���{������i��]�u-�x��9BJ�ޙ(E���"̀���М�Ko)uj����rց�n$#�J'<�L�ia }���I�����\F�;�F�[E�A ϋDt�7I������:xm��!�7�]�]El�]>���rT��ω�a�g!�<b<�L��ф?3��qB�<� .�lD��w���t� ��i|�k!��]d�}�/0d��wi[��$�����+��I T>@�>z��p�^ws�ԛ7� R���xfeo���z�6y��(3�>ʸ>"�t$G�Fh��.���}������&G�,��}n���� �P��[_���i���߳���*�ƼK�?����YE]������g{�T£"�%+|�D����s�l-��s!���F��}��`��7�4���&����S�ҷH�u�?�ZJy���hhr����+�:�C�$���ݕ� l�8�=�Fo��2#����M�$�� 4M�J|�Gñ�t�����;�*x��=��Kة��mۈ]O���)�D:"�rU;_&r���M�����:y���#��ɪYV5�=���;�?JC�؉���s'c������V��N}�rr���kY�d��{���t���/n�ax��6R:�2;���uv�I'���~m|[(1�:pF�����{�Õ�v�, �T�V����d&մP_~h�!�4M���t��&�'�8˰��N��b�^�3��d֢2G�-6�h2��5� ��P��כ;��*�Y��ůNu���$�>|S�t��|��WR͆X�I�^����f��S���ow�:>}|����BB��E�ݿ��F��c��M�\*��+�)��ffG���pz�n�ޙ�� �^���1W4H���^�T��0kJ���(u�<Osd$�[B�����Ȥ�.b�N��g�~�k�ݜ���t܂U_a�h��,����\���+&F��97դx�������c�t>V��K�uX�Ne�p�P��NST"q�'�5�m���l��%m�d�� ���oBEZ'�]����~��㒌�v���Q0^��H-;L*)����B��X:��5 ��h�l◆C\ԁ�(�0)�iQ"���:�/+'�8G������Dsa��w���z�σ��`H@H� �6�ɹ>p�%^��.���@����Ú��άCŬNP(� �����4�� �A�IP|�@]�?pA��Hi�45�g�05���a0�n���w\�T Q����$.g�i��j˕B���Vn�~���W���G%����ێ��)��B��t��Vd㩦����ބJ�<�Sd�a�w �5 ���z|.�ԇ��c�d���ҹ����i8B<�����6�������Z� ��&6�ܮ�?��@6d�0�3?�ݡ��N�����̺��fz��PU�t�Cm�f�?յ: 5|ի����ʖ���`�)�,�*��x��:Ǹ.���������Սoa ɽ�E��Y�7dܟ�FEʼn��k�K���BO��c�I�e�_�!1�_t.*x�M�㴺�aU�)�ކ(�П���X�j��m��y���g�fP�.o9VXu/��F�O�_����8�������PR�e{�@K��B���"ٌ��O��h��ʪ0�Qʗ�,s"Ь���� ��1Ä�0A��a��'DTMi��n�֧`Mr��<DŽb/#Dž�s��l��P����_z2�$#� �V���]�vX%c/g�a�"�V�?��cϛ�-#��"(�I��U~���?�W0|!�t� �J�8c&�f�OLͨ������X8���/����f����^����>K$��b�n0�j��Z��C���`Y��u�R�i�8�D��������:��d��_�0h�ZJF�,��~?~�17Dh�j��N���>����6\��Օ��c��{� xYѲ��u8���ŝ��jj�vS��m������m��8"�tu�/ŀ��s ��]bٲ)���$"��Wc�U�ų�5�Z�ݼ�3��LB������规�Z��L?b��x��F��r?K�����~�C��6%V?��EGN��6@�^����MRA�}�� &\}5>�K;�O?��Z�k�F9���Vږ���j� 姻��*��K�\}��˴��u.H�c-�"c\����%��/����WX߀%�W<|������{P �<\�_���� ���RF{SE ���cZ�_w���Z�����V��g���l|��-폂mo����/�b.� =Y��1 pj��}��ՑN��)�>r�d78�z����F@Z�Kb� ���������LK�,S(�q�|�Fv\2��wPB��Z}�.v�X�'�^����to<k�cE�1xћ������}8�%�]ç�� �ȑ�����E(��&V璇�fά�{=���r�[�$��̠�E�w�)��x-�������p��xPe<d; ����S����9�G�~&�F���0��c�>{�O���aT�Jl������2��t�5�$�ͬ�M�u���k���6x8���x��<���+ ���.ͷ�c��n:�GC��/V��Dt�M��,o2��+u��C�J�|ت:E����̒���Qt�`�_����X ��( i��iN��`�f��.96�M�� 3�������^bL�7p���\-:eAa��93s4��ڝV���wd�t���By�Z;c4�������\nv��yW����Q���P.�/P�pa|�p���n �܌_a%��pZ�J~`�%�9�ٛ��yۥ��'i C�| ���7���9Ѩt}N̲5MW�b5�1��O����)s���W$E]xH�:~m�Oq�1��l���������;Ui���-�����S귘������ac���lb/�N���=�� ��y{���J���>��@66��M���L+]�C�,heU \'� ��8-(�c�*�$���<p�k �'���6�qX�4Rg�k�r$��o�����/l��,�m��#�l>"���qP��=�81�<P�}���L2��EY�<�A�s�����@^U ���/+���%�h<��Jp[�X�������y�B�
Static task
static1
Behavioral task
behavioral1
Sample
f36dc902674480a1d2270693f3db8b055f66813b5225c37d56955b050c555022.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f36dc902674480a1d2270693f3db8b055f66813b5225c37d56955b050c555022.exe
Resource
win10v2004-20221111-en
General
-
Target
f36dc902674480a1d2270693f3db8b055f66813b5225c37d56955b050c555022
-
Size
1.1MB
-
MD5
7bf5f9afb5b9c14c971a39d9c986bccf
-
SHA1
6f7f6451062b98abe9a1496caa1c1f341ececab6
-
SHA256
f36dc902674480a1d2270693f3db8b055f66813b5225c37d56955b050c555022
-
SHA512
29c33ab56a9653b0a5102771471faa16813c1c66051898480fe2e69d92dfbd995efe5982739959929c9f00a01ab30f4a9a64fdf142cb51842d4c1008dc0aa6e0
-
SSDEEP
24576:nIa+QYX/cqWVURfsc1yYeCSstpCguY9IVjbrWY0agYwNjHVQ+6Cu:nbWX/1+UhhHNtpaWJJ6L
Malware Config
Signatures
Files
-
f36dc902674480a1d2270693f3db8b055f66813b5225c37d56955b050c555022.exe windows x86
ee47db400ae5daf87041b07d77068349
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetLBound
advapi32
RegCloseKey
user32
RedrawWindow
MessageBoxA
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleDC
version
VerQueryValueA
ole32
CoTaskMemFree
comctl32
ImageList_GetIconSize
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ