�K�t'gq�I�=�}�&��� �����1�����K��u���D�?c������u�&�$����n㣯����Iy_�ϳ�ϋ��k���S��d�{<�zR�h��E��X�6���7�os���ʲ�0�rg2�(_��J|c�Z5/�e���~"F2"߉����p�*o�n1J�k�v���� ��O�*����Y<1���@�ǐ��d�D��m&&���i�l=6�=f����a�R�R�����qPPf�������q���[ِ��Y� o���3����c�����T�S���Z`_�^R�1z��+�+�&�N"|9���wU�}�f�'��5��R*�c���4�@J� �|#�)��/�Y�/�kB�?�;�!@f>�>Sa�d}�x. ���Z��{�WV[��I�zVqՒ��8��9��`��С,k���~V�ˏ`��fW�!�oRb8�S���x��;�68߇�(m�o�����u�$6����@`����] �Uة���&��ho�zH��<�e��ٯ��H�����ǐH")���.~�c�z���o4��nv�I$�7��Jg��v,I�~G&�Ѯ��u}�_���� m����qaT��)M5ǃ���FW�xgy�R>>t��K��6)��,��UIa���7:��*�c��|��֔�����AB+&�]^[�|-��C����8�k� 9�[��\��p�����f^����ZH�鲄����a >��9�@��*Ss�s�f�P�a�����iV>��>�&��Ρ��Ǵ�ĕ�)24��; �ډ�N�D�9�`J�籗V���J�y�,v�����S��U�/� ��ƜZqu~�L�$�C�Xu[��Qvް���7����[��j�^+���Rr�6�U��ؤ��xRɛ]���w�@q7 �|��H��4�g_�v���h��M���%?<Յ����M�:5Id-A�aZ��_����h{*�,�P��P�u?���V��;f� ���ܣ�'����Y�.Yg7����ػ)�L��9dڅ��kO��xÚ�/LB[pq���W��u�7�o��[�Z�~����}G3�j.T�\�؊���*0����^�|~ |��%S�2}*�|J��M=�W���*{����Z�Q��s���;�i����K@���ڱh㿈D�n~S@ou�8�)0���s �O�Wl��yW�ɡ�����x��ˆ{����J���w���C���zz<7�)�aV#�2��"YTv'.��#:Ba1��y QL,EU���]��̫���nw[�4�IL �^����b��r�Mcy��l�ڃ�5�HhKb�Ӓc��x��/���'�g70r@|vV�P���6���R�*j���f/����Qm�A� X�k�S���tKQ���^אL�C��ĸ^#���R�Ӕ'?�*���x�J�.SY�5#���1f��)��E-f[��o�g &y(W�JI+���6@>���}���iu��5>���'�Qf�,&pH+��3�X�$�ZJ��t�� �ʬ8� �4��ٕ�B;2 )D+f�� � E�J��f)��=����C� �5ۼ4�� =���B�ɚ�nc)�G���E� ����$��fjn�/L[ûNK�d�B�a�xt�� ����L��~�ⰮJ+�����j©��=�`{�MU����x0��P���$�-b]?�%ßHRavʬ>�9'��Ӂ�����/"%r��Ge>".�u}�N�!)��w��4���rd���>� �Ѣ` �l���g����w([o���h��X�F,�;�8��5&!��<�@���� .9knt FG�r�f � @�����^�� �����#E��ӓ;�i����Sl9ү�I �H���-��z�5GĒ�3G���^9a��h$�pQ��{d��WV��)��6�4�8ڇ��ⰼ)bb�K�9bE}v̓��~psA�I��g����~����P�{���OOH��H� ��89�8/.@ע�Ԃ��|��d;B z��,�����V(�芑�t���*rɻ��n)�997Sz���O��m��;1�?��;�������3+#+q�k��H�3�U����*s(0 ��LOzvZ�/?>����c���$���9�9,�)DR�L�����+{�"r��_��$����yiP#�,�?��"Yfc<����d��umP^�����@����T��ea��)h4|����o8[{H ��Txݑ®:2��8��'AS+���\�c����������D�w�s� u�3�B�$���c�e��OEu�$@�J5>$��USPp�!����ӍH' P"F��/2;Tg�y��OOo烪��c�����l�V0�.�c��e��%�Ldp��U/��9��PVW-`A�^$ �����V%G�J�m�QA��Z��~�6�,-{�k�86�:*D؝�gzhi.� �!ę���ڋ̚��t�H�RMf�o/nI����ga\|��>��1��D�D���^=����t��� �ք<�r� �2�6��d����iث����ܠ�{���b�Wc#�<��]���Z�2� g�,�O�a���Lj���U�^��r���?��݈i����{�k���i����d�%�L[!����5o6 �7Qq%��[�\+��#fҁ���ư�~�G|t1*-,�'�� QWo��%Jz ��l;����ζE����a��L����M s�� MҁB�Z�֎Qy���R�r�ek�!�9Q�KHyZH@��m${��}(-��ڋߢ5��9M�_����˪Y�C�c��b]m1ZBt�ҲB���@�=ɾ�ǚG2��@�\@��Y˹�W���6$��,0NX�������Y-2�տ��oŹJ.0I)3/(�0]��X&ڞ@k*A��<!;�i�|i��Zd��-�a�Ҥޚ�c�op�H���H$�Z��Ң��ְ!����pG&��ԔA鷁���*��Wj���?�6F���Mʧ`X̩p��]���{���Al�^����j9���o�9Ǜ[�%v�E_�9W'|uZ3hkA"icL~tx �8��|
Static task
static1
Behavioral task
behavioral1
Sample
a1b009d6e8b8436adf506efd9b6b90d4f4bd92efcb8e1375948e50a7268797f9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a1b009d6e8b8436adf506efd9b6b90d4f4bd92efcb8e1375948e50a7268797f9.exe
Resource
win10v2004-20220812-en
General
-
Target
a1b009d6e8b8436adf506efd9b6b90d4f4bd92efcb8e1375948e50a7268797f9
-
Size
5.8MB
-
MD5
c8ede6cce5273c61689d58b275c665fc
-
SHA1
185edc430a672eef1a3430d78f7bd0bc604a3b01
-
SHA256
a1b009d6e8b8436adf506efd9b6b90d4f4bd92efcb8e1375948e50a7268797f9
-
SHA512
952a8c8b8db6c5b3b3f1653e6070fc2676c4b81a828f8a9e0bc64a033ddc75e36a5c3dfbeda0515af2c9a6b744aee0f44a8094c61d73f6e3a15af00d85f2a1c8
-
SSDEEP
98304:QgNbU2HKLpVTLhvM3fbNO6bd/oRVibl4yacozKDF2PHmS5h1K2rL1GTU6wLFFciz:QqgGwjK3JO6R1b2cRYRYbUDaQN
Malware Config
Signatures
Files
-
a1b009d6e8b8436adf506efd9b6b90d4f4bd92efcb8e1375948e50a7268797f9.exe windows x86
a8c4a533b1b424aaac6d2158051c6779
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WSD0 Size: - Virtual size: 220KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WSD1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE