�P�*���z(����X� ��1����]�5�!-�ZY8�р�[TQ ��h ��t���9�7�7���w���o�t��{�̄zH8l����i��w�h�<Ă�53 �_G����6�e���Nsyܜ��9��(��wjCÞ*�e��w�-�@4!��?����������!���< 4z���.U��y^�9�u-l�M_8e\ �Ƴ�0c�O�י{<s��&)�PN%��ʾa� �I����9�*�FI�˄��t2|d�d47C�%�f�Ȳ��!9����q�D~&[b�"�,��PO �oĞ�w�=��T[���0��~5��z:Z�����ݞB�sN�T��d V� $�_���6�X����6���d#�����Ԙ�:o٭����I������Ѡ, pC�v���A=6��aHD㙥���:���o�� 4��M�R��ūhmz�R%w*U�!t�8�+��(a���:8^��u��ܳ"8���g�M��E&����P����."I�Z_X��N |�j9ɑG�VS��jt�]���6�[ґdo�Fma���/�����]0{��K �v�AA����J{��~W����j��ͲVvq,a���a�C�^6��k��cw �,���� )bh�%�4eM����l�St��Jj�~�0}/���Ų��O��v�^WA���0���fdw�I�1�'���*��݈y���N����yn�9� ���8� �#�V�f��6�ⶃ~��]�C�b|~9�j�����Y� �r�a�ș[��n��@X�u+���<�G�i��`^��$M�}���۠/Xq�&����A��y!?%��PT����7/�>�6����*����Ң�z��xE|�3*�L`�\@h�)e�A����l����F� 5R���'��X;NF@x<1O���$9����j<5=gW=z��;�.����\��_S�4����hp��+7";�Er@��o���ʃU��/��Nw�AMP�3��O�;fm�<��,��?4ߍ�}`=�<T{��0ꠃލ92�o 2��!���4ȵ��ҩ�����N<���o����y49�O�J/�OƠה#X51�Q��6�u��.���3ӫ�G}f'��<���p�ҕ�}��֢��U�B�C����<A0a���G4��ư��~2��:��,�Ɠ�r%O�^��(~��u��77 �2���>��)Z��zo%��M#{��Yv)F���B��7ɞ�'*�,v$�L��W�f�e���߇�ԣ�!2�O�T�i��a}-(k$��ѿ�o�{0>+������Ѫ4a�A� }�G6���wn��6c�V��W�Ì ���7 8T^��ȡ� ������a��W^bex����v��Ld��D�;��h���?R|�L q�!x9Iw�6��3�!i�qM�Yi�EA����}�r�sZW�!c��Bqr�^�L�D>��fn-� 7@)LRj�2�h;�:3O���J8y�eo�P��C�����B�f���1.iQPdK��l~:*{�>�} _��}`|������uY�_�P�q�{Ȅ(��v�f��YV�٥%R����Q�q]��^�o"�p=m�@u��k�K�w��?�uX�4����8��}@�saq��+���BUU��66fY ����;�Iٻz�[��4l:��e�8��)s|J���ڊJ��<�v"���<��f���K����>����)����>�Rン�>ygM$};#��9���H��ˡ_7��� @����7��p�@k U]6%Z7c�-�����D��_h�C;E`q6�6�����}Q|;Spw(3��?Xm��G�F��-G6.zˠ��j �Zґa�YO��D*f��R%�����W�Ex8ӎ��9e~\�PԚ�עb��e'�+�\n'����8��ot���b -��Nȡ��N��"��`6!�Pkb#�3�3� %/r��XNX�A,�Rm� R���Gxȍ\��B���2��j��H��E:�A����yWQ��t(c��x�Q1��,vD[ci��HT_i���<X�b(UF��D�[wM"�@��$-�/����сo�8 'K0��^�� ����p�Z�׆��~A���R^����QT�����{|�u�lX���� ~�+,ͩ}�N���T�� ��N|��Zq#5h9�'pi�h�paF]��`i��W��BFi�J����W�!�2t,b_b/��6G�(��!7�����*1�6E@x��\+���(u�F���������u*�sfe�\�����I)��E;���DG���`��۞A�$\�i�>���A��`L��"��v��-h��y~o��"��A�˅D V��� h��}.2h�k��~0��� Pi�'��;�p���M�-�Ue8�A]�8��Ug6�6=�֏*|.��������a�%d}K�a�]��`;@f��.�*�<C w��P^w=�Oc��a��Ɠy�H0��~:�N���,�o��(��)�N�/g���=����R��8��)���a�i6+ө�.Ш��||�jj�50IB�1_A@�vcF���xЪ%^�n!N��F;#oq�܌�s��j0��e��LAӁ7YFo}<E�{�E��Af*8��"O���`M`�˵��e^�0/Wh{B���KF;�b������%ˊ' kʽ;g� �XU*���t>��F�F�J3���G8Fk��9kZ���Ld6j����u ����ZtA�+��OhǛ6O0u#�����-����q�B��ņ�Jzm�=�B�u�/� �Ǣ�B�E�B����I�;0C�����l���?1J�VGh��5}?F�6���ʙx�#�|#π�a�ᣋ��_R����o іi�����7tz��=���i���������x����0��G?;��Jy�͚�P_��P����=L�젴.@�`nG���*>(�&�$��Y�G\O�T��OK���gP �L�*�)��&G��b��4�8���4�C�7�����Lа�P�������r�������r�l~;�A_���b7�� }!�F� �g����`���i����������F��U
Static task
static1
Behavioral task
behavioral1
Sample
656aaf80ab731b1de127c28e5edc56ea2a3a7bb169324f2e26bdd859dcc36cf3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
656aaf80ab731b1de127c28e5edc56ea2a3a7bb169324f2e26bdd859dcc36cf3.exe
Resource
win10v2004-20221111-en
General
-
Target
656aaf80ab731b1de127c28e5edc56ea2a3a7bb169324f2e26bdd859dcc36cf3
-
Size
2.4MB
-
MD5
e8d505813702ff27fa457390facafbef
-
SHA1
0650beb65eb68fc35095823615c0407345462923
-
SHA256
656aaf80ab731b1de127c28e5edc56ea2a3a7bb169324f2e26bdd859dcc36cf3
-
SHA512
e0641249a16f46d4893bbd8eafd39f94475c8a60954f9fdb6225134efa6f5de10785c9788fe9d36bbd20ad3b9e86889d2ff4b856b4912cc69a5729e679608875
-
SSDEEP
49152:IAtWXxAm/aYLCiIbyhsWUrxC4kJZ8iNI9j6UTRRvSWTbeiUlo1t:IYQxDQC4OrQtTeWTbepu
Malware Config
Signatures
Files
-
656aaf80ab731b1de127c28e5edc56ea2a3a7bb169324f2e26bdd859dcc36cf3.exe windows x86
e1a2f2ecc67fc9f3d8c5a0487dcbd6f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
version
VerQueryValueA
shlwapi
PathFindExtensionA
advapi32
CryptHashData
msvfw32
MCIWndCreateA
imm32
ImmReleaseContext
winmm
timeEndPeriod
ws2_32
WSACleanup
kernel32
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
gdi32
DeleteObject
shell32
ShellExecuteA
ole32
CoUninitialize
oleaut32
SysAllocString
psrpc
ord92
var_conv
ord62
httpfile
ord3
Exports
Exports
Sections
.text Size: - Virtual size: 25.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 439KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 722.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3DMGAME0 Size: - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3DMGAME1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE