&�WJ�^b����%�V��1 �y$�瑒7�N|�r E* ����`�(E�+"�>%%&^k�%,Y���)*������rxf�ڽR�c��l�@���;���É>G�**2K��} ڤH/��83��D3 Sz0`�{V�� b�UF2�f3Nv��13py|����maV4 ?U���a������'q6�r^�K,K����j�u4x���h��`\�T�,�h�ٺϐ��g��U�ն���h{{�7��}���=��J��`�rߨ-���-�������^�����I��-�V�g�*#l�gd6͖J�3��{k��&%V�H��PQ���[B!q�+�/ �nO���>��ܪ�*�}y9ܽ| �z�hk��u�m��j/MQڴ�E��&���-��5}�r�a�o�;�v% �Oe�(4zQ��A��ag�S�t&�~,&,�.o�1�m �[W/8ͪjd��u���Gڛ�m� YF�]�܃�$���YS�y���� �kv�a��)u������G�����vԗ�ɬ���Mj%X�)iu�z+�~s]� uIRE|���G+/����fc�ȶ��ɚA������Uy�l]��ڒ�� ��ї�p<-�����tҸq/k4��8���J�J�\�6cW<��N[ T�A�$~�s��1���3�dJ���>PS�i�J\vXE� ���:u��D.4T~�<U�-풚� �.kĜ�7�yOZT����$�K3M�rt%/8պ��-��E�lB����)xU�Y �֎��*F��ΪF��P��e_'6�8��!'1�R�)�����ʹ�m������ZM��j�_ظ���t���BY���~��E�'�:�H�x�Z�-�q�b�x�.>'�&�x�OV&�p:@��s+�\�&;xq����Ah�S�g��gR_T��I��� ��\�.]��u���U����=�u���qc,g}!��S��X���ɀ�� ��Q��`yX\K�?��z�T5$�`��U��K�}՞��R���]�C���ƛ������t��&�!�:�5XrC;��'�,[�ݷ���@��Y"�tR�Ѡ���L��F�p;��O����8mA(�N�5�^&���j1��n�ѓ:�O�ϡ��w���;��ǎ֗z���rlf�h������)n{bK��952�En�.�$�2��EG�^G��`�B�Zvp��.4]�����������vO������Nk�٨.��b"�@,�'�ߨyQX]�H-^�3��9���¡���O�g��96�E7�3^@I%��nLZϽ G@g0�����i����,^�&iLA衔�%p�� ����x��w�*���tFf~z�h7�A�Z� }�:�e�p X��ØS@b0���P��Hd[�&H�e���Q5k{�^��.O�������5"�<;jJ@�2��~RA�Hc���|9�����Zˁ ��9�:�ӭoN ��\��uN�KI��B/����#����pb?zb�haGF�c����ү~���U$�������C}���y���uh��Oj��%kfW�z�yN��u��/�"P��{��c��<;��"%�!�ܜ��(���,�j=������ٮ~��ѣ|������Cnn��� �D=��U�r��(H^>�����:� �}�ô_���>r�k$ܽ���6���9ȌDѺqP���k$#����íxQ��"6��pF����u���U���������N��Fs�;���j�07g>��`���-qq�2y�4�*Z�/&��[�N�+�G Z�JX����F�!�q/\~���<��F���k�{LWu���������Km�*�S�F��Z1Mk����?���%��)}�#8�Uo��Ա~�7�Y�Ԓ�bM��H�R�(��&����Ɏ� v(+kT��䯙�L�'��C�|��Q��� ΅It�[��m���� ��P�܍��c�dp�R������]�(���0C%E<�S��/�p+G��+� �۹Ma QRǣ�Wj�ȉ����B��\���r'�8�g٬�a9h�X]�É�nK�!U�� ��Q���_��S���;��i�-�.T� yޭ� K���������A�À,P�f�E�]��<á*� �1�-� _�]���{�;�~���r�u�@A��3��������vKAg��2��üNㇶ��v�(5�$�5�n����5�������M�� {(��Rg [D��a�`߷��e����W�7�Y�G�M��$ݐ{���}���ӏ�����p��}m���nS����e��x)-��_K�E�����.�#�H�7nl�� ~hf&=Z)�>����R��;1}��;Sl���[�.��5� BS�Q��яl�{\|3¬���v`�^@���s��Qx���?��V�q�N�?���i�p螽m�p;~E�ŭ�펩C�/:������}o ��mS:I��>㤰 _a���(2/� j����C���|Z�d�&�.�|���2-�Ď�3j�J��:`�eY�����ɘ�58���0#m����t��g�� I�J:�[��*h��\�IƢ���������C�4?�O�u����+*�,)ɚ<����K��;'-��� �wX/�xG�MH�%��v"�4R&�Gnh����Ƅ9��C:Zf�!Sȉ I|��[�f�g*���K��CЭ�����QY�M��D@Fa54NO9vC �9����yߠ༤�g��3<�Ho��1�V��h0A�|NG�5W�ix�~ޞ��+z�|P 7<�����j�^Y>�lg��n�M�\��B ���� ����T�m� ��Cװ20�>�����&���1P��'��)���G�%s���ҁjV�AV���l�E�d�����}�D����Y��LqNH�6�P�c$�ro�_�}��vO�,�\zSY�K�B�c��^��ڸ)NXݐ⣑;��7���@��z>��/���JK���D��lK���G�$Xw�t'�O�l߃&�����k�3�����N'��� � �L}\$G�_容��ۦ~��)��!�K� g����4�k���0����8��תD��<�'{��Ys?"��Y�a�5���K�ڰ
Static task
static1
Behavioral task
behavioral1
Sample
f2447e98945956a57fa7d7a79f5c7e23f8c47c56cd5f03f88cb932ebeaf86655.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2447e98945956a57fa7d7a79f5c7e23f8c47c56cd5f03f88cb932ebeaf86655.exe
Resource
win10v2004-20221111-en
General
-
Target
f2447e98945956a57fa7d7a79f5c7e23f8c47c56cd5f03f88cb932ebeaf86655
-
Size
2.0MB
-
MD5
f002f220c85845c18ddc048a397ae063
-
SHA1
d1fb47913edc0bd364149a51bc228d8f2d78458f
-
SHA256
f2447e98945956a57fa7d7a79f5c7e23f8c47c56cd5f03f88cb932ebeaf86655
-
SHA512
aedf6c403b0e7bb2574ddfe5a278b43cb3cce34882e26c61385f8f6d1c75c4a5056d9343ee977a3a1a9421d55564be0a8e95bc49feecac0cfdd86510c6ff67ba
-
SSDEEP
49152:GXHqvh66U84EQvg77jaLRFGLDb+qqTbA4BZeyx0VbFcGn53mSEFV7Jjp6:G6vhD8gvjuDGLuV5Bx0Vsz7Jjp6
Malware Config
Signatures
Files
-
f2447e98945956a57fa7d7a79f5c7e23f8c47c56cd5f03f88cb932ebeaf86655.exe windows x86
0ddebc441d39e263d5e22cf3c800ea44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5199
msvcrt
free
kernel32
GlobalAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
EndPaint
MessageBoxA
gdi32
GetObjectA
advapi32
OpenProcessToken
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
ole32
CoInitializeSecurity
oleaut32
VariantClear
urlmon
URLDownloadToCacheFileA
shlwapi
StrFormatByteSizeA
psapi
EnumProcessModules
dlqmodule
OutputString
wininet
InternetCloseHandle
iphlpapi
GetTcpTable
ws2_32
htons
msvcp60
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 643KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95271 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ