�M"�TW_� ������:���.6�>��q7 �&AԤ�������h ��U2���<>�ھm��vyR�= n�Ua��z�����0�����"I�z�4�Ѱ��5�u�e��a��@j�:o0W4B/��P�s2���I@�J%M̚�2bB�����b��%����>����:��`�f�ߙN|p�����q����������B���_�l�cp��"�,\�V�� �]ik�_��[%��� h�Kw }f �cܒ�U���]/ %� i�BvM��� �^(��*���#�$�T+�Q�mA3��x���1F`˕8,�^��C�b��1�؏O�G� �z�QK����#�?��=����*$'���������y�9�� AۿΨ+�j~�`c`������scFr4�(�<j���5C1��c�G��X1�iHg�U���@�Yy���洑t�����������S�'- �ʐ��g��VJUuB�n�#�Pt�g���j[������)�`ƔN�<�ǝ�c%��7��G|I?�#��&J�<��#GO�F�ȵc�~?#_=�{K/}���k�/ĝ�H�� %mf����������a@�qo��ci�xx�TZ�N���<���6�������sN�܆�6%0PZ�6�Rx�utn�I��$+7 9NH2?ӡr��&Y�^^LjiL6�*`z�*�����{b��Z�<%�ֵ+yĦvjM��WXI��閇��r�T�w;��d�{�x2�P��?�'��*�D6��pƹ` �m���=8 �[{`{!���x���fP-�*ኄlqGQ��Ȑ�A�������T�p�d+�u�`� ���έ&�=� ���wy�a��>��_��ש6~2��a�;4j�E�j8��z��4��Te(�cs�OF���_�C��_;�T����'\~�r�G�[3� Fj� @Qz��~��ň0�����0%� �kз���T�pS�r:�O�� @FRYr-ȶ��y�u��:�Rf۰<��C�C?��8����Em�^���^KQ������\nr82�+�M�F����v�/)S��0����=���(L���P���Y��(�wfٙ�]-�|� ݎ��@ ��Z�Ki���Ua�Hii���Upb7��l�D�#-U@O�4� w$�m���oT��)���������զy������F��K��pw'���,F�v_RWO@�+�#s�AL�Ŋ��:� sfq�}����Rl��(�>)����B�u����GY�����0��2n�$�:�uu��u�I���w��r�.7r�t.vx������.����Hu��,�K����46�+�aG����r_VWA����͖;�2Ͻx����n����K=���-��ږ�E����Og͗F��[��3��"����:ᗭ3���,��R�U�fI$��=?p0��?�Q)R�����rCsMr|������Gq����0'E�6��2m~S�2Zj�B���&�����[�9���_ж���\نi���y�f� p�T[�a~Ĥ?Ɯ_Y�.y��a�����F����ى����m��T�>�ӓ�D��H̫��@|��ʏ[���|]��^,`�!%��Jͧ�N�FBp��qI�=�t�ę�/X��F����aD�@��9C�e�W��|���y��d�T ���dh�1f\ug�1�B�l��%��h/o������O]��*�h�!vF:ޙ���y�&�0�+�_v#�-��s��2�-��Vօ5�{��j�Td��Y��N������y� ���p���_�SFZ��������j���enB�c�K9�ǔ1�l��ҝ�K�MC] ;��&s ̟���N~z��:lR�_�r? �͊?��>$�#�K�1^�G��d{{�B�{h���*�'�� �Z5t|LlQG�K2n���Ї����>�'b X��p�C�F��GZ��:rC}��Mw��0�Q� �:�Hks���k]�[i�����G��n�b��퀢��F��g���_�C;��J%�����꜔�`�E� ����^��O� l���(C)n:��,��{��U�����O"o�}��1�:R�Л�9�� ���劝|�Y��)&}�Aa�C�_��; ��WR��a������Q��1���,�֦�_���v�a���H��A�tҠ��Əcz ���Ƣ�C��$�AgRP��t!Z����E�C�����7]���j��6�vI������qQ����e�?!Ξ�Oڪ4�}`?��h��Q�R�[�Ľt핱&��7��,�B�pQ��b��5��-u')wN�XA�v��(Lto�a����G�Zuf\�qa`�������� �ѷ���}&!sV7\� �,S�P0� �қZ��/ʙ<m;%"�<Կ34��j��ډFTR .ܲY=(9�[�c�0L�Y;P#�D<�Ҝ�s4?�<YF7��e�pFd�:��7X�?K�笫:�j�iuX����8IX,���T%������헵v�l!z��e����?V�p]d��/�/�qU֗����OA�?U(�6l���v�Ąn��u��I�ܖ�п�I��PXx ��z�ϕĺ231��������\��������������;�������w�y�E" lBy�y��u��$��IJt���W\��:�N��|���t �R3��K��mI�9�=�\I;���f�������&H�Iu�.�O�t[�Rm&PH�a���n�uEi��}���+^���L5ec����w͜�F��2�$��X#a۾Vk�?XWA�6�z�1����xtrխ�c��Vw�m.t���3@qEk�E�?=MbTa�='���\�m��>XJ6-�kА�����ǫq���Ln�O*ԎbJe(��!q��sH��#��t8��gV��!���^[_�c8��J�T��ݹ+�T����uQI'�d�SڝY'Yz��E������Z<�=��������rX+�a8B�`���aD��9����+ȏ�5F�Q.n�W�����v!��O0i�9���TC�I�C��&P�$AS�F� X�fӴ[�M�W��!�K �=
Static task
static1
Behavioral task
behavioral1
Sample
de2c32d344e6e9681a25987abcf8508e3474924cff467fffada94494367a7e2b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
de2c32d344e6e9681a25987abcf8508e3474924cff467fffada94494367a7e2b.exe
Resource
win10v2004-20220812-en
General
-
Target
de2c32d344e6e9681a25987abcf8508e3474924cff467fffada94494367a7e2b
-
Size
2.2MB
-
MD5
8aa798bfa2386d56ef79028ecf171904
-
SHA1
ffb1440356719843ce7efce10330dc146306c0aa
-
SHA256
de2c32d344e6e9681a25987abcf8508e3474924cff467fffada94494367a7e2b
-
SHA512
84ae68eae81f82982cbd4eff01f218bedc0ad584a2de781777c71cf417b0803db3dfd064cb283889c4d5ecc96974f0278a20e46f6f4fa80f5a85da8704bfeb22
-
SSDEEP
49152:L72OHLugDZq0lFrQSAbeDNmXBZ5t6JybE9RxV9D1SurYOx:LSOfZXreONmv5AiexrhbV
Malware Config
Signatures
Files
-
de2c32d344e6e9681a25987abcf8508e3474924cff467fffada94494367a7e2b.exe windows x86
ba57268ab1a4628006e9409894b69567
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
WSAStartup
version
VerQueryValueA
rasapi32
RasGetConnectStatusA
kernel32
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowDC
MessageBoxW
gdi32
GetDeviceCaps
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
VariantChangeType
comctl32
_TrackMouseEvent
oledlg
ord8
wininet
HttpOpenRequestA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 521KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 830KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ