�^���|��A���x-�����+U��Bh�q�!�|�0�6f-#=���0~�����������B�8N��g�\źⲅGL�n5�U�Or�k�������]9J�������Q(��sG=���6�g��o?7�x��>����=����N��)�hHu�]�F��u����z ��b;`o�&)��p���� =F~��}���}]v��m�h7��A2�����|hDpO��k@@VY���#��Jw[��YFT�f�˕�Q\?�`�rYBD�����8���}��cc~C���I�֠�@����#8Ŗ!�ꓪ��#j���4�c��U7v����m�&9 ����{\_��dg�k#ZG����r]U,��»g ���j6�kāi��~���O�lh���t�}?������>�*$�z��[�٧����l�Nрo]U�7��)�q�T��Y1i=I�|��g�����j�,��R=�>��A��d��h��[��Z�#�I��!U�Qh� � 6� L3���{�5�'�Ǎr� �����xbxd/�i얱��^mPC&?��'}�Y���X���I"W���u ;����ng���P�(��R��Bb���E�Y��29pb�]^��f=���;����>i�t%܂�4�(K��x�\u�.n�!m���ksK�x9~zO\� ��j �Iv�B����c�;��ph�.�� �n,��U"P�~�S�ײΌ�^оá���D�$��(p���3���!!<+B8�J��� ��2������(I�)�"�q�p���|��vc����̼w�mR^�tW�f��l�&��"p���*ј'd�&���N#l��F�33�D��t�� �^u�U*3>ۯ� zHEc��߇��hu��g���6JO��/M]`$���SDU����J�J���K�@1��N�4�� _ާ�g�Щ����o@�1���jG��'�ชaS�J�h�f� )�Êo�#�G�o3�g��r�xY��9�d�c[�:�Z��V��Nv�."�v��t�[��Z϶��zՍ�N����1��D*�Is�K�o�˿n��I=q�ke��Y���^m�c��y�,�a�ae�2����f����7��t�F"Љ}�P����ʊ)W�� �-��Ξ_���ub�Al+����Ϋp!���9НM)ź�cڽ�D����D&���7ݵ2�o��*�j��/?��/鋒�, �b\b���*̣�By\Ge�[������/�q++����H|3n=f�Z_��sw���V~�����{Had�/�rr�(e�'���`��s��qy4]��� u�xGF�K;�Lj!-_ ��P�F4����q�� x3gGr(�P�t2�rb����"��E��3��J�:�iS&�\x�EB�U�_�]���m;��:�[z�v�L-����KOY�~��$�m@��f ��x���"��m���A~�6�G/�q�����Zc ���G_�A�Ie����kK��ni�V�M�GE��Wc�h�d�{C�_�i%�N�Q@�9��0���?��,�e���%���|��kƂ��X�X�Aۘ��;ʗ��rl�(=�F��n����=g����k<�c0���\L���I���;���:��Oi)G�c�셎�e��Zؒ����������:�`���!��4&F�h+��H%��Z�zx���T���G-o�: 77; ���$ox���`Z_�g�c��b���y��U2٠���p���)�^���������<����ΓOk7{7�I��:���(=�ڕz�'i��^��.���.uC�Kb8�*����qd��{+3����lc�l��3QekQd� 7[;�z��$�"�{��^�jA�# ^��Î�q���Z� +�V���8gSwk��N��d*$��j}X�m�=�E��)˓���g*so�?���&�z��C��@D�\���c�. �0u���s��@\vEGUTO�ߎ̀I����{���~�s������rg��E`��}*���yG\�����F�ʪ�~Ǒ䗔�N�*(&'D��F� Ӗ�o��;#JM���ĩg�0�/Ct�#�y"�#����s�?��J7!ߊq,��{~1P=R�0�m��&"�e�{��b��\�U�hк�<:a��_e���V�Y�CH,�RT�>xe�aI�s�)�8-o�L���G��K����[}:Tfu������@ a~�2:��K`��;��'�G�M�����z�|,�N]�s/��w�杆Կ�Ό�.�<��8�O��vz���d4��W�Wd!��q� ��232f=��{���(��L7�T.~��I@�%�b��N� ���Ds��ΔM�:�*<�o��УÛ������k��:�)!&�5���,A���b�s(71Ti7#����+{6 H�1���3))�.�b]ro#�zQz�ۿ��CPW5Z^�c�a�_Za�^�@������p�$��s�:�B�F7�b��g������N�/pg�N2�-�[=��?bF��9�1.땕��f1�G��h��c�ۺ�ƣN���9g��h��#:��H�䥵���"a`���<���hZ�"z͜�8���0�e���+�'�i&s��F�N��!����*����>L��S|y���ppO�E�����& ��8.��Lε������_'5��`m��~p�(ꛧ?F�����.�W�⟯F�snð����텊�c7��6t~H5������;B�\�R](O�D�!\�� Yy�q�D���$P!IL������z���>�������H����<OX���V:`�����I��Z�Eʁ��=Z,(9�c\d��CpN׆Е���R�AʂokZ�<�$��Cs���tm��%�7���u��g:p�[���pƁ�k ��'�"ʺ�� �h/������@���i��=��|��L���ɧadi�L>#�mܪ�訿���iKy�D�ڏ0�<�#ɻs�>�U����9G�0&%��YS^˒��2�v��:��)�����0 ۏۈ-���|iլɅ�#���g�ЁN��W�s۩�gj�`6���b3ъ���.Xe��-��ł�{qL{�������q�
Static task
static1
Behavioral task
behavioral1
Sample
a616de0f48afab150a930673dfc18353462a05752a2fd05e1af7610d7dbd0599.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a616de0f48afab150a930673dfc18353462a05752a2fd05e1af7610d7dbd0599.exe
Resource
win10v2004-20220901-en
General
-
Target
a616de0f48afab150a930673dfc18353462a05752a2fd05e1af7610d7dbd0599
-
Size
1.4MB
-
MD5
7715bfcc22b1d53cde9756051679706f
-
SHA1
bfefa2040e2693f4f9dd08befca7cd723b96a027
-
SHA256
a616de0f48afab150a930673dfc18353462a05752a2fd05e1af7610d7dbd0599
-
SHA512
d42e7ee5395a7e7428812cc7ec1a82a05f5d9c697247f96e17bef403f34b6eb68c18d5c68999df54e7f9d91420b881e70f98f5c5e269834a6eb134bb9c4c6838
-
SSDEEP
24576:jo6gdNgUQ7a3tdO/RqLDoHxSkcpg9KpX0//tNxJ/86kdQpmFrfa9HRrIhN/+n0nI:227qtg5skxqqg0XtPx6Ja9HRUT9nhfq
Malware Config
Signatures
Files
-
a616de0f48afab150a930673dfc18353462a05752a2fd05e1af7610d7dbd0599.exe windows x86
32cbc12c3b25854c190b3de3834d74bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord621
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss0 Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss1 Size: - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ