+�y�� �#OU;B�;�������0�j��l%l�)��.�1���)jJL�/��}t�cR`kB��hw�� �=6�k)B��WS�?b��h3bD�{���#���H�+��)L����� � �#�Z��ڀg��"��k+/�k�̵^�B%�x�3�v*[g�� j�V�PFw/�=T�0OT�����L��u4R��RgP�'a瑵����(Х� ���<��v�*��a���,�,��D��._�� ]19�{� +�A�a�������� A T���yy���m���o=�^:���-��� `q�%���*�ϝJ��z�*#W�h��o��L�-��|l��n����{ÿ��m�����/ڹ0܇v�z٬��� j*}�k�H�{X��ۥ�ڼ(,~gw��z$qE�g����Z�Yt6���>��j������#>tlo�h/Zh���+%h�0��zv��@)�*�{Q��&�1�E8tLz`���ҿ�W�˃ћ���`�H��R5�|<� �A��L���O�z+[�IpC�Xlw������W{x�g�Q�5V{�g����L������{�Ft�(�r`D^�Ђ7�#���9+�k"d��l�4�"�?�-r�N y:*�r6��qq~~���@���n'$�-�E�U�A��ku01T�,�ԓ�?��9(�Q����fшQ��.��P9�'z�Y��"����SU� &|)ʚ��Pof{Y�N��p�ux��p �c���Fq���������X�?%�������.�WEJ|����D��VО�V����������K����2謾����t͒�m3�`�?����3� y�͆��>�K���5<c���l�y!V�(��Vy��I��������i����Wd�qO���M�wD�� �Q,� �����z&)�͑�P�;����FEfG%����#��9��!5A���x�DF�����z� oK�&'6��P�˨@���u�E�"�9峁l�Ƚ�oմ�OK�S�j��e~+���d&�j�7{�o��_�CW�����JH�a�B#��=��!�/��(�<��k�G"[�Ѳ��6 䪭1���H�Ml�=^������w��}���(�=� �Q��{�����,$.(#���Ai'�!�&�w��t��m���DZ���C��W��������t���h����y������� �R�;-D�t����\V��4;�↳'���}Q�&�C�28��cUZ��P&�09��E��{.�Ż����@��X��\X}�у��fO��h�i�:6t-H������vD��^KoG�B�7��e�C�\�д��.i�"Zޮ�/����ڞ�xߖ)قa�^ΫBE��ٲ����K���6a��2���`4��W�ܧ��AI�7�q ���w�"'t���9q��{� �j�U����W ݘ�,�7��!k^&5��:F�E`���إ�L��66�픔��U'Q�^���L�gZ}1W��MQr3ee_�(�3^���n[g3���ķ�=�a�m��zQL=~rR�Dt�P��������AlU����D��A�t@�,�a�@������45���]�F����c庮C���:������HM�N�X�C[�o���<p�t�)��#�:F�fB�Z�k� |"j�FI�2K=�FE���ajP[���&�=��ϸyRj�|O�Z�����l�9֎TzÄ�N�i��ł1�I/6���r����p���W��Be��A><�I���/��{�ʍ���uZ�D�Bkk��$��s�JOծ�:��;�r�x�>��V@]"�s�K�u �7F�JG�J �>� �x��d�|� �����m�]�S��G��f��{-��y�l�I�ͭ�:��: ,�:��C��Ãɬ�}x �z>��� �_�J�滎fD�5�& R+�����;�~}T��^�s%��������#���f*��u�nb_���i�Ұ��*��P'���k��*�X������Ľ]-~�BM6�� �p�ߴ�ō�|�*�Ϫ=�V��G��O.w'�N�ž�ڐ�1_�������b�eK���8�2z}��^�� ��-��� 'dZx���=9N�� H�����C�`G��&9FE�Sm3ݘ�ڦҟ����ѳc�p4�$9⻑`(&��.� �^�f&wR��Cd h� [�)�ѣ�3�BW��5����O�I ���1�N�ɑ���[���G�p�*�2q0�K��d�Z��2���䲼� z�1� �����bl[��_� �a�OK��H��I��}ss7"ŀL�Es����Ȥ��thM���5���D-]]Y-ӽ�;�^�mM{���,I'�i���'�k�����I�0�-%'��i;��:�s��~�2�r���m\�-�qt'�F������2W��\�iyf�sv?һ 5I��5�ԋ��S�f:;�� 5���=��I�T�0���Ԓ�z ̀�n�ғ�����ޟl�)0��nb�V��rH��V�Hb����q��Ph1��� F߫���������h�WT��ܜ4����5�v�n�9,������w�s�G���������h���=@G�]W�1��d�GR�Up�}��--�X�D���_�6�T�z`�z��К�Ѵ�J� �Ty����W6�[�w�VX�v���d9��S����G��X\(B�� QD�D�(�Azk]0^�]m�ېf���������%�<��u�:y�=�C��u�� � �j���l,մ�n6����4���'4S�d���#Ok���r�*�����&3US+�y����v����NnRЄW��|K|�B)EM�KJ�U� ����7x<�q.S��6Gd�a�r .�EP��'Z�,�0�g0���[�I��.�����8_�wjb�p�����6�Gd�C��L��ߚ��Ј��a,ܭ9��,��np�xaK�> k`� Y�+�K�Pd�ĕ������2^��|�0$rYy]��3�{U4dZ���Ja��hro�w�D���`Ecw�ɧ����bS�A���Q��44��c#25�����b���Lds�*,�JOԘ �
Behavioral task
behavioral1
Sample
dc2eee381d68db26ceb9ec3fb32c930f2519d225e4e873e4b09f31ee80f43f9c.exe
Resource
win7-20220901-en
General
-
Target
dc2eee381d68db26ceb9ec3fb32c930f2519d225e4e873e4b09f31ee80f43f9c
-
Size
206KB
-
MD5
df66c4a6c791bf716c6f8943198939b6
-
SHA1
30235afc2d49ba4099d3782b097f18886d7b5fa3
-
SHA256
dc2eee381d68db26ceb9ec3fb32c930f2519d225e4e873e4b09f31ee80f43f9c
-
SHA512
f5e1a2a09ff75ed1adc717de739e597d55794eb3033277732d3fbba92737ff4cd4117921c73f8660367b01e2b0ab9b73e0d84c3b1fcfe6c9fb57cfd9225dca81
-
SSDEEP
3072:ADqZuDbo+XtzDnPmmZ+FEe5tRYuNt2XdzZhPzBO+t3Z+FEe5gVDd0L7id:AmuDE+9WmQ3DYLXFZh0+t3Q3gVxh
Malware Config
Signatures
Files
-
dc2eee381d68db26ceb9ec3fb32c930f2519d225e4e873e4b09f31ee80f43f9c.exe windows x86
263b61a24e677ae8cdbb9af68c282ab3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
oleaut32
SysFreeString
user32
CharNextA
MessageBoxA
Exports
Exports
Sections
UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RUPX1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ