��^6�q��hn�s�!28\����Es�� �d`y��#�o(Ix+L����^(|�+�I&2p�R�Pe=q��04kޔ���{33"���/�|�v��K�<�x�'��Oȭ��� �D���S`�N�ǥ.t~�a5|���:����5������]�?p�nY<�֏����(��)ʹG Q�Rwy(�^�9��6)-��^Rӊ�� �C�*��<�u�J;��q���F�}��^^���+/m�}���� �a�Xh������`�LR�M��z�S�##0q�[֡*1-t�ֆ��l]�cV��P?Z���EӊU?�Rݔ�i� �H�5���E�46L$/�~g o+r���L���Wy�"���M̪T����-���t9`������j<r�g��J%.�&i�[��F߀JL6�z��4���0}X��{��lS�Q�s����]�x[Y t���`Ͼ+�+5��?�m�L��;sb��55�r�6�v\���2Ko1�q��/��Ȇ�(TJ�9�rs�0�Y�{��yP;Y�Pڅ�)���j��������ս��=vu|�wpWr:�2[������cģ�D��BX�F��;�^da1�@ى��2M5�Xݨɢ���q^�J&����@v2���]א�s;e7ԯ&eA �>��n����lUh���߫5�C�A� q�pc<sWd�a�mK[�9�X��7��~A��#�1�2���UD8�3�����VuW4�S~(���MW8�Tbh� k��5&��۬������*����ﶄ�y�_�/y��� �t�$��]N�l؞��;=�-����M�}^�:��wn5��7��� M2��$QF��*<jhUs��ei5P7����X)�}& |%�J�� ����m���"��� ��X���G`YS�^o���h�R��n����+�r�!���Q�Gض�&yz`N��}0l{p��__��q=0'A?����M{�D��e��.k�X����b=�ę�0� }�Y�d�L<Ň�ț|�!`�5=�&p� `�#tNp HL�����)<lVU3���/��N�J����G��g`LO��P�t��fHY�Z]���>6�f9g P�dq����N�왉Z�? ��p}DJY����)��*�ϲ��(a���i��L`��d��8`��:OS������������ l)�*��ĵ��_2�.H���ǟ��[�%��"��]�Ի����g=�/)���.�ȑQq����+d[�8!U�g�e�3�0uD7�r���e�l\�������D��#�~� ����/ Ŋ:�aO����]2J4����ZTF���/�s<���F@՞�������!ʨl����u@*�OW2zBM�|o�[�������~u�[s�[v{�'g{v_�_�cދ}���'�&����bn:�nSS�[�b���G��`����~������AfԴ������@�K����|���L���}7�w �?v�(�ܴJ)����N�����M�k����ִ �9B�2M1�j��K[�=�-���UEᅄ:%�AⲩV���z�P��M�f&��UMA�R��%�C�c'���Im�� �����Ps���&����m���7�#x?cW���]%��mЂ�%g �����W�V���,F�PƯF�>໊%��%�.�/��|�htg�@Y��!�����S��x��iő��jP&`o)��ZP���\�!\u%A S���[w��?��&��,m��Y w��KJlҩh��*_J�y�P֦�G��c<�;�a�TL;A׆=U��{bA�U�lv� dɌ���0t� 6D�/g!��A�Ub�����-�N��tn%��{?�25{�f�a��^�l�,����]g,&�V���E�b?�ƠIe����dw��p�,4<��jv?>M&�ڝ�D^6�����<33x��CD.c�������� #�������Xiߛj�����7ﱄ�>��u6��[��Bd��8+z��[ذl��]DN� O���1;�\�88��z�$<������j}!�[+�S�����!D���P�nj���C��%TR�ԲL�"����z �I�s������?�V�iI,,�"0wO?��~��c�[4�֏Ԅ��I�uj.S���x��6-�5i�}P�����~I�k�~�xF/�f�����C��¦,B��5��c��b�Q�m�و��������hM��(w����֮K�)�!���c�0��K/����Y&Vti��av}��4��=��W��F{���S���@f�OĿ��ܴ��|?� �>.lm�-�~�f��q�Dl{�A�^�{5�N�k ��+O%>��l�>c��4VA5K�$rwme���64�+7���L�nP��qɥ�����-8�Y��v�>Y�heըVS�N �N�TV�1l� � ��ԑ ^��.~;�%��b> �w��8��K���&h��L7���]�̠NGV�ӫRry�K���춬1G��nI��U�����T"}�ʒ�i��*T��J~��.&����_��t�e�������3�6�9m�qjX1���=��4�ߍ��~Uh� �.^�b�8TD��=�"�z��Bϙ�}v2��Z���z�h抷1,���$��?Rē�k+e�(�|����r����CB@5 �F{y/}��TR�D �8�Z�փ���됰��'z�����ʓA�0���'�o1��+���0x=�g���J�G�?�r"╴-���3ZO�`{� BK[�_f^#�2߯�k��]�B�n�ٱߐ��)d��M ��k� ����V��U�xǔ�!��r�AW����(�����N#{Xl��Ʉ�y��L��ƒ�,�j|�tqK�_ս^jJ�y�tm�Ȭ�W�@IӼ���v�Mc#P���i��Z��ơkkk'd`4����v2b���)!ZG}j��!�R���cr�$�I��K�V��C(��P9e�_�Co�FTk�"�O�鯕fi��6�v����v�o�n���%h��t�>��p��9)�B��b�S��m��@f�W��+
Static task
static1
Behavioral task
behavioral1
Sample
ec12e14a5edee822ffcf49c929efa553bc700c59e6cf4edf1b34d8dda95b3407.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ec12e14a5edee822ffcf49c929efa553bc700c59e6cf4edf1b34d8dda95b3407.exe
Resource
win10v2004-20220901-en
General
-
Target
ec12e14a5edee822ffcf49c929efa553bc700c59e6cf4edf1b34d8dda95b3407
-
Size
1006KB
-
MD5
a663212af0bde38a18cf7bd68b0a5594
-
SHA1
2fd4bb26fa8b79bb397afe66f470b5eb6d4f927f
-
SHA256
ec12e14a5edee822ffcf49c929efa553bc700c59e6cf4edf1b34d8dda95b3407
-
SHA512
363ab6d3fd2297fe935b6dba501513e253b88946dbefee7b0c0e477792c74e7da383664b93a215dc6e783174f9d92a35cce47dca6d63f93295fec9ab827f6570
-
SSDEEP
24576:+NkPn0OgaOih1Qw3YIjcfoMm1O0oFOJGEBwyMDsGs2mpMJs:WkMOp1jIIioVWFO3wyMDOK2
Malware Config
Signatures
Files
-
ec12e14a5edee822ffcf49c929efa553bc700c59e6cf4edf1b34d8dda95b3407.exe windows x86
f30ac05c86ad9f02ec559bf3e3e19619
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysAllocStringLen
advapi32
RegQueryValueExA
user32
IsWindowUnicode
MessageBoxA
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
gdi32
GetDIBits
version
VerQueryValueA
ole32
CoCreateInstance
comctl32
ImageList_BeginDrag
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.001 Size: - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.002 Size: 990KB - Virtual size: 989KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ