k%)L��L�EJ~�Je�,ɟo��o��l�<.Ɖ ��O�X�סeʼ&y�������e3���\��H%r+PXm�>�If�s��k�Cp(���ɿ�٧�#�7��7���|\eoתr'�.�ɻ&RY��֔i;�m�eD%!�˨P�!��*R,���ϫ�埘u���*T��1�lRllƋY�,�,I�o�3�������>���������*Dv��+���ױ_�k�?R+�7��+-��z6.�$�[�<(�v5���T�\�;�������.�&�2��P)VN4՛��Q-M\��˨�ouҽvv$�I�/E/]�����[ "K�K���#� e�����#&Qgվd����G�?]��yE˒��*�4�q���LIo�� d�J#8(�� D)35�g�:mT�4�{i/�!�(zoU��ő���� �ޱhݔ�;bG�up�/5�9��Y�f"����\�.7Ne�˚����Gq=�u�pP.��}U8�����J1D�JBKJ�a��Z+M<�0iY�<`�@�[��t���h�uvhr�<n�zЄ5�R�W���"ȝ&��B��iM�7�;�b�d4n�� i������2�2�R4�,��� ��g�:j��f��߲|��!M�� 7 �Ð�%Z�V�Z��L6P͍o� �u�2��n�xsH��ٱGT����r���~=��$"� ��d�����; �2_�լ��汰!��N��]��2� 7gd�3HK�_����y��d�!�v�}'��jS���V�݂cu�ba��zH$�w�u͛��G(�6`���1�KkL��y;���G�;�E�����,҄3'a���H�p����%Z]G1y�������G�v�B����*�]��M(E(ap���B���G�6�cg�a�;݄�ՁY=�W#���ݍ�VHN<�Ԯۣ���lʥѤ���1�G<�����Ԡ�Y8��`: x�~���2�ᶭ����=&�ئQ�M��CˠL�N��6���]�,�H�9О��:<O�=�6%���"n$�쾰ms�Zw�}���0։{���I��w0�!UXV�$����� �ij|XG0, ��k�@��є���%̫�2q��G�c��g��_�i��t҃�p�Ѽʶ7���c��������jnU�g>uۃ�\�G�6L5f1 �=�A�j���{K�K�z���9G��i���2�} #+��w�&�������� ��`O,IP8�Oa\��e#z�IDY�����N��R��>��]`��n91����ޑ�w��9�.���k�k�Z�ީ(Ş�J��Ecݞ�E���<u�ìoA�%��T4@o ��C"q�"oi����\z��8.�M�ݶ��Ӿ�� Zr���l��bsN[�yv�<#�~�ez�,��r�� ߱ �y�f�����,_���5� !s�5�1�5��9R����P:���A����2Lf{3�C�PQ������<;ǃ��.����W���"1�*�Q8XG� ����>��c�szM�b��`��Cj6�7K�J�͓؈Z7��w�?q����g�+539��.����n�sT��)���xӉ�'~)-���ȷ�_��y�'��f:�>�]c�>@��f$P�E�K��3�� �Gqw���<���U�M���ȯw{�����s9c�` ����|� Y����%����l�)��6��U�;�K��;�\�$�sq�}�����R!Lh{qN�6���j �;F�:����<2G��e���L���>���� �`��5���)4��kJF��v��L�(��#'�+g����v�EB*#3��R�<��]�91_�?M�_������g[���F.��m9��c�M����-ai�0$3�"ă�|��:���\ �)�L1#�����t�'8�t��Մ�����;�UQ��T��_N&�c�<��0۔�s��F b��'B#0A��F״�T�ۮd�r��<������U(���Fw�v�ৢ���dfi�c�[.�h��d��T���-��6����"��nȳAV�X�4g_+u��&2�x�M\�����ik��!����D�HE�H۠ sk�v�3q���Z<�Q-��#rV���N#,��eS��v���r����SY�9���w;���f��W���^���E���m�.cml]��A/ ��.U���E�w:�AL۰Wyy,}l��c11&6�LE�I�夶�*��%&e.��+2��`���o,��x10��0P��q}�9����M��眛��̗=�(Wf"T�e�ܻ�G�O���%#L�G��!U��C�M8>��s�QT���܇˷?ʺ���;Ac�w�k�#�iehV^��Zn6�|��8�T�肃D�k졼M*����D!��'��dq�B7��$s��c��p��>o�C�C�mx��ru�~š��kD��b��Dt�6 �K?�~%ލ�ن����W_�A����\��,.-I� �<�`��x�Lig��W%2>�c�p��ё8>g$���c�6�ɡ%3ʠV�I��׃d}�e�:2��K��laK�3��Ir -�������l�<��\�ZjW.y��r')����t=�a#�Z;e1�y�rA&�1�d�����(-����(܈°+������= h�>�_�+X��f,���nq�ؾV�m�7�����nܕ����r���4�҆��,�+'���km��k���zײ��mF�>�$4�ې 4�A�� �I���N���զ�`7�#..�)*|�����А��#𰾐J{�)� q$4��N�i"�q1�T~(ۊB�oN���M~�8Bi�f��b(9r���P+��)2FkLR����p|�� ��DG�?�mv���j��8~8ɨ�o�zG��YWO憽klPH�K�>���&U"&�o֤]����g�E{�R?a��"�Ua{���{��u�'��V>fLd����祬�h�����g1S*��4̨I�ƿ}r1sSG� �Z�^G�^�K��͇���8���U&Q�85��:D�g�HJ *A�p��s��dc����y��B5ڍ3|���?�wa
Static task
static1
Behavioral task
behavioral1
Sample
fafb2e79a58553277010b6b56a5b459b1a09977ae4e1469788e580b4873879f6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fafb2e79a58553277010b6b56a5b459b1a09977ae4e1469788e580b4873879f6.exe
Resource
win10v2004-20220812-en
General
-
Target
fafb2e79a58553277010b6b56a5b459b1a09977ae4e1469788e580b4873879f6
-
Size
2.3MB
-
MD5
6f392bf26b36d4ea1b44a30230d37d2a
-
SHA1
58bd3d376edd1e6bb0c275d5f7b507ddd02dec23
-
SHA256
fafb2e79a58553277010b6b56a5b459b1a09977ae4e1469788e580b4873879f6
-
SHA512
cf8eee423ce9fece01f364cce9a4b337e9bb963e4c10348c04c25f0cd79f533ebd88ae53ffce1c851f9240cde39754eaf95f8f0313a71aba26887437a52f8291
-
SSDEEP
49152:Pw+xHVgE+ZtD1XnDnkAxjRErvvnXdXgrit9fUETDmz5i9xCYHgKjgxdY:48iECZXbf4rtgritRUHzUxedY
Malware Config
Signatures
Files
-
fafb2e79a58553277010b6b56a5b459b1a09977ae4e1469788e580b4873879f6.exe windows x86
a68e733d53054dd9c3c768273e959781
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord537
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE