=�8�ΧюCE(���s�^�U!�V���zP��ow3_�k4��o1"��z���~>�Ysd>mq����S(���d��Im��B�\,;iw=eGK2!�B �K���e�|��6*�z����؟3Z������*���Rl{QO ���*d�ʂG�u�\E�ONV�Fl��J�I|�۰Ii��ޡ�l�+&���Q{�����N�M�5]��6(b�cZdK�82��0gZ�6�%����&�-z�a�e�k����'�O�)Q�@,%��dF��p�l7�ކ�����i�]���Ls�A�����b����P�z�#m�W�O�:Я��L�V�C��+��5%��(˰1���a����Uӏ?��|6pc�د����~Ji�2�/'~�JLI�~�:��;�"�6��.\�c�x(D*�y=����c�)ҪszЩ��_����/�1�2��bj#�4q��s<���ϯ�;-���8y��$�O�]uF[ީp嶏��}��������kAe�p(dt�35@V�%Շե�F*&����h�X�/t�٭�Jl��s�)�G�u�8E)��lb���2��쨜2)�+,;�n�z�&ո����.��gi2 }OF�G�yMڙ����&!�3��$w4_w�\'���i>b�j����`/6���.�@�}�r�j���F�%���i,����rSVII7��h����̣�H��������Xq�@����:��uh[c4ō=(s ��5�����zxW˙����&ofc�F��G[���y����Te�4��Wt0��k�F���$0bck�4;�ծ��G��i�z!�#�� >�������2V����$Y����Gkܪ��$^�}���^���uҁz�q��OؚoM����γ2�vӶ�)Ջ?=;��7����a%"�Y��� 8�QY�>EW]��C����\t�uF��VQ0(������HĬ������]=�it2~dz��ܳ� Ґ:>�P�<~�!?�G�=�Mwʁ}���9���e����kdY/�)��� n����~�Xa����*�Ib+K7�h�-���=G�ɞ��'�;��pH���{xo�H �ݿ����[]n�`��,�����R�/GR�Ŵu���J��JB ײ�� ����ң���Ԑ��[.�C�i�E卧��%�$e�[D|��x�DS��3%\:�w}R���Y�&l]�vѸ�q�ذ�����f3�r����5�^:����P�ċ�ymg�|���bB&H ��Շ4��t쓫4m��Uo�~T](��9�{�%��uS�����[遟/���f�5�}H�U}yvIa_p�%<����B���x�`�FhmZ-��^6E4���B1*"�_���{z�\r��]�ׁ��q�������B�.d��@vQ�3��9D�ܸz������I:��~# `|9G�eH2����-�f�8�_����RŠ �Ym�r��?ߌ$�B�aۛ �(�|>�ڻ�G�V���S\Bb��Y�2w?᭫��ŵ��Cg�Gz�қ��`�Um��or���n�\��#����v<��~CR楔Զ�֢�o�6��5nf�=bYJ�e� ��J���f�H��%�j�~��dX�?v����P�[�C�����v���. �]k�T+`�}��N\�����NΗ��+f�ÛcP/7��A�8O�� O�G�x*��o�5���tA��"{�Q�2�����ˉ�U�]o�xK��tʔ����R�6�Z��Di +"u��.n��g@�_.b??��hu@��ȿu���H;���sk퉋y�:���V�Z�7���~Tf��RYݽ�cj�)���\��)�W��|a�(�W��i�ԝ�4HEb�|F�kZEWnp⎓*'��LA�(��`�q�khGO�Xk���a��.��5߂!܋נ���M�*i��P�dA�0�~��J��'�V�Z\ �5�V�z<�vQ�� �QšF����&8ݓ���9��|.��Hɮ�ڶNu6C�{���)��H�J��t�Ӄ�T����n/cN�ฦ���zGT����@��bf�� �:��g� r�v_��Ĺ�I��:�(GD�������¦�iϜW����+V��>����H�6�E�,�"�U������^��v�b�l�<e�����5�Z������_�v�}/���`@��f�/�a#6ɰ�z�rp`-}Wu� Ģ���56��:�V�1�_}�y�:�C���H2M$�QY���7�~:��n�{����&B�]�b�?��� �5��Y��_?����M �SD�V}�y���Vi*�?�<�[4p!-#�84��1�Jk6ev�9��Nw��3ˉ[�n�fI0�4Km���,��0�� ��՛�T��T��;�s���^�����>�g*�օ� �H�Z�鸆�i��B�.L}=��)P���b����_����N`s� IfVs�d���ۼ��\N��~��Ȅ�7�eMg8�����.� lH�W?̺�p��_\)#��u2�/�Ӆ�'C�${E���e�B狉l;�L�ލ3�������p7r:w�J��S䓮�[M�4��>�����i�|��y2����-�����jj�ey���ê;��=�R��V�ԅL6+(b�{/F6�ԐH���7SVδ9���y=� ���z�[I��d��Mz*u�M��jf[G�A?�~H�\WPudi�C!����y���� �%g#hI�%�o�������:(�b�,��d�?Q�M$sSr��m �?�#q!���&��?��A;�����)鞰[N�q $F��]�{*�Ci3 �?Y"n�Hzm�Pǩ��n�E��i�P4�_F�o��3y�2s�u�d'���]����D��]�+w���B���9�:�.3�֜���N>{l��{_�k���dK�v������!V��j��@%������h��y��'kH�_v4�u��eHY����z�l��D��Q������Q�yN>��͡=T���%uF��#�?]�Md�x�f�Ț�X����{^c�K)�?5�,Q����l��ϓZ�wM��/d��>$�,�-���S�@=1�\(��=b��2
Behavioral task
behavioral1
Sample
93e4fc5a47cc0974247669b666e6b5f72f3255d06bd5a3ab7a378d17a69e0580.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
93e4fc5a47cc0974247669b666e6b5f72f3255d06bd5a3ab7a378d17a69e0580.exe
Resource
win10v2004-20220901-en
General
-
Target
93e4fc5a47cc0974247669b666e6b5f72f3255d06bd5a3ab7a378d17a69e0580
-
Size
657KB
-
MD5
a7d9a08ab9b2a6af3bb8309af4ee2c3d
-
SHA1
ec32a746b80e8941fab13b4d67556ee6de177873
-
SHA256
93e4fc5a47cc0974247669b666e6b5f72f3255d06bd5a3ab7a378d17a69e0580
-
SHA512
bb06d00ccc9406eb1a085e3bfd9a972d4e1c1665357c256bf363ab2d3e2d6af9ffb1ed18a7001676907d6417ed7c1d5dadd16aca9665b978f9c3a8ef6b576867
-
SSDEEP
12288:z796COjinVIL0RQTJevzWDJ2kTpQYrNlcfwGb4TLqWEs0IiMQa6PUZQhGXkhR:FciV2kQsvzW93pjNl7mWF0Dg5OR
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
93e4fc5a47cc0974247669b666e6b5f72f3255d06bd5a3ab7a378d17a69e0580.exe windows x86
b0f87ed12e893315639865b4fe4e5f27
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
ExitProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
user32
MessageBoxA
MessageBoxA
Exports
Exports
Sections
UPX0 Size: - Virtual size: 800KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 590KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ