����(����bո�z�'�6�s������j����h��Ӛ|c|�����R��O/��s(3��X+��Kp�k2�$�ê��Nr��Wr�Zo����=s�zM1q����s� ����]�PbN1�h1 ,p� $��ݢ'�N*+��J&oea��a�[]� �̕C�_�A,�����3h3���D�Q�������fMSl0cɩ��1�H>�9G��]Tp����\Bu�w����.!�;ɴa���)��r���i���>be�oK��{|5���� �y���VM��`���3�֡fm���DGǾʈ\3�sJJ����U9$�=�s���F|�� n�y�Q�iЩ��� �����x��ŧ��~$����%��wL1g�b��$�x��c�n�.����(V��N*�v���G�Ҕm� �R��&�{�n .r��q(AyG����\��g���[{���=_�q��!�tp��=��hć@q�����n�ݔ1��/� \�Zg�Hf�(���U�p`t�.А�����~i����d��ׯi"�"8��N�ϖԳ��)�'_�I:�|~�L�{aĢ'j�����q(�T���� �xp(4��MI���Oѕ`�eyL{C� %�#�8���>�wG�kT�:��x�-�I�+�wfK6)����dx�O����������S�r�PZ�4&���D��Z�q��?�\���!�2�V+�,JBw�"�3�`]t��?:*&�uh}�7��Z�J���ߦm�4�o����΅}�����#�G�g��8�J��b��p�c~g�#��Bb ,M{��[;����;�l �%#�p-�h�X\������f��Y�v�\L T�u�b���HDE֮��l�����}%���x�AAh�����Ҧ�U?%?�I���������R��K���0君��u��H)�x�r���.dP$ɍ��{��MY��M���?&Jj&��6�4��vYI� �t��_�ɛ8c�}ݙ�N�h䋐��83G�-�W������2 �n��D��a��kP�+�<H2"���ez���2�|�U�C�Ʃ;4�HIS���*N^�k2 62�J���$�@��}�@؟��ef�qG��fT� ��Z�bVNE[}���J��$�����9�/�4�s)�Y����l&�=�5�: @~��t��)����oB��mGп��'d�ԭ^�ø�$��(��!\I4�������f�'u*��Aİ.��}3_��h�DK�y����Z���ţa/D-�)qQ�J���y��\sJ*=�?!$�i3�Zt�b`!��ՔE7��KWC��[��6�+,�z\����3-�k�!b>��gYY�&�1_R=�RB����g\�fG��}�"☟� �����{>��G�筆��bܑ��mO�Z�KQH�s�9��S'�M��y�"Џ5;��&����c >���[�k����z�B3��3j9(��>n1��H�Fx��O�<-Y^����C�9RS��u(k��Y��y�+Ǧ�T�gB�s�*�8�+�A�[�J�W�n��t��k�H^�C�4�Ҽ�O�w7�5�ć��:u�����~f�[f�Oa���uC�@��h�ݩ�<��������pw�R�R����)��[f�+���$]ǧ���m:xv}Y���s@��/�����q1��G�#�����kRyl��|�h��|.{[�v��i����ܖ�o��P ��ٴs8�s�N����Ն�q+7��6�b�.�?)3E��t�����:�^�l8*IQ�}�F\���v�? ��4U��NV��v]s��Y�N�C�?B2aͥ�0�m4��M�������qŐ����������%����m��� �Q���c5�����w)�ut�p��%��`��� $�+�!t��lS�u�A�Z���Zm��MR��6�x/v#���`�JA��/�,�'X��uN�6!;u��J��Bb���I��R���)�f�����4�%���';���B�0]�.�?��E(8���b�٫~ADB��`�[ �Kh��'�ڟ`O����}��Y����ܸ�Ƭ�-@�+��;�#�KK֕�����z�?m�[�ƞ%,E������ ��ZU�!��u��.)R����f��[���Y�4䝐���n�쏄��b�=c1�Dɛ���f��T9L�>S�v��fhu�9��uX:U���@�թ�nr;�S��wO�e��ĞV�ޅ��tmr�R�5�q��l_�����ʆE��G�Z�jڹ���R�Gc6% 3cW�J���#'4.Zn�R:�_tAky���4���9C�*!n��ct=��T��8���AKp̃\D�!��4���Hq��9ޞ�Y��7���[�Y�5��ȟ���z�e�s�ͮ��OuFFӫՊ��[�J�f�S�-�����j��{t�Y��q�R�C˰��c��om����$[����{���:���>h�J3`}&�d������'�0�k|���8n0IJ�sy��>���4�M��gLz�C^c�����y����̎�m?{��Q���6jZ.�N�3�D��ZO}a�T��H����������d Vz�����)��[�c��G����c��� �M���Z��j �qy�?E�ls(�b"o/ft\���_|��T�襭�������2?����+ȗb3�Ր�s�̰%U;\�#����>r�O���q���%�Wå����W� t;u�MB ��t���iJ%i��ʄ��Zg��"^\��C�� �O��J��2l���� 0)i���I���WD˦�6J��ď�sH���f�;-�,Mu �j4Q~4�xaOo�lD��G��3���ґ�����v��O"^��Oe{Y��P�j�͞��֔Ó�p�$k��7=����a-|�����u=����s��Nء����?�X}&���F������d�J�&�imv�Vo�@#���D���n=W������]Η�����iG�����V� ��t�DK ���#�������E����~��Fn 8�nّ���l;�&U�����s�����H����R�k)=jԔ��j_y��&i9�
Behavioral task
behavioral1
Sample
b98a8293fabd491530f62d2ba4c2841375c052c1e4372def706df0344364eafd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b98a8293fabd491530f62d2ba4c2841375c052c1e4372def706df0344364eafd.exe
Resource
win10v2004-20221111-en
General
-
Target
b98a8293fabd491530f62d2ba4c2841375c052c1e4372def706df0344364eafd
-
Size
420KB
-
MD5
0d025b7650a45d4eaa0ea95a53fa4522
-
SHA1
93a414ebb12e3c4b8cb25bbe1414a1164a9f1a68
-
SHA256
b98a8293fabd491530f62d2ba4c2841375c052c1e4372def706df0344364eafd
-
SHA512
4a999afa30d298666f4fa54c6bc74e06fa2f549cb618e1129c3b6254e6b6088c816fdb65d5b0602514d413a62dd45df3d289ccd40ec25736fb380c51471839fe
-
SSDEEP
12288:ED+6d6TPHKRocWyahVcKDCP58rc9EJTI9NNo:EC6d4vKRPWyHKDCPP9ks9Po
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b98a8293fabd491530f62d2ba4c2841375c052c1e4372def706df0344364eafd.exe windows x86
00d1bbda4e17ec9b6b8da7080c474cf7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
UPX0 Size: 512B - Virtual size: 744KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 363KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fuck1110 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fuck1111 Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
codedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE