4����| |!�%�'J������Ŷ�������{��*aa��ף>��I�ҍǤ�\�x��̻�Hbi�=����<]��C� ��&�x��bs�:�{tN���S��鴝�"�>��|���AcWZ�䞼�p�Je�!����qUtDP��o� ��-� �Hn����E��[D'��)bӉ��=1�0[����?C]U�*��/%IE�娒8�����tܗU@�9�Ȃ����lg�� ���+������F�V>N��<]<�2��j��ͷm�3��\�E�-G�ҋ]��D;dA�J��ُŵ��ہ��|u���V�PQ3�ˊ�����Þ��S����4O���i�L��{��0��i�f� ��f��������~�a�qQ�@�=� ���)@�jի���k��NQߤ� � �5�4,)��"����$�M�>C������-t�5qE 5b8��݉y�4&��i�������o������ls|T����B�ӭm�}ڢ��jO��q'%O��3I�����Q0W��,�H�ϕ,��"��a�hR�-�qGT�Lӥ����Q>�о_�N1;2���p~��0�B��7*�������P�|:�����@�tFئ��{�<�� d�(S�ŀ����:�bpp�[a�1�Q¤�k������#qv�3��*��8�������^�V�I)st��N�%`�����GxQ!~1oG�����&�x��StJ��f��=��xoj�Q/���g.�>̐`��D��Ie7����A�m������Ø3㵭{?7S4��7mor��K6Y� �ZӀ���Q����}�����V>���קmt��i���l�\��C{+�^�% �lpZ���E�]ܕ� oF�l����Vk2������v�۫�tK�p�@M�1��p �PP{�r2�̿-"�| ��b�0L��A�7W/�������[%�F���ij�m���h'eݵ���'�EVa�b�����g��.���͓�+ �e2����^��fY�@�ͼ'���-Lͱ��&��7p .����y07n��3PY3�Ȱ��M����g��Rgs>�Y�Xɳ������nպ�U=v%(0���;ǼOE� �z��7K�GܽK S>�?3�rk<�O\ɚṊ��{W´#�7�-�9<�z�$��;#�[��ۭ`���J��ڊ�u�K��W���>��S*� �K�C����"?�@=�)I@�.2G�`�����4i�w�e�v��P����Մ���P��hY6t�6;W��ɟ�w�PN��%���,�X���Z����N g��C� M,p�>JYt����|_��:�0H;��_T�ٯ\NR�#�� 6"������Ǐm���Ω�U�[aG#B�����j0˅���Q�c�|ڠ.�����1�����ت�(V�#8���T�����پ�c���'�c�����t���8g����K+�k.T �\�u2�>��>�9_S�X�ل�3](Ӹ�b��)k:��;���iw3���fNdr�D��ڟn;!iB���q�inj��O�0a� ,/_��B��umMBQƃ�s(�7^.�Թb�����e� ��5'�����Z�����I��Hm��=q��6���p�;Qi���ۃ�l��̄Ҁy펟�g��6!v5z#��m"2����c ��:.�Ů6C���=eM4���({ iv�[Jh�Ӟ������^v .��Tk_��L�W�)&戦�z�LW!u�.Y.�����Fh@^1�j������^m���V`x��� }�"�W����sN��a� ���㙞�+�Z�g�돚�=[eZT�����e����N#�Q� }ni�0��i�˽����(�mzu�G1���I�S{:�:8�� D��av6E���n�3�{��ɉ���_C�R{�?L����r�ږ8L?�����O|��m!�=F=���!0a��;^ S� |�~�gij���#V{�R�m�����U���wn5����`}r}?�d_� �ɲ�����#qr���q�|�9�K "��x�U ��� Z̘��'8\����j�TJ��AȤa����P� ��&��d��i��g�<F���,�EԎ4r���t~�h�l쵄Ŵ����:�yC��nՌos鬦�W䊓��M��]#���@��]��.�r�픻���.��A��?���Uf�2'a�@+��̍��o?| �Ρ��Uֻ�<�6@�gw��-FS9M1�����^>��u�ޡfρ����Ǔ��c�M��0G%����sY���vRw*���`S�-��.��A��G�D��}i�H�ak+%UɈ8�����}���[�$����ܻ{@n ���A���%;}�{v�(�4��?s�I�_�HK�J����Α����\�gc3�����>�g��J<|�i�-��=�S���)�]%jFg�Nl��⚢�}��4��AI�M`���B0�h9��O܃Ũ�;�Cp:�M5�]O�KI�M�Ɯ ��ǐ�&x�Ӵqg`��oQ<ai�ڮ~�F�W_ݾ��F�&u]V�Sʬț���:I�9��@o���~� ?������7R�RΌ��t}�]�M�51����E?��=��ߖ$Ӟ3ˢ������}�=I0h��t�' �+���j|g��<=l�X6�;�m6{-$Ƨ`9������w�����Z���9d�f��-䨰���TID�Ox�̞���Ӧ\0�v��!�(\O�]8H����4�/�[mȴ����`���V��j>vX�!\E��o��%���.�|o�ŋH-�X��u�:u[:3v@����(���>�ќ`>�ڶW�����)?��V+����.�3\��5�]������@��� �(��-k��������d!@Ɂ� ��']F ��LK��w="�Q��#م��p6ͥ�� �EՇ��_]���G���:(�L�9�>z"/�%��R���4��ī�(�>��P i� �q%՝.-/?R������������Y�l�N� �<ږ�M��#�l�!¹�.c�f���= 2���ATɞi�n]2�@c�1�L�[��K�Rv-,��s�z�/�����1gr�+�Rp��������ZX���^�ikh�)\
Static task
static1
Behavioral task
behavioral1
Sample
afef0c8aeb1d183d88d36217ac6d8dd70e82ffc03b2e38415df24f470a8f6ba9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
afef0c8aeb1d183d88d36217ac6d8dd70e82ffc03b2e38415df24f470a8f6ba9.exe
Resource
win10v2004-20220901-en
General
-
Target
afef0c8aeb1d183d88d36217ac6d8dd70e82ffc03b2e38415df24f470a8f6ba9
-
Size
5.3MB
-
MD5
cb96e48324aa97cc318b74c46df917bc
-
SHA1
fdd3bdcbad6e3582f45f32aa6af8ad0bcf154cdc
-
SHA256
afef0c8aeb1d183d88d36217ac6d8dd70e82ffc03b2e38415df24f470a8f6ba9
-
SHA512
dcc8d706f952649d6751ec9e8e10c5ae8b6856603c82a9efb10b3680a99693fb529ad9fd2a5e38890046e1ae40ceb642121ec63c4f752ff79b2198a0f0646d5f
-
SSDEEP
98304:GSuVgIq19JCLpCR+0IABlq4bPOVjffocGPqckcES9vJ:71vzr80zziVfwLEU
Malware Config
Signatures
Files
-
afef0c8aeb1d183d88d36217ac6d8dd70e82ffc03b2e38415df24f470a8f6ba9.exe windows x86
16c15a8097da26430ab39d8a6ecd07ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AdjustTokenPrivileges
ole32
CoCreateInstance
oleaut32
SysStringLen
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CB0 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CB1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ