"�Wg�s�Oۃ�ZL�b�Jw.�!�EU|����P�C�D��6��^nj�����Q������[z 2�=6����`�p�1�X��/M�%�|)"����h��k+����kn�r�}�(6剁7�PT�jF�����'�Q���N�� 9�B@+�DL9��#>��]ݐE<,h�(� �����⢌.BUj���vh/� �5£U1��H�!�qZ�ѓ8Je�f��k[��<���[��K���*h�8V��K.h8�|�M����G�^,l�o�]� P+�:�U�=���- x�X2m�{v���}O8���0�)H�����}���%�o��a�|����z������ט�C����N���hh���Q��Nv@�Uq���{b"A۩4L���Z����st��%�F$e{��*�2���>�]!��AG�Q���R�V�ܖ�<�'�J|����2�����gܧ�/^��(�azт�ly���g${)v�ɦ�lx�)��$1f� �KT�A 4��k���ǟ6;X���a�h�^^9�%�����FzOtw���h$� ��������Kl���r]�����@��v���^�z���Q4�K`^����|(�fd�b��BEK�o�2\�Cjn�=@qC�����ȻI�U����>a��E�����#~�h!�����J������Ov��N���+I��r�D,2�Va$@���L:q�;���Ufɣ��]M� ��|��X���9K��pj��Y2u�z]�3���L#�]�,�CM�l �xI�������ڱ�-)7� }=�V<�����"8֟nͻ4H�F_P,ʐdj��fl�WB��ŗ/��~��(C�7�Fq!��EuE����,l2�S�j�{a��5rIA5"n����-�N�% i���e��<�;)U�����O%;��r�`����M�C2��@�c�`���� �� ��h�����ݚ���D��?��� ��æ�RNw����U%�<�� ��������7Zޮ���2��-l^A�ٌ.��y(�S�����3��`w1���jQ��O1%n�����<�K�8}f�%���v#]��{�$*H�� (TW T�c�� ����h�bhβ����7F� ��M��lm��2b�<���ށ�*��>�ܭۼQS���Z��W?��"�F�H|X ��}�-��e�/��7��n$u�L��� ��Ԡi�J�����>���^��V+@������&X�?�@��dB(Xw¬�Q2ތ��~ԀA�]��d*V��,����ыK&ØS��qJ*�Qnl��ZD�џ~�j�'�R�k��oA�<���ұ )�3,`�!�!Dx}X�Lj1����*�W~�D��#��!c:�y���,���}#�n� B��ғ�#�G�?86P�MYe���@�(��D��V��8/��0&����i�hJ��Oo�AG�M�Ů����s���"J@����+o�kJ� ���,�v�:�q`x����: wW}�vY)`nI�%��ɽ W���s� }�z["0��/Hm� s�u�V���l�X㟋�^E�������u�~�i]um�SS]�SfSF��Z����v(ǽ�Bk��O����Bx@XgQ=J�1����R�iw}Ewk�u4�q���g���}!�=��i_V$c6�A%a�ʷ����|����*>Ӄ�EF�E���kn�x�E���*M9�@�;���L1>�%��ξ�B�h� >W�>c�ު;�*���.�>;M#���/�6*R���έY�������U'M>Ϣ?3��}���$��A ���9�sCH����h��,��j- [x���D���(���g��^�����P*�Mq�q�ʼnW���p/���ș E�5)�r{�[#vg���%�s��i]�3�i�3����8�(��u�!��4Og��o��/ ����]@b,���N��Ub��Ak�L� K�@mj1�,"�)�('>k)�ڝ8hx����S]D[���� �;���\#$6�:�$I����d�-mt�Ӹ �R��nc��X<�S��:�ZغHH�=,`%B�i?^��C2:K�E(����Bk�O�:�/b��N�0K)]W2�hj�M���3'�aJ�ɘ8�3�Qj��N��!�����*�2w,F��sG���).�s�N�r���&�E39d�$�SO��y5���ܛ�����4O�X,K��jf����!8��K̤��H����W��X�,<8�O�D=&LW�d�cw`Z���Q���{�� �v��3�;��U���������`j7<���Ѝ���M���#_�d!NU ��0���+ A 1��)�0��2�P�;�/��AM%�YS430����~�����US+� uWw5�so��GlM��!.nN�j������Pc�_VH�A4�PV�}� P��xR�<�H�Z�K�e��K�0�n���G�y�rg�Z�x��e�G�7J ��@$�M<����+�"��GޠD{[˙l���(1��m ��&�]'���}X�qa��]�-���s��d���x.���0Z ����ޘ���%a�v�MÎ�}V��Ww�\�I[k���)��W�>�E;���M�kg�9�ް��ֺZ=-o�@�ڂ�-�"6�Vՠ��Ŭ��,�~�����#&��CIƌJb��M��2�wz~�w���~%������ۖJ� ��q%��TW;�I�q�^��=�_@��ժ�N�OW����G�b.1��`E$��K��D�p������1���u� ?�~v���|.���R��ڿ�Ǹ�;W$�,�Zvf���?y q�ʯ}��������]m��Ќ=Y�é������T��m���>#f/�u4���+���2���|@�M*����/�ɴd\�!'|Ԅ+��j����d捋�^��C�u�Lȹ�Uej)�8��&����;�}�������w�t&<����kǐ%��p�*�離�n� s��#�s�ɛ�%�d}X�DD�����g�y��j�_�O�L�=��!y�ж1���9��,L�^&������j��~�{��Qv_d5}֛��z�P��c�P��H��!�4G#NL�BS�2��S�Ͼ�5�EK������3�UN7��%?�Ql3�C
Static task
static1
Behavioral task
behavioral1
Sample
98cd71bbf00d4fc10c7f6f0a0e43858eb4161abb18630be8ac8c57f9ed5ebd56.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98cd71bbf00d4fc10c7f6f0a0e43858eb4161abb18630be8ac8c57f9ed5ebd56.exe
Resource
win10v2004-20220812-en
General
-
Target
98cd71bbf00d4fc10c7f6f0a0e43858eb4161abb18630be8ac8c57f9ed5ebd56
-
Size
156KB
-
MD5
92017febe144f3a45b3dfcffc25aba21
-
SHA1
2cafb4bf1605a0a3b94bb0ebb8aec37cd9f6ed1e
-
SHA256
98cd71bbf00d4fc10c7f6f0a0e43858eb4161abb18630be8ac8c57f9ed5ebd56
-
SHA512
b72a5b29f9f780966191c310d12c0a0669a5de2d33e49846c05f047a0fa62459f5caa9eb8c731b0f9f245045e4e4ecdc9e909c1f9238c1e5fd19019e604ff931
-
SSDEEP
3072:PA9tWTuVPDVo8oR7Bu54Pbz0qGrdoNn65kCQ9Vqq:PQtVVPDDoR7Bu5g0Bdok5fI0q
Malware Config
Signatures
Files
-
98cd71bbf00d4fc10c7f6f0a0e43858eb4161abb18630be8ac8c57f9ed5ebd56.exe windows x86
135e400f19e187ee674d8f4a6f42408c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
TerminateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ