.y�<ĸ.��YlwǫE�A9�xdX�[�p�轣�<O��a��$l���B�TDC�1yj�L�� �$ݳ(�_ӕ�o~���R��3X'�'#��J`n��um���0P��Z5�3I�#;|�����N �w��͙ޥ�a�����Ke �ָ�(Jگ_W��3S�s�N|�b.g���=�߿���&-��,A������ء@B4V�jO5��.7�w;�xl��v�R�eC�x� ,NoҴ�p�h�=�[�b���DGL�j�7��q;(?X�B ��Ke�����ITk����,�:萎'��?�W��QR�g������5�������.���R��������]S&N��N=Q�|�ǜ�����z���cz����-9+i7R���i���X���E )=��M���ЩJ1�S^\uM�Uy�*@����&�n��k%.�J�����l�m���u�pK[D,�o �+ُ*~w�EQ>� P�������O�f�I�����,���Lg�-g� w���K ��s���/��Rr�tl�G1����)I7z�epZ>W�F��f�/7 ���p�j \eG����nz �Ҳ��A��mE��e�X��ҳ�W�����3����$f�|7/�9 �2 �k\�BM��rhCɯ�x\ ˊ#Lά���z�y�#e`����?�5���Y�L��1�g������>Z3�q�H �߈r�.%�u;H������*����u�JƉr�(b`�͡���^{7G���]+��j��Kls��³���9��� �ىxU���g����a�����A[r��'�q�^x��b�0��C{t�L��6��md݉)��R rTM�7�з|_�Gu�����I��il!*�X�������J��t�#Sr�P{�إ]3n ����fCsW 2P��� V\h��Y{��t�f���D-k %:w���m�^��btc�` D\ODk��p ���@��ش��' 4�|n]'mh_�`p]�U�D���Q|��!��b�^c�g�\��ִ�sI�u@\ɵ� ��GZ�(���È��/w�e+�iC�E��@�l��o��|�p<�܃�*���\�=A�<ô[t�B�?�%�c oĈ�z���Wdn���7j*�]��GS� �� |%��3]d��1�E�:��75��=Q!,*s�o0�K�1�\�� }� g6�pu�N�U�"��B�V�3D�����]/�6^�V�Y��(�R��p��%*�jG���ꍹ%ߞM����Dө�̱y������ �����T��X%-��9� ���]��2���6���\�����i�hω1S.[��[�a�x�`��!�~�d�2�^��П%��u�:Uau�p��|��J� �l�72J�zv�c��\d��J:���B:m��G�n���f�\�Y2�`��GKQ�Ӈ~��Jh,��ԙݪ r�=�"{-�-�/�f����j�~����}�ߗ��/��`�nF���2��e�� ���i��(!��9P��f�P��٬�UMj&�?�D�,߿�`�db�6n����u�Tf��(d!�=E�m�<I��T⠭@�����,�#��γ ��N����!�aOvܙd_��2&k�%�ϸ��� �%*��r��,KB��f ﳯa�_vI��i���*���V{<�p�h-{{�C�i��,�N��EOv�3�q������҆� �n�:���P��5�����!�X�o#�Z��)���6S&�")��O@�r������_���:���_����`��(���~q�?ݎ٘���Q��E�7oF���Rt�$��e�[l� �� =q�љ��/��������v���V����Zb-�8V��q{��\�Ղ���w�%,&_m{<z����ƻ��~b�����*����{�~zc��@�k�`���6��ԚEP� R�K�Z��$��x���{ �ߗXH(�"��9W�� ^e�ģ��i���^[ܷ�,�z��r3^�d9w�R��v��Gn6]�H�~f Vs�������_�|���j�`�$�]=\��Q�M-����|��@�<oKRcu>{������m��p���ҰW��o�WM9O�q�R����6��Q����nk��+U�gD��?��5�ud�2]dh�̤af˩�+�Qs�����`�)Y�/۰����Y���L `�sIб�Ov���:Ic���-c�E?�H�G�XW�M����0�0�߇�����=OL/s��X� ���� �S��:�9�3.�`�X�u�o�?�'d�"��n>M�ψd�(q���O�UJ���x���{.��Bg��A��ʚ��p��T���uu�<v���gU�0��M4nwZ����!���O|�M�?W�X�l;�+#dW��E�tF��������� ��*M����M�@p�`m������u��`F��h�Py�"�+z� ç��[Ҥ�清�m� ��3s���y�+ջ� ��Ō,�Z<F0m��G��X�"�fhεO�$���.��$�q��y�Uq$��c#k������M�V����s��R�;=ET�hWH���0�I�0$&�����B�A�#�Cf%Dr���ҕ� G�����e�.��,�H����==�1,5�Hy�w>m�[��M��"��eg��m����u���d#��zJHs6j�C@���?�5(�t��84v��e>W3��-��?�bp�ž�|��Y�����7B,t&�@ ޜ G�/�%�|��z���QX�4� :aZ���,�J$h����F���O�͑��ۡ�o�x��<m�I��Ug�.������� j���[��F����̦�ko�Y�1�2\�P�}���z�'j�K���R��hB����wHN��`����:�3��9�����ɔ� J���Y�����唟U�����~��̄d �Nt�5�)!���+��n�� #��O���"u�l�o���Ĺ���hH@��q3�,<Ɯ~��b�@r[F8�]�� ���=C�$���/>���e�H���U|��V���j�~�mK�@�aO����G[�X���AYo������Eq
Static task
static1
Behavioral task
behavioral1
Sample
ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Resource
win10v2004-20220812-en
General
-
Target
ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7
-
Size
6.1MB
-
MD5
e41c2b8d50ee6ca63ce2c32236c99bed
-
SHA1
60972aa1a8f68d697fd3ff74d723609870f298f7
-
SHA256
ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7
-
SHA512
1557bdb28821d8f7be09e55f45362a1078a4de1e75a273a68bb71e6146553ba760416df66553e3173f2889188a8030adf6707456251dfac717f941f7937d0e8b
-
SSDEEP
196608:2M9pfAJBlQoHoGMukN8rhH5tQpb7UlJ35DB4CF:2M9pfyMap3rhEpb7UlJJDSc
Malware Config
Signatures
Files
-
ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe windows x86
9e8908e50f393e7ae82b021edeb98963
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
iphlpapi
GetAdaptersInfo
winmm
midiStreamClose
ws2_32
WSAStartup
kernel32
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostQuitMessage
gdi32
SetViewportOrgEx
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
AdjustTokenPrivileges
shell32
Shell_NotifyIconA
ole32
CoTaskMemAlloc
oleaut32
VariantClear
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 654KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v550 Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.v551 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v552 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ