{�'�ɓ��P8����F���w�OL��#V�3V�ǥ̇Lp�'�b�����&Yp`��A�+f��h�ؓ�?�4X苃��`O *���ω���h�IB�P&����C���8�[��s��͢6g���I�=+���u��,0�|`yB�P�̜ز0��J��'��X��G��O�'��j����e�`�Iډ �ɘ�+Xq)� t��]�:E� o��)}J���{����Y���� {9�*S�.��0��8U�]�X��H�8i�|����Ϫ�dk����Ā����ױ3C���w� UC��5 �\�ϳ̒������q�MK�F�������/O���@;^]�J�b������ q�\dT���:����)&jYA"�9�pb�'�]f3(f��_9��c?�P.���M��Q,"�O��u�t|���|8�hM�����3ِ]!^K�K�wy���PQ���� �վ�p�����N�y��=�8�i78��_O�j����x��J�G�yB,�Nr�P*"Ǥ"�˞��S��p�����';U0<�M���+�S5��Vh%C��{7/�Vdd�Y�;���ֳ��Qt���#RZ�y�6e0s<��p.{)�n`��j�-G$�a2�{JXQ�7D�{�͝�5nC�� c�CD�].��Ճ��'�);�~�q|J��j���Ƽ�`SB�6���wn�(m��O���({�x k���ָ?��V����v��<��96�&� �)� ��U���#v�*��K�����/C�!-�����1����F��#H�]H$ux�r� ��Α�(��7<��X��h7���'|+�i��2X�s�Dĕ"8��țb����&r��A�Z|��vx��Hz�?��j�Y�x�-�J-�d_�9E�;�Tq^W���Np%��Q�K�p3[�!~��_�R����_ܕ�Zo����=�[�\�RG�M\�?P3��T�,KU�ͱ�v��m�]�X���M?���`%V���}�U�y-+�������:�nUQ�C���i�S���@� Y���2]�Y�3X&�D& ��%c�:|f�~�����`ԾC��x�z饔(�՞������~'� ����p+�n��/\gA��� ������y���Ly����x�iF3�B���{Zb�Dz���"z�I:~�k�z�w�P�xY���fr:BGo5����p��(#i� ��`�m2�&�O��ڶ9�䔡=�����!6���.]��;�G��z\�hyg�'go��R�������n�oLç?���H��*br���K8;�,�2v�[]�O*��8];�~�.[��/@1* ��[��` (�2m���"*v�'JU�,��S��T����&UV�Χ.��A�3� ���سSuM��m��%ұ<�[�so�M�AA�8�w\'\�N��:�������i8I�+ӳB�͈�J�2��My�!�*����t�� ���'Q�z��|��z��qpw@�'���wAg��K]�K|�O�p~�eK���atk��<��F9�B�ϓ����2��&�澖��zʎ�K�F�S��Vf�^�����&���^Ԃ}���)��Ja�*A�y*o��">*t����<獂Yp�D���?O���p�!m������T�r���=��v>����A���[1[-�`P�2��i�;�m@)�NB��Κ�6��z��L��T �82@��5��\��:"�k�W;:��%�|���T�p���S֥�A^I�[q���m_��J��_'�q&����u��:��}=���M� �r���^ܣ�Z�H,p����ƀ ��^�D���G*��tLv ��N2�qb�{���&�^q�ǭ�V�9$���dbӧ<qzLe��w%]�2�{�F�1 � ��ڍ�[�>��"��4�I@�f�A��僽n��!�㸯I�YpV�<N�=�#p �[|{������O�W��+�^�an�|�a��h����yz�:���ݕQ�MC$�lʷU�e�lFR��.V9�bf�-���T� 2ȅ��=`@������ݴ4"��Q��M}"#��,��7�� �����Kv~B����qG*�h��CN}'���Xf�oX�)�!�Kg��O)[� �$.��S�_�]�l���_NS6�k�R�� ���EΒ�x�A6�M�T�C�l��N.5��[�=#v�k2�@ �z;�Dk?�IU@�S&�#H��{/� �>���$�x�<ٍ�tr^��:�#�++������M��)�tL�'���p^d�8��R���뤾�u6�:�V��y�):��mN?�G�P�v�O��_����3uk��f��K�]�nhb'�5Ӌ�oI��������s�Q�����h:S�:�쒜j����F���@s��#��fg�����Wc埤��%���%�k�Y*���r���-(���\�c�s���'J E)}�o��N����v+�B��Rb�Խ�j�5b��--��Gd�����!�F�Oc��\;c�^���֞1{�z�Cj�J����.$��'����_�<��\M�D=ޅҖb��N�M�`S�Aˬt�6���N[���ݪ^+��Z��/l�M�f�~�V������*�Uy�R��.5)�d7a���G�hw}/��fbdp�0!M?Zƴ6F����&u�a��Z70>�:���eC��Ԅ�����ࡦx�E��%�� ��*��7t��-�/*0���ΞWӥ��[����J���t5�j>'S��Z�1���e�:�9�O������f����/aю�oc��к �PW���\�L'��83M�%D��|�3F�s �����ʱ���t�M1L�iY��`K�;kHDX�\�ή ��B�^��y�k��������3�`�2�d�b2]T.�k6�*����0��2��9ٙ&�]�bJ���Kg�n�:�`��Ͳ�eTP�N���ħҥ�,��O�ps���)��|r���s��{M�b��s��&�8+�ΌCG��Y}���m �)��ruh�cL�(�����*�A����L}���9Jh~���K� ��,#}��/b�Z�� c˅�B�đC� �(J6-S����ZS��+�1���
Behavioral task
behavioral1
Sample
fd62fbcf9468e424f4babf013f51fe7539296304f22ffea385bd200552b8d13d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fd62fbcf9468e424f4babf013f51fe7539296304f22ffea385bd200552b8d13d.exe
Resource
win10v2004-20220901-en
General
-
Target
fd62fbcf9468e424f4babf013f51fe7539296304f22ffea385bd200552b8d13d
-
Size
1.3MB
-
MD5
355336c2785cdc1552615fce3f109cf1
-
SHA1
219b55e5a4b012dfc51c4a382f37195a107af38f
-
SHA256
fd62fbcf9468e424f4babf013f51fe7539296304f22ffea385bd200552b8d13d
-
SHA512
505667c6f9f6319f809e8f2cf1526fc9cad1185eef4f8d4a7483236c554abb7727a3917439893ea5f15d8a75b97155993923afcc24b12dc5d889420072d07ad9
-
SSDEEP
24576:w3KbES5R/T1yivuzUfir5zk1uRiVg9+GyXN0wiYmamF3+vj7lBd0wOv:lr7/T1wU6+xVg9+Gy97i3aOQj73
Malware Config
Signatures
Files
-
fd62fbcf9468e424f4babf013f51fe7539296304f22ffea385bd200552b8d13d.exe windows x86
1b9ab52ba5460e25b4447a99ed842b53
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
comctl32
ord17
comdlg32
ChooseColorA
gdi32
PatBlt
ole32
OleInitialize
oleaut32
SysAllocString
oledlg
ord8
shell32
ShellExecuteA
user32
GetDC
MessageBoxA
winmm
waveOutOpen
winspool.drv
ClosePrinter
ws2_32
inet_ntoa
Exports
Exports
Sections
UPX0 Size: - Virtual size: 916KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ