b#�y�o�ͫOͯ�[s���x�l�InB/N[j �S|�y86C��/R???K���[c`��lX��]��F�!���,vI5�3�@��A'��%�?��������ll��p:�?��Uk���9�н6� 7V�s:�.���ĆY^����+x]�02HH�^Յ���_��BP�*95�{ڔ�(b&�˯5pa�h��P2�Gs�������n�`�Sҟ�Y��zyӝӕ,U��ֳ/�n�LG��qJ�֠��]��{�:<�{@��jXm̉I�6sD;��������nS�hL���(K.2 㹹��p��#{�����3�T��tW�cf�B4��네 S���!�$���^�bU���n�ժ>^�� 1/���^�u�vg������\k����'<�jL����Oi �|�WGj2�E��*#p&,����a����T�g�g �,ů���5<�!*��"Eymh�D����yd���|c�z� γ��/��h� �햳�iՐuF=6�E��$г�&J��)ܫ~�0Xu�߄���|�����C)�T_^�M��#��w�ia���9��`���hؒ#Dͱ�8 �41A�]h�^��f㬞���[������{h�S���j��������|���_{���F�����iI�J�{H���q�Z�Hַk/������g���� �`b�W��Z�~T��K����!J���J(b�� tc���S)��}Hu_�f]g�� \��1���(�{��!W�?�������=u�P�����f�7�������P��0�{�� M_���N�Yb81��"e2^�$�F���V���!۹P~���[х�4��>D�:sO`[fS�z�������)7��ҐXc���Q��H���P�[t4}�Cd��_� �~���]H����M!tr'�c���������ʔ���a���[f�_k'0�|!�p�W1����K͙Wܧ��F���8U� ���w�"C��1�ԫe\����Ķ�����vZU+����h��VIJQ$�Q-H�G�9 ������ҬX\`�1�̈Ir�I�b֧����������������!�n@&�q�����$�������b+Ҁ�h��-���h�.J�q#(�i9�����a�g<��<�s2!K(�ib,`vY�P�����V��;�E|����D槃{)N��0k��9������,��>�Aa����R$"�k���tʬH�CZ;�+�j�A�>Ң�9PMAyiFL�r�O@��G�����F��/��~]���GL���Ť:�`$���ZP!��|���.��^u91���C���U�L~e�+�%�X��Z��bP���7���<Zr$�3d_`�b=d��o�9\m��u Ɩ�^.v�P �����wH��Plzg�����*�? �k���m��� �]G��o�Z˂���_N��6������,[�M����#��0�.)��X(�������PW���u'�f��8a F׳��ǝ���Wˋe��_\��tQ�Z3�>����I����);Z�W�� S��aw�x0J�䨻�+���EP��ݜ�)e�%���ϱGX-��̇H H�����w0�8�T[����/:���7��P��E���og��S�hpci��?C�l���R4�8wڗ�jÃ$!ޠ��Խ��d���^�p������"�xα�L#��]��J������6$H0���b�K;`��!Q���F;I�����Kt��X{~Gq�\C������c�A�F^�b����qX@������{��05l�ֻ�Ԉ�gk (�l�M�4+'R�`}�l� m��_VI�#~KD�/QԮj�: �����9�%*̾4��d��A4]�̱�+���ya�x��ئK�k��0r����T� $MfoV6v�2P떣��Bi��,�������x�@�:9�%j>�Zc����$bi �![� }�*��U��X0�z� ��P� ��c�b��L�O%� U��f��U��u���?������En���=�n:7��(��Y���D��%ā�-�-��{g){��qɥjI�k���!����H8G��R)�CG��=$�_�I.�Dg��Ȉ��-М�IJG�w�U}�Ό��M�i��`�x�����&�A/s8L]K���0�ٙ���{O_�a�\���i�G��w���)١��ʍ���[�{�ҫZ��]�$5g[q����a51T��mfW��%�}#(se.XTv t��aPgT��!��0�wd�E�Z=�V�:�tG�Gk�Tೂ?���A���)��}���go�訝 �=��5�,���m�#`���=6�ʲZ��[(���,�ܐ����-o,�� 1R����(ʎbJW|%v�����E��� g���o@UK:~��+���~�� ����ܣ�<˫�[c��� �n�-lO�~���n���#�뷈�Q���W�!*&�y�X��^.��p*Ƒ=m+X*J �"��(>EB,�&���"9���5Ơs��K�����XR�4���D���<nTŭ= ��uf �F�.M��Y��M�����ɝ?R��*H�%�5RYE{�]��� Q���6�ϟIuo>�S<�#\-�Ա��v�V�Ž$���t�Of�?�Y-nL��9�H���&9Y#瓔�L�59�/�&l�J�D��$Y1��*I��渍T�R_{ϖ�}�[9�?n�C���(���=0��u5�=�נ�`�P�x-.�1[����&��>�s%Z��e\2��1@�~T�:�b=����L���!���x��`�X���Z��?p�kw�Y���q�J��A6��K�Fϑ$h�y@v�����(�EJ�%�,W,=�����S?�0���{�����L��!̘�����{Ar%�%�B����!�)M�E�x�_,23���Aˑ5�g*ɱ��W�0��2KwSѠI��C"��N�������� Y|�x7���!ƛ��y~Hh��t�����YcRS�����R n�砤��p��ڔ�؞�p�|d�p�U���ж2�Ջ����>��*S�OdCfF�b�R'�_C��@� �6������
Static task
static1
Behavioral task
behavioral1
Sample
bef72b48799c3e1197d6ca05ef307fc9d827a816e7ef981d3b306414db3df1e2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bef72b48799c3e1197d6ca05ef307fc9d827a816e7ef981d3b306414db3df1e2.exe
Resource
win10v2004-20221111-en
General
-
Target
bef72b48799c3e1197d6ca05ef307fc9d827a816e7ef981d3b306414db3df1e2
-
Size
65KB
-
MD5
728bd166616b841f356d98d2b328df12
-
SHA1
dcc9ee820bdd0fb5525f9e88e1046a08bc0fa01f
-
SHA256
bef72b48799c3e1197d6ca05ef307fc9d827a816e7ef981d3b306414db3df1e2
-
SHA512
55bfe6e6bb92a2b4afe8370dc5ccda6d545f3f676d7f9058ec7217cc5482ca7a1d106223d016fabfb1ab1fe9d4bede265d550cb0585817e97c9ba7a7b838ed4c
-
SSDEEP
1536:8xQRjsuWHbsO4FqPmCCn86b07PLECDtdjYPadBQ1vQTGwfz:U77sOrPhIl6NT0PadB04/
Malware Config
Signatures
Files
-
bef72b48799c3e1197d6ca05ef307fc9d827a816e7ef981d3b306414db3df1e2.exe windows x86
fc23457673e83866d956cbeab6b966e6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lopen
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
2 Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ