�R��#�Đ8V�p����շ L@tp���4C=� \��Z� 0�Rz�5���@a���g�4�.��4�BT��>��Xs��P�QA� �ȅC�f�`Ǐ���VH�F�7p�v9�J��UW(�� �K��lA$γ��n�5�����ז�Q�DΚ�M�n�ዌ��b_pW.�a� 4�q�e_aq�5�|����~F����N� A��Go�����]�qA�-{�@0(��EL�*+�* �d���m��fO]$�ҟ�p���ILh����J�����9�x��m-WW���z��dȿ���,����_Q���r���j��d1�)5�'$�V����f܊l��_u���5��ka}�¾�Ǵ�1ĭ�?�8 �ݣ��w5���S��f���3Vk<�P5~X�z������6$���Eb�2�8:'4�ۅ�KEc���?�x,�^�`Z�_��c�NT���e�#ྏ����x�f���>�XY�ל��'�.c����� �n�˭M�֥Wpl���Tj��$��5��;�$��i h�щ.��hd LN�Ҵ?D���u#k�99��q�J�%(W�ԏ��zʡ��+ֺ�C���u�^�UG�(�����>�o�`�I��0���� ��i�&]��*��v}�\ �i�`k�^�&���5�I��Z6\2cz�ԉL�Dh�Rߺ-|��xu�9�yM�Q��2;S�uk����W*�5���<�� ��R�7j[9�HI5LWz�SBZ�kM/�t/�(��*<|�Y�*GA))�ԭ�8�� D��<\�t�~����|4`KLօn�H�X�d<�_)��8��6ߛtׂ=����`���w�,p�@/�������S[u��D����4��nV���}��|�Z�W>��P�� f���)>H/�}�!8�� �qD%��jĘ�����A��V�S�9?H|T��K�u�"U����9v�L�a�R"�6� �/�}�f���F��\� /�wX����/� %3�� M��shyc��u�o�:ݟ�iEi���Cv,��h����������E^�==A:�Mx�������t��TI��C�[�����u��Yg���� ��^1�n�;�.-��̕έ[]� � �����?���!�/cbȐAy�����;q��9CD�o�8������oj:���0��U��2U~�&D�����D�?j���W0�[ץ�s[��;�?��k��ٶ�w����,g�\�w߆2z��y���Y�������;��/���?B��+ڌ/�tVX �خ��"�ݞ�֝�Zl�����h2 �2��pc���\��jP��51����/��K��IJ�$GX@'N�l�eMo'��n鷢[`�EH���qe���'o ³���j��Y��1��bn�!fc{�ձM���j���h�J�!T7���<O{�&hGQn���hlZ"ȗ�$rK�R0������� �+^�5k����:@�l@���]u���25{�Z�8^�yE�Q��H�� �e� s�*�(5�Z%2��5�â�M�m�\��7&y�4�up-%���lr��+��Y^^t�[��0Bu�.fp#G{��W�� ���MH���[�t���R�SG����'���>�w�b�x]-�E"�1`d�~pn��X#ȍI�*�Z�w���r ��"���pD��X�J瘬R�!�����l�;�_�o��:�A�Z��o��YJl���.�����"��ܭn�4����=F����:��0BJ��l}�@|���P��}e���1�z2����9��,�X�ٽ�4R(�I�zغh�X��f�|T�h��<^D�GXwV��y������:�Ӂ�L���R��ώ���F��4p�ą��ނ]$��Q���GT�F�y�F��?;'�q5�儽�>N�vz㾳�O����*O��Ӹ��>[�T��U�`�<b(�O?ԝ�ȫ���U�� ��R!#�T�����/���*?FN������aG̱ ߋ���v�1�juhX#hN���maCTg^�+@�RI�+Q�Gr�ML����puSc4�7W�$L1� =������!K�՛��h��ۀm`��?%j�̵�L�m>ۗؑG$��\q�� �1�} 2�[!���Q�m�h�9�D���O1Y�4_�ɺ~=>�2��ãWF�ֹ���֫�!�b��{}l>�,��%�p���Q�t��ɗ��:��_�}���ژ��}�����P`�1 ��y>�T�F~n��3�¶�qar��Z�o�^E!t�84�|�ȒIJ��㘫�O�%1����,1_U��ֶ�7+`���|��\�ѣKd���x|��̇^P�j��n�H�������;�_�|��{mn"�R$��c$�J�X&�<:����;�y[ Z͒E����ؚ-Z��O�c_[(����?ɜG͛�1���9��jT ��d�8#Ɔ�!�D2�h$bL��]q��y�,RP�δ�G���iAoO�^2��]��&��������/v�5��q��f���ۛ�>y�Ш�0n��^8i�b�����5ҧy����ۭA�� ��==V�z���,>��W&ʵ��J碞�K�����,h˞0*�(k|R�kV��/Z��o�U�vѓ�,�NEϓ��#���y;�~2�,��\� �DZt��.���1�� )u�4T�� �8�V�//��H�����V.8|n�}ċ1��:Xm,f�- fX�)�dv���i��9\�J�>�����VNڏE��g�ra�����o�6���)�N���T�)H�^��v�Qfg�~��( ���b���O��/59_��j�Sl����~�2���C:��whqO} ��"/iDŽ" 8��� IᗋDmx]5�F��<5��F�ʽ��$Q���s̡n�����TH���֦}z�印��,tsظJ˩@Q,�a�A� ����"�1W����I{w�����C,Tќ�k"Լ���*�A C��#��[�[��t�����K�D�<D}x�m�u��e��Y������ڃS߶���Q�� n���k��m-�����!�雥W3�y�1;f<��E�A�]���v�c�j�����v�S
Static task
static1
Behavioral task
behavioral1
Sample
e0117d6d5a57e7ed677ab02aefc2394afd46c805303c50f7665f33143cbb8bbf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0117d6d5a57e7ed677ab02aefc2394afd46c805303c50f7665f33143cbb8bbf.exe
Resource
win10v2004-20220812-en
General
-
Target
e0117d6d5a57e7ed677ab02aefc2394afd46c805303c50f7665f33143cbb8bbf
-
Size
180KB
-
MD5
dc25b838b4dc4498ab85e870ebae6dac
-
SHA1
015c65da020184a0cb644667449f62e9045a7761
-
SHA256
e0117d6d5a57e7ed677ab02aefc2394afd46c805303c50f7665f33143cbb8bbf
-
SHA512
8a64eb0cf31ecddee709cd244bee89204a537e2b1e535ce9ae1852e6a0c45a94368b7f8f42bd16332421cf4533bf5c66a4f6a9d447269f7cb604bb72b4f0ef1a
-
SSDEEP
3072:VysGzfab/WuJzBX8S8mIcf/4X5fhiKzq3HX9LkC4tcaplBI9ggY:VyXfab/WgzB8SqcfofhtzWX9Lgtcm2gj
Malware Config
Signatures
Files
-
e0117d6d5a57e7ed677ab02aefc2394afd46c805303c50f7665f33143cbb8bbf.exe windows x86
c85b9ec0e1d6bc9cf2e03984e327331b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ