�#�)� ��͏�q�Em����Gp�����?4�}BT ����n���>V)�/XELj]E���ŋ�Y���P��U���1 ���@@��)�i����n���M�y~</-p�@"����v�p�]�� Т$��oA��.�5h�w`�7��z���`�H7�}���_x���������}�i�X����q��fWk��i��G�+��>=l�!�9�)&��� sJ��~�0�鼲6`9���xҟͫ��E�W��g �r�$����9cc�Ue9�J�@������l1v9���z������uJ���Ѭ$����$H5���΄7��� ��ȯ��\d�S[�����x��iU�]ՙ'n^��.C~�����`w���U�k[�?�(�H���t�9d-�Vَݟܞ�T�Q\����+>FSl�f�Ȁ����:���~� ƨ#�6�\nDD��~ͼO:JT�E,-�'�ٗ�"<���'�{�`�p�`�����a�99� �X�������h�� ?�l���o�4��L�Yd-����8\5 �E��<$��r�)h2����/��x+wURy�����k�d�������X\����Լ�'�xY�j����(�:����@C�8u��/�^�-mOu�]/&�z��.GYY$g��K�axJ+��I��cu��kC�I3�3^:�i3>��܁EΖ�����a.�F(٦wIF&�m����'Ǥs���$����t��v�*yx9��;�� ti���OQ4�όYO������7.kӝX8ˌD�WS�l�|��]�µ`K�vC��%��Q��W� ��n*�]�� +q��5���?¶���x�Ф>L���r�SP@����v�A�������F�{�jc)e�M�S���m{�8{$̂)L�+��Wl�Q� ���լ�BU��SD�ĺx��p��� ȼ���"�����M�c�h�4Qm�.�k�t��Е,7!7��8��mی�7�S{�f�)g��0����4���=P����b���������zL�C��%G��v�N��'-Z��xC�R� ��g>��\�|�n�Q+&���^k/��L'�j���M MF��"���|?!�ǠA��\se?�#nY��`�����`��x&����7�}���6rЌ���d�~s5*VQ�m��+�WU5����m5ߤ�m��M� go���憬� 戉<y��"dL=��{��f�^ۆ0[��~s���/������,�V����g��+� [�C=,��m[�P���A��V��t��+�⤬�*|>D ʓ�Ź�x��_9Ygª�7ł֏::ݤ��l���~�}��^�HMQ�_53>� ���.n�����Udy'`��B���#�@Z����j����u���k�[7<�bm1��H�#����5���B�����p���2!/���Y1�?h���[us�v\��j��o�ӷ�T0Z��mH_l�� ?�;���ۙl�R��$j��{6��W`�E8�W�K �?:&/6���`z�r_���π/�MY#yc�x�HW��Yg��MM��_��em���6\"}��ѩ�RM�+�Mj����ͺ���Pe��'&��B�,��N�����W�x(Td_=�=������@��P�w�2��1X��i�t A4[���:>='Nԑ_���u9 �d���`��"�.�-\ �PbE$i���h�{� ��i�+��łM��v��}gh���~��ltW�.���GK m�#����փʖ�&�n[߷J��?�#|Nx�MU*n�- ,��*�"�//�aR�Z��⼎ps�$�ڼ]=L�h�XG�G"����sPM-�a��Y��G�Z�A���}��ވ 2�����;���9 �ڶ�#+��glCX��� /��Լ-pY�@�9�R���A���L���q]��'n���:��,5�g�lf/���Z5��͋��j����qE����@����>����~墐64�A�`�#T�:�A�"X��Ԅ;Co-r�S�.��{J����(�h����:���9��4�N̤?��1R �>� ���JU[VsI�*��Z#M���`G]��( �c�s�'����c��A#�P��ewÙL�7n��Rǒ�AB'P�J� ��������5o��A����$������ ��-�-��)�-��ۄ� ���Q�.�d|Q�~�����O���M&�ɵA���\�g��zܾ��M�Dt�*�}��v��َȳ��N� �jG�3�Ǩ�?��u����td�0Gy���k��s�Q>����u6KI#�y`��J� GN�k�dsGβs�$�ѽ���c����O���������0�n��OܒP��U��A�uR�7�F O���6q@�E��(��?/�Yhh��X��.�����O���p�"9�ѡ�/�x��ɓ�m���4U�������D��h�Σ��vf�=��2Ӄ�KM��������LI>��߬R�ҹ���*eai��F>�~x#�Ts_U��� ѕ\s�P���1� B\)U�����&j��fT��X+Ǜcҵ���^��X�I��d|�Vɗ�AMP{�Y)y̔��Yg��N����RUoW&2ؔz� �ǃ�ǎ��h]�I,�gM�Q�f!�\<z+;������* PF�m�n���PS[q�⎚'�n> 38!ls�:nڔC}�_U᪖G��<#�P�y�b9M�& v� ����ܲ��-�T�o{ Cr0���d��O�'��9a�W���Z�m�hm���r�s�,"G�d6t_��{��: �.}ii�S .X:��EFQ��g��]ŕ=��V}���\):��[��o�3P5�����</�9W�������]��峜����C�1�4tNσ{�]@re�< ���Ss��/ ����?i��pb��6�z�����`(���D�DH�h�|�uM$ ��E��Y���gr��S��Ь!�ixQ�`����i���a$QR��?�3,?�9�d�}�s}PQx�tu��#�n���qL�)1s�T�AmCJ��m�Fim�zȦb�F��W��m���}��E�8�:����go2�S���ٺu����,}`��3
Behavioral task
behavioral1
Sample
f402e77f848690ba0391a2de5bd7f79868b9a7b47fad9f4d926eafd8dc1fcd1a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f402e77f848690ba0391a2de5bd7f79868b9a7b47fad9f4d926eafd8dc1fcd1a.exe
Resource
win10v2004-20220812-en
General
-
Target
f402e77f848690ba0391a2de5bd7f79868b9a7b47fad9f4d926eafd8dc1fcd1a
-
Size
235KB
-
MD5
38add6de87b3de6a8608d467efc35e9b
-
SHA1
3e9c4a3d91415368c2f34c43dd39efa0ad1870ec
-
SHA256
f402e77f848690ba0391a2de5bd7f79868b9a7b47fad9f4d926eafd8dc1fcd1a
-
SHA512
d357b36b3fb16be819c4a668c042a516035f6529db63739be5b49c668ee162470050a5e09525b39ce1c99b3e9ad5bf6922ae6ae5328b180c6937da682a3c4cdf
-
SSDEEP
6144:jT0z3bHXEWwzdjzggsFU46wU1L3S28SkvG:jTU33whjPS0wwzS28Sk
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
f402e77f848690ba0391a2de5bd7f79868b9a7b47fad9f4d926eafd8dc1fcd1a.exe windows x86
a29a5c10268c73710104685417460caf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ