���~C�o��Y\#��{���*e�8�W�~�%�t�MZjy�-cֲu9%P4�-��]l�1�z�x5���駗L�Л| �_�jV7�y �%ぎ\�ov�0z�&�D����n�䬳�j{�y(N'1J�"��_�H7�VG 0,zD�������֥��Q��iLY���yt�����@��IW�uq껬���6�������I�� �v[x�}�ȓ��M.ߵH0��pm��gY tp �N�������eW.��r�<=WM��4/0�������բf��c�ƸDzX�%��O��Sk��Et;�:�X�Bݶ 1¶R����8�w��nӻ�E���<]ܮ#���BLJם(�p.���g�DO�[��[����+��-�ZĚ���&ьҙΌ"}6D�:v��o�:Z������RUf>��)S���֚��Hۇ˧��:3�_�xW���r/� ۾a"�q�]O$��Ֆsӻ���(2�̌1���@4(����u`z��$ Խ`>�)~�Eu��\o�`Z,�X?@ߢ�xX1�!��Q�~����phs�xm3��H��27��@��W%� �$����0 9d�x�����#��H�����/��W,��~nS�qYC������=��{1��F�§�zf���2�wsjJ���(�e��9�+��$�������q��M" �^2�F��/�,O�]��0�T˝b8��FqM[N�'��X���b�*S�8R|'�E������3+n�/IE�][����#�<7�y�t���t���� ��� ���S�2&��z� ���s`��J��eM��^ީ0i��F5{t����q1 �F�=p� �()Ɛ��<Ry��0�!%��}!�JI7�,*�~��&��J�E���%���E���^�f?�Ne6�;�P�Q@���rWˊ����P'��g�La}���#S����.ч.�唤��=r�߰������ӥk�Q�#��5�Z@����l�=������/ `�����qw�OJ�BƳ�)��;c����}�Y�%���������Zϸe�@�/-��A���$> Qi�ܝi�2�z� D���>�/�E��g1�\���S�d&#u�P����8:�����r$���g$�3�y{3�j�b}(�c aه�=���}X���$8po� ,3g�6O�r�?OM���ӂg������@�L*+ ����\r<҈��%���K<m(b�n\����Y���NxX�R7x���K��6��tX���v"L&�n�����Lݘ�H��~��UK;ݰ� zpy�Y���Kj���p�h+���Hr����~&�)��p����yH��Ϻ����`şܧ*P�&�N�zGV�js�az0DŠ5IDU�Z%c���>Ia�� �r��,C� ~M<`.(ɆVӴ������� ��?��W�Z��+~�/[P[�/H[�g�~b������Lt�]�wl���:��8��aT�l��?��`�C���P�x���� �5qM��Gm�r�8L�V<��0m;��g�g��({�zc�>RKj�D�a�F�tn%n嬙o1�Mi ��?'x-��G����#W�3�\��1��K�9.י��s�]k��l�f�q6jC��O�b����Z�>�b�7�jk��9r#=�<WG�� m��aw�vG�Q���$`�G�œ��94Sua�h�.�X��Kq���B��Q��g��D�56�X&�v �J�Ma����8a����t��%�W�[*���d���G+c�?�`�0��y Ϧ[cI���:�`�I<�N�;�{�`����vB��;���|��&e�A�m�+�`��~�S�axC�&��{�E�C�QB|f�=���<���s ����=��4��6��ȳ�T���pV�����+�m�B���mx��!Ywbcf��s2?�D-����� �_��K~��ҊB3�Z��^#{��zy���^�3D�KZ(�F�e Yx-n\�����X�4�������� ��]}���X��I��nM��EUO��ڳ�Hk�G5����Il ����d����/�^�����DW[?����0�]�Jby�"������i�^m�l�X`�p����'����y�j̾�m�R(-Ad��";e͵uMp�RK��� lp.-S��M�A��R&�̕)ޓk�S8N�?�l��#����z)"`���v��p�G���e%2�~�Kם�w����A��3k#y3��* ��b�����Ͳ�\xV���e��8�yTS��~���E��K� �������� ��>�'�y�m�ؚ���N}^ �pfJʵ��]/I���磗 0�yh*���ZNN�(�2��2F���ah��ԸQ��Eb���R�bv�3Í������I�����ϼV�,6��sC�x��@�����*�W����b{}kM)����mE&w��&�S��Z����c�>t�#]$bD{i�0`3��,�)�1_�e]�L��p8�g��ӹ{��[�Ғ'��#��X5I�u{h�.��>��`�>�D���v0yj�K���L*�o����)ѭ�I��[���V��������ٕ��G�� ��'4���^���M70i1� ;�Z��h�V/߷��Qٷv�$�x���-�,8tqᎤ�����r�M��_L��{NN'���h�v{S�����G�za��L~L{�_��o��Ҹ��ZӁf\�E�3,7E]q���7pxP�� %H���4*=|~2��*q��4#1��oH����e�8$TxzE:b��IKo�f7ݹ��Na�{���e��D�%d�+3���<��a]��? ����G��������C�v �/�e1�lD�Z���q�yD8E�2�Ц�[�^�;7�=��V�hB ���6����a@��c۾�>�TC��&���d{�bӛ���Yq����F��#��pD5 5�3k�[���G�, �p���?4���{1�$�;m�g># vֲ�**�u��E��V��c�o}�$ʞ{_�:��nvi������Z"�����^�v:i5�4zQ4�S�`U�0B�1L��}3;q}%��O�
Static task
static1
Behavioral task
behavioral1
Sample
b46bcae0ff416bdf72d5e9f6486ce5cbf04a65f318bb696b2ee456e938d011b0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b46bcae0ff416bdf72d5e9f6486ce5cbf04a65f318bb696b2ee456e938d011b0.exe
Resource
win10v2004-20221111-en
General
-
Target
b46bcae0ff416bdf72d5e9f6486ce5cbf04a65f318bb696b2ee456e938d011b0
-
Size
58KB
-
MD5
eab3ef91924136c5b2c517e8b2317171
-
SHA1
dc297d6f2f3ef28d6d6fe2042e305cbc6c8723b4
-
SHA256
b46bcae0ff416bdf72d5e9f6486ce5cbf04a65f318bb696b2ee456e938d011b0
-
SHA512
c0d4a1bdc73947dcced951c558006baec580f2f34fcda035d18ed29180c577a38f708af5265a9cf56bb832309606f9c93b48661f2c32a0153238cd9e27b0d2ac
-
SSDEEP
1536:Q+nOBSq9lSxIQ19umIuQFoRHL/71IS17OqmjXT6Wfwfz:Qx4OAKQnFOothJ7cjmW2
Malware Config
Signatures
Files
-
b46bcae0ff416bdf72d5e9f6486ce5cbf04a65f318bb696b2ee456e938d011b0.exe windows x86
efb15bd0be8fad956444fb0c177c9349
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
_lcreat
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
1 Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE