�/�m���X�!���@�)ec��&���,���L���|�i����:��*U���?ؗ@���F�d���q]J̖�H�؍u*=@M�_�p�mυ���p���ܒ6H��=2��9櫵��Q<��iey'b,���/���d�%q��-;Z��e�����R�bWM E���m/��^��$�C��8�E���貣�-� �⢐g*f"�-D���nR�7{0�C�8�#f�]e�E��b�30��y��>��&2��M���V�4_I���K�]3f��Dm@l"Q�����j ��(A�����Iք��|�U�y\�ߨs9ߠ�L"'�4�V�g����eG#YE(� /C^_����-z��i�@���'?��:#�h�f'0��)��/��eY�� N��v��w۲���(�n�J��\�i�?��i�Ą=��4�^"��̠CkҦ��|��n)1�����c���h����g�T�o�0��� ` Sj�"��3�{R�~_�m���qSW��o�1���{9(�[���K�K�ض�Ƨ; �?k�=��۟r��=R)����Љ����!Lϐw]8��tl?+���e�����p���=�L�[����iW<��:S� �e#�ԈK+��P��xhI%z>���״�N�|4�T <-U����HRibyn�u����3�c���P������31]��'L�w�?�� -�/�o��enڻ���u!�#�͉I��dp\�P[v�Ⱥ�чsz�M1.nI=���8VX�+�$M�X-�=�V��t���.b?����=��c�~e�.���-���mP� :FG.�����ҷn����Ϧ�x�{2ѻd���g�}�&C�Ү�5KC�H> ��&����A�����Q�rV\'3��;���/ø�,/�"βk_�'�����P�ck�0�ޢ�&��y�� O&`�9좸��%-Ex2'za�ܥ��)�NȤAق�t0�gvU�S|=a��|����(j^;1E�YU��>��yj���#Cߺ�!f���� �'P��G��x��V�,��'�3?��z|����@6`9����7�����kᔑ�ךt)�> [�U�( O�#�<g �r�PĊ-��h�2����ܩ�6�}G6 �kߚ�j�z���ɘ�t,���Ѽ����bը�7r��e������ ~N�Pdy��$29�6l2����M����i�r6�K��"Zd��<T�p�zP@Y�[ �������M��8��oU��������l�V9�������%�NT�ʲ��0"��u�gℭ89 G3>�X��L��Re�f˪�� �7}l�[��A������j]�X�L2v� ��Iլ�I��.�}j�� r2���!Z2bܠ�d3��vl���%2g6+�����̤��}U��+5@n��Hҭ���#�=�����y�����`������E�����d\6VK:`ArȄ7sH�z�� M�'�*�h�!N���l)��>��0�����l�Xj)���<��I��r��)���h<W����2o�Ԝ��C|0���D7Y�f\o-��E��� -w�Į��E�0��-�%�Iɶ��R�SZ�b�C��:ݩ��$1yT� ^-N�7�rVٿ^q�Vi���:�����J{7`fz������ q�"�RN�*�2^A���e��/gf����#��K'���> 1�$�V���J?����֤�����d�Vt'[.�1���ĸ*��Y�#_Do�CMHѲ/i��;b�w�H�(G�3���Q���٬��#6"bS�,|c��0H�nA4j� |� ��T����*H��|��-�0ef��ÎVf��p�En}' &�f-��E?+>Z"� ��;�X���鰑Α?�i�������S�ۃ g��rmK���ަC�<Qz��|vz��|�]?��ɨ��͕�9�����o7 �9쿳�u�<�F�@�%m�SvBIq�F:;!�P8�u�j7�$-��\M��`I�>�KW�LW���LG�pf��d�Ѐ���u�[� +���JJ�}ޚ�Un��20��/|��s�C�ʹ!Єᾈ��>"�@ �2� #�����5���_�C�)$���]l�5,�D�WWْ�Lh��zWZ����z �#��nxu�x�͵M��!�F<ܦ n�1����;:4�KC����:�ۢ6�`�Fs���9[��������G�?�����(Xڧe������ VO!I�P�99J���z�&#�47��<tbS��E��vJ#�MTխ/ܻ"H!w]�>XX/v$-;~��p��8�dV���ħ�TT`)Ú�ަK�p��~e=���<�:z{��>d�l�=S�a������q���0��'� � �Ot�� ���Ǧ����*�d����8�d��|��A*�!O�+�63�M1:�K�B��"�&��k��0��#��������>b������(��f�������:�^�-�*�LN�P\�d�R=z�8EBH���)"�i:�A;r� ���o�=: ۿN�^m�C�K�'��d����_M#��7c�ԥ>�n�H�Q R�������|���9m�h']� KvCy��Sw�������� q����>�#���}�\�)>�� �����]���͙A>D��tO;YT�aq����j��Iq$�Ha���Qvs�6Iz%�L�F�*�欨���w��$������T��l�"ap&A\�k�A.v���Ӿ�x]���_'�%�{%� x�%B-��T�Ϗ��c��G���\=�|q�Iy��ߗ�X��y�6�6;�3q�*�B*X��g��w��F�M��D�#��;̶�2��TS�!������ZjG��$CzyL�_pplX}���Kt�i��k�[���Bկ��U��$3����tU���'����s8 ������v�O��1��,��E��P���$��gs�q�hN�[ d%�5��x�u����Pc�� ��Y;N�k�Q��-V��������(:�x?�-�&6��Cim�z�'�Ш-�݆{�� ������i��)z<�rd���G�q5 #���Y�b�S��?�����=��A(���G
Static task
static1
Behavioral task
behavioral1
Sample
a1a81891f53c2941620af8c130635a3f75469b326c2e6631d5a47ebda63f81f7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a1a81891f53c2941620af8c130635a3f75469b326c2e6631d5a47ebda63f81f7.exe
Resource
win10v2004-20221111-en
General
-
Target
a1a81891f53c2941620af8c130635a3f75469b326c2e6631d5a47ebda63f81f7
-
Size
2.3MB
-
MD5
ace80dbe51e3ffc16508d0b6148ccbb6
-
SHA1
7e37dfba8adcac3ab59acde7ea6b996ddcab377e
-
SHA256
a1a81891f53c2941620af8c130635a3f75469b326c2e6631d5a47ebda63f81f7
-
SHA512
4320616432ea9f5596a19c1ef7c980f3969d6c503f6667d8cc6b5c695a08ba151febd4a4bbc90a7c4193742aab141bb73de28f06faff25830f86e7b44391ff57
-
SSDEEP
49152:j7Ix37Phg7v9tvL3/+apjmIadwA5LS3ZDP5RIXa6:js31uHJiIattS3ZDRRIK
Malware Config
Signatures
Files
-
a1a81891f53c2941620af8c130635a3f75469b326c2e6631d5a47ebda63f81f7.exe windows x86
6f37b770ea28087d0e0670beac409112
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4486
msvcrt
printf
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
MessageBoxA
gdi32
CreatePen
advapi32
OpenSCManagerA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
ole32
CoSetProxyBlanket
oleaut32
VariantClear
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
psapi
EnumProcesses
dlqmodule
KillProcess
wininet
InternetOpenA
iphlpapi
GetTcpTable
ws2_32
htonl
msvcp60
??1_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95271 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ