd$dՓ4P��~��R�9gO�\ҷ���n���?��������)�y��5TbI�t����?-�m�ܮzU�C��y��b[�1<�J��Ŀ_�&��~��w�����Lh� �Q��\�}� ג������-m�(|3Dw�\{�;w�{l����A�t_;K�<��2*��۲��U)�?$�T� !��G����E���t�&-���>1%��YŘ��>z�S�����l����Q�������/YG�Xz\ �P}�f��#/�%�6Y��טM�f�ѝ� Oz��ɜ���lqqdJȜ�I������H�1��3Zd�����3C�����UBJ8��*��$-wE��Zyy �i�e�A��ki�����W>���p�X�b�0�Er���1���AK4;!Ns*4���E�K`�[l�����WN>� �%Z����V����v8�䀞A:^<��*�N'���a],l&�;�h$5��Sv�]o��,V���y�g(�U�"��vB�E~�$���dB��^J�Ga���7o�!�*�[�~ Š�V�a������_�'���#y�y�➏G��r��I��Qj�zRV�t�l��H�<I��6D������!��:��GM�%7����SF ]�5���H�œҦ��m��vpT�������MFR���}� %2�r���B��$3���e;0-X�Maqm>�t��S�� �`B��WpL�"����只� ��mru�W���ByD��3�*�D1����+j�]Ul|����rW���,����^&�v��{M譿���H��{�G4 �ǝ����5>��6���!�3�}uf��m�$��Is�'ByA�*"�ۡ� �+U���ֲ���ˍp��gąpM���:�#������HT��>���+�w��4� �>��IW!�OD~\��/���&��_,��[�<1��3Eķ��J�}�lv<p�����h� $w��]�� �$����$`e��ñPJ���憚����Y��^�gԻ�ͤ�:k<� 9�k�}���`����.ҭ�:�SY��샅X�6$6��|e���bS������,8��������tdv�Ř�o�ӻ9��A��i7oi�,r&�dݼ��HVJ1�ѕ7:�̻�~����n�P�W�_�|���K�����ϟW���F9��*�FV�!����s+9��9[@�-:-|HOt�I�.g5�8��A��?HB-�}� 6~낷�}����/��m�k�7�� ����趋i\[��&����yN�� ����NZK�Cs>7G��99m��Y����wx�Ó�]g����~�Aď�A�<�$Ąw�<g$W���c���kX՚�|"��|Q����l�yB�'6K��˝,�h�]�(lx����Ұ�Zq�����`�uy9r��Ŭ�Öm^,-�Q�|��4SC�,��R��;����'�½OW�N��p��8 �D�ۖ3��.K�%+F[����t��(�������ܤ�>����"}�gţ���&�8>���\sPkٙ>�+�T\n=����L{��#�Q$��Tw2�bm����,'�UIS=[ �� �Y8`RN�l��f��d����u���h�F���1�2�p�j����R�"f���I/p�~!�_����wۿ�[]\��i��<�#��V��fFzW{��7��N���F����� sڶ�wfJG������Y{m���jK`�Q�"8��e��p^�ȨֈD�!\;����i�$���������oS�{��Bq[��5N��B�ᙲK��H(��@tVu���D�����J��]w�B�)�Ha6�_-A�P�i�Q�D.a2�����>�`�<B1|Eԡ������Vi.1?�*y0�c,^*co�����"���}Lm��b3
Static task
static1
Behavioral task
behavioral1
Sample
320ac7d30667695a471278dc788878d5374a4fffc862b3c17c86fcc184ffef83.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
320ac7d30667695a471278dc788878d5374a4fffc862b3c17c86fcc184ffef83.exe
Resource
win10v2004-20220901-en
General
-
Target
320ac7d30667695a471278dc788878d5374a4fffc862b3c17c86fcc184ffef83
-
Size
2.2MB
-
MD5
3dcaa6b62917ba0ff3da78b68f38d01a
-
SHA1
4ae8fac5f805edc89959e19363e37f0eba86f098
-
SHA256
320ac7d30667695a471278dc788878d5374a4fffc862b3c17c86fcc184ffef83
-
SHA512
e721de80e7e9c7a5c8cdfced69598c3448f9842ffd3104e6f8191777e4e3cbce7dc6f69c1308d5b492a391e97e7e610d5356cf0987b89d5a59b49e38b2bc028a
-
SSDEEP
49152:1FIfRuJE9HXLzpBV2hlVt9fAh1giwuGySPqQ+JDZt1PD99:zIeo3vV2/Vt9fyxwuGCjZHD
Malware Config
Signatures
Files
-
320ac7d30667695a471278dc788878d5374a4fffc862b3c17c86fcc184ffef83.exe windows x86
5a895d09b7e7aa9abd3643db77efd6b8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantInit
advapi32
RegOpenKeyExW
user32
LoadCursorW
kernel32
GetVersion
GetVersionExW
GetVersion
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateICW
version
GetFileVersionInfoW
ole32
CoUninitialize
comctl32
ImageList_Remove
msvcrt
memset
shell32
Shell_NotifyIconW
winspool.drv
OpenPrinterW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 99KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ