���u�G��[�O�|�[ #h4��~Ļ�i��W�T�k���,\d�&��tI�x�%�K�4�\�o�{�ae�GOh�ۻ����3i���yEr@��*b��P,��yt��a���ʎ�E@0+������2��{D�]��+�#U���hjϕ���v�0Ø������<yW���y����Y�y���x|ۥ��� ʅ�p��gG���p~0%6�H����i$��2�Ffvx�����(7�T�����ญLN�U1��BI��0?!`����3����u��vhbp�g[Z�kh�lTB����fM�N$z����� �p+o��=FQ�@a�?����y#�~3Nc����8+�jd���Z���5��a屸<��I0�A�ᕷVkQ�7�J��H,�.�?�wss��L�;���d�?��l �"M�� �[x���9��Ԩ��f|�]��|y��U ��x�U7i�����DW�j!L���e����� �a� y�ۉ��]���68��M ќ�`���f��G@8���&���v����D��1�`�(l�.:]�'���J���V��/�d��C��͚�f;<"nM�m�z9;�\����EyHh:yR��bU�>3Հ˙~m[j�9Z�D�'�������#��Tm�4qX�A�n��((�� 0D��z3W݈4�'t�0ڵv���~#��������E\H�|#A"�y�ĉ�rɭ�3�Xޢ�l�,�w?i�Õ�r���oJr�W��/P���c�\�A�^]�m���@>����>���f.L�����\������'�v�O~6� xD�+��)ctYg'�P����镘���J�Jz]�"�&��Je�r���8�B��H�b�S������{�Q�A���Ҁ<C��"�D��oTvU���4�T&-G������G���9��sf-TgSmNH�N�q*�*�����~f�a#[(w@�O���Ʊz� M���������z�$�KL���x=f�rR�x�(?A�1B���{���tʰ�����?@�O�%p��M�i,�Tu����`�'a�����GHaV_��LQ-�!`ԮV9T2 �Z7�a�8�jZ��m���,��s�Q���F;�.č���Ǥ��A1Z�P&���� <緘�:|����q� �:i� #(�;�c�k�'�o�E\��EJ=���r�k�`����$'L&���Fiդ[��Jibz;� {�(�9�t[�D��b��z|����F9 8N�㹔�=�������'p�� c��p�l�B:�>��K���͙�(�I)��ЭG�IuS6��L���e�l�u0_�3yr ^R����ԁI�o{=x��\MZH�!�~˫���y�;� ���T���a��4�O ��W���'*�ю1G㛰�|�يޥr��]n蚤W��rmۄ袊�.����L�BKD�^��D���7� 53N�dޝ!��U�vQ0���������_�%��Ȫ��Y>�{��hH:���`���/}b����RT��$Ѝh���fwJ&���'�'T� �T3�٘��:9m �ב��G8�12� L4�N�O������7� ?#�J��Ͼ���aSA���M�sb�#x�E�G�}�=Pf q{����ija��ZC ,�.��������0H����H}���æ���-��4��j�PczJC����X/�+�AW��A�I�C�����i]���\6�;�o��A�H���K��ŏ�J�s�:2�� ��V�d�� &�~��k����,ߞ����d�͂�f�:܋O���*�P'�f<�����V��<����u�q�s ����f��� �ݽ���~&���h�}m���P��+<����x�c��WY ��{(;��\�ث �h�������S��Wl���~ހ�F�e�GRn�Ъ�%��~ȋ�Y[�@Yt&�;I��&��� #Y��5��{//$����=���)t�3:{ܺ�W%K�=R����3��[�K�>`�C/@@�<�)?Q���q�c8�Ӆ��%c�Pt\P���ŀ����^�\G�i gq�C[3Eێ�����A�,�i:��%�4�A�X}�v�k�g௧#����a�~�t���D�|d�R�:��|�J�M�A�b϶c�z��fM0�����{�-�f�c�ࠌ��{ݾ�zG��sk�G���6r�3<:��zq_���̳���ũ�d����?Q"�$ΈVށ��Yt�;�<��SYP�h6��T�Yr�]���+h�ov��AZrs��O۴���f�1� ��⩉+���Էe�|wW\�Nȉ��X��v��A�%��(��@���i�����I�`���M�{��^�n{/����Hy����8��Ҙ��u��u�r�R/�"����W�3���Zx�t%@_h�M&��/�k4~���v �n�� ��fC&w���d��aP̜N;M��J�h �FK ϑ %��D��Ԕ#����Dž��N�Q4�YMkԸ�E�7��Y>��1�9-��Ⱥ�*� (��7��'�[��<��4S7���9���ָO�f�4S�@:\��Un�j{jY���-{�Zk��on�K�$ᵎ)m�t�\@�H�@B��8Yw�;p\�A:�e�ck�[��e�%P�0��ޤ��H�p}X�D�� ������ף.�\R�K�b����@�y�o�+y��C��H�w�>\�$}T�x*��5aiF�F��Qik�ܚu��Y���`�~&�A2��n/3Ĉ�R��za�R�Ë��M�ߚ���N�ÀWES�i��p>�u�)�ڝ�8�!Е�����Df��0F}' ��}����>�h��E��ICp5�.����<Eפ�}���I���ԥD�c�K�0v�j]�I�������ʏ���vb�q3F4U����<B\����<{؍��dI!t��b�̨�TC2� ��W�Sb)�}O�3�ե�������G��cjILJ�V��xs\��ߏ���W1�����N�Agc��"j2�[�L�t�ѧtx���40���^Q��@�Y�jIT�p���oo���B�����VnVz��?�6�_�
Static task
static1
Behavioral task
behavioral1
Sample
af782c06cb5a41f2e740aac66b88db129d1bd53a7e82ea568404c1f65cc163de.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
af782c06cb5a41f2e740aac66b88db129d1bd53a7e82ea568404c1f65cc163de.exe
Resource
win10v2004-20221111-en
General
-
Target
af782c06cb5a41f2e740aac66b88db129d1bd53a7e82ea568404c1f65cc163de
-
Size
2.4MB
-
MD5
efa1cda6be295c4b463eeb3f967ef914
-
SHA1
278a0bd604da31f987887ec16554930dea7c4b06
-
SHA256
af782c06cb5a41f2e740aac66b88db129d1bd53a7e82ea568404c1f65cc163de
-
SHA512
1a304a728bba071f367d1e6786f5aab5c46dc9e4c5d772b1ec078482f7953cc13908ffb582be482ccbabac7d68e93aefe5b68671aad71a1454acc328831ab78c
-
SSDEEP
49152:AL80x4RovqotSBQAA6z5WG9Oky+6hpBg63SAuE2h8ju:AL80qNotYQN6z37yPT3SHE2iu
Malware Config
Signatures
Files
-
af782c06cb5a41f2e740aac66b88db129d1bd53a7e82ea568404c1f65cc163de.exe windows x86
3f5f50e32811337c783708c40ba5d6bb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
advapi32
RegFlushKey
oleaut32
GetErrorInfo
version
VerQueryValueA
gdi32
IntersectClipRect
ole32
ProgIDFromCLSID
comctl32
ImageList_GetIconSize
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sd0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sd1 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sd2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ