����cp������� T�j��w�%w:d�Hn.X��D^B�:�^Hy�:�تR�!/-�����,�h~���QK��`썫�C#��m���r�B�+�\g�W���V�N�C�<�YV���f�N�p}��<$!��#���L�+��,�o���pq>V\v�$G,�rQ�]�.�� ���HQ��I�lp�-�����P�!$/WNy�;��OlN���������?V��r���:�:?�m��H��kQaN*������A�bܪ�.q5->�y�֥Λ���4[��H�y�j����2�<0"�>&l��������!RU֫�)x1��Y����R� �%Ч���(��}����[�.؛�S��_' ZD���5�����P֏�����@�l[��j�ȥ�������2>!]�{�|x�V�mDsV�h1����'\zqɇy�jfX����֫��'r:_����5�N��2oh�D0!i��VM�9U�j�|��$+��Ħ��Y2�.����;��y:>�����Ѡ�:m�b��T,+4HнyX���ut-hG�i¹v��`5_��,]=�b�pF�1f[�_ɞ�5QML��v���m����Ͱ-t���H�o�_��{�{�Ƈ��E�Vl��R�LRE��:�dJp9�yЩ�m�ڕ���6����'��,��X)0ވ��;ɖv��7D�����I[���Z�+f��u@��U�~��\-W���As-[k�Q��V=��Hk/V1�̞)�����Ŏ�z�ǹbZ��ϩ��Y�*��[�y��C=��ODB$����{�)��P��렮�m��\�]A~��`�H��^ ����r�Q�~t���lU1���x��;w`�jȂ�����ݾ�G����';�zX@2Z��\����l�(�:"�Pc���G)6������}�u�3v��!�H`k��&X,�h�}��o�*�)8�J/ ��9���U����Q{&ow�R���ƅ�ny�q��Z?'v���{�:wWL�0=kF��ܸ��8���g)�73W�~ݚ�}J�z~���w!�S��~|��̙�� �����EQ���W��Y�e����Jݨ�T�d<����ߦ��Q���� ӛ��$�Ԇ��d�s$��˄��� _��1���,�1��6숑 ��E�Y���3�V�LJS� %�Bc W�� #��K5>*p:-F������*{�)/��+��:}Tܧ�3��aP������ɕ)�]c�$]b�7����ي�������=��́5ؠ��v^sT}�u����2�aQ�w�/`v�0�Q�t5�6 �F����3r���L�TV*G�7�]�aL���r���l�[�u�n�ٴ0S����_OX�"3h���CD�<��n�֤|���R�(Y=V��%Ŷ\��h��0�<<������G��0�`8ҟ�z�V�|��5]c��]��Y���?���S�2���x0vg��P&q�]�J�Z������نn��E܆sC���7| ��%7+o6un�����r�?���eCf�j�ؗ9CM&�>���Nh�K��b �;q� h2ОWBy�h�����,q1� �SZʌ�Z"��LY�͗�\^GP��_Y 2��2�[|�<*��n�e0t��Y< 9c�& �!8Z�E�<�� �G.)��n�n�����&lr #�a !<|���4O��X��ƥp��&�s{.��E<0��5ͮ���?l�4���e_�S����y^n�1tu5�Ed{X>fqE7)a �O�XVS?�(c���<�3�)՜ �E��c�,&d�t=Q�if /S��K�v($�k��D9u��Z0hZ������!Ó2W��h�^�0������Ҳ��twz�X�1�/L��%)�.�t�ՙ��R�9�������W��<��>���ơ_�W6~?6���",aT�B��l��^��!d��Lu� �������۲� ���U�]Q��cs=�.s�����;-�v�7L�!c�DE�s���i]g�ٓ (���H\��= ���E�m��3Ń�ܧ�b�e>�)W��1�|��BJ���e�o!>}@A~g�Ո�Е��:�3tQn� tDzgͰ��6�2��Ѭ3gl^��/���y��}�'Ӣ��}+4�uShq��V&�wr��O����}�� m�Ch�zM�T�P����<P}d���Ƀ�70�T��a�|&W�e*ցg5B��l�I�LU$��V��XR3�͒D��'�'���Pg�B��V�����S�ܱ�G�>a%�v�����N���S��tvZ������,KE���w�?�^�����b�ԥ����Yэ!����6Hc�"��#E�q��c�v���5�>'n�EI��� � �� 37?�t �y��U4�L��� U'l�63H����� ]�m/�х$�娏q]�^�a�.���N��j��j��N�L�Z6F�T�L�P|r��I��t^��l��f}�OR:*�����t����}J凄�� ���)�;�8}�ނ�%JUVj�c�2�?�������g�fh)�y"�Z�90��{�� ��w�� �0�ͅ����O���\]85�w+b��昐D�wR�%��G]<mJ�%X�C�=��9 ��{�I��T��Q��xB�,��[K6/����> ��Õ��a����\'����;����q~�Bf@<�wPu�WLg��S�w{�2I�p���A��SE�Z_��+'l����?�_�x�f@��f�ad� 5j_��K2 9����Յd����b�k��匋�9���@C�f�`+%�:�� �trBq�I��o�[�XB�f�� X��9�bJ�Ǻ~�Wg���!ܴ1�HH����=I�2ʃ(�� kU�v4�!�lp#���.'�U�CK+���D����r�3+�����\[Ϋԗ��=I$�,�7E"E�����r�����;鱗���� �Q��]��SvD>�W�)�ʹ4mH*ˁs�.2��>۵�)U�E����%��"sA�i!�������&¿Az��yE�wUgpK�����a�a�# ��e��~��}i�7u�;:-�qJwX�@C�ӛ -��[DP
Behavioral task
behavioral1
Sample
c704b4babb7bc6db49497cfca64bce2b1bf02c944d7cea35501a149c213c755d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c704b4babb7bc6db49497cfca64bce2b1bf02c944d7cea35501a149c213c755d.exe
Resource
win10v2004-20221111-en
General
-
Target
c704b4babb7bc6db49497cfca64bce2b1bf02c944d7cea35501a149c213c755d
-
Size
2.4MB
-
MD5
81b55dfe27532283805d79766e194760
-
SHA1
be5b50c4afacb67ddf25cab22e0d6c2504e12464
-
SHA256
c704b4babb7bc6db49497cfca64bce2b1bf02c944d7cea35501a149c213c755d
-
SHA512
0b5c15bb7563c35066bab227b06863371572a72a60cf99c30f7ef9cacb202c24d2bf1fd69a67cc74a4d64d0cdc73704afdf8c3393e00f7814c315edc4aef1501
-
SSDEEP
49152:0O/Z+yKwk0oDzO/wBCGfo+6IDAB8SPlGfRymo6nbxSA0ve3rMxSBQ:f/Z+yKwkPPO8CGfJ6IvCQfR9hbco3C
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c704b4babb7bc6db49497cfca64bce2b1bf02c944d7cea35501a149c213c755d.exe windows x86
67b9dd9ee97fefe34414ebcde8b7a9d1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutReset
ws2_32
recv
version
VerQueryValueA
rasapi32
RasHangUpA
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
MessageBoxW
gdi32
DeleteDC
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
oleaut32
RegisterTypeLi
comctl32
_TrackMouseEvent
oledlg
ord8
wininet
InternetCrackUrlA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 522KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 943KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ