K#��:����S�&��dzL;��1��|��r������}���f]��(M98��هj��nX)b���+e�!m�CY�tb1������?�D�zH�2�o-���HMh�j^�|/�<��.2T*��c�j�1���X��cN���ː��07�~�(�����p�w\��{-⩓5�G�k��!���z�)r���gK�o|�I8D,e�nf&͐��˼�,�\i�'`G|�d)a�ܾ�C�CN.���eg �w]������MUpKM�{+l���家�0e�T��11+��o�3��ܸ'�ڌI�h�o/���Ƥ"J��Yz�`<�"{jRU�~v̄tjH����mV�5�f+ Mk���5*-����s�:�n��֔�ލ���(��%NB}[Nű�y��J��\Nv~k������;)�RM)(����.iN� !yӞw'%��rgmF�p['�̐N&�qs�",$��)���S�e�5���}9臚J|������a2�Oj�qʃȦԦ)0�du>,����R$�ϋz �C~��b�B�ϺJw}"W�Ϭ ��3��(B+����N$ "�d���l���}�P�TV ����ԬdD�!E12�;�_?����N�]�~GD9�����Z��S_ծ���X�O$��f�������~�Α�G ;�˹휆S�!�v+��L�!eUx�-�n���LD�i_%�.�Ï�t�(s7�x�6�w�;y�X���M�(�wD2^va����l��?͠U��LE6��/:U���1�,*������yg���Q��}�ƪ��_�����-��ӕ�dH�:H�i<�$�1� ���.�@��+Ga��EB%|�`���.߮���v��fRڐ��yh��,�|�J/NHO8���|N(:G)�F��AA)���D5_a�����^��F�E�#CFj���ud$���������P��)���c�p�U��ſ�<A��� 1�����Pz���@�P�{-J�U����B��N����(��"t܈�@q�W�Ȁ��{��L���|P�{V����৾v�Y�1��}`����N<��i�`0D�ri68j�K��f�}�ph��%��r��H����ydZ\���ḍv�Ļ��v�_X�J��v^?��?f���#�M#A�?�Fh�X�[Q|=(�1��E�|�� n��^E$�*�*���z�40�����<�e�7�#����AU��8�8�nH�����%)m}�������@7�i�Y}��yX�������pM��+��y�˫��;���T��������,�_��;�2���7 ��U��NGt*f�� ��~X��%� _��?dA3�HCq�G�={LhNU��Z�n�TVY�-��]�!W2lsǠO�`Ѳn�����NCĸ�@�P��� Ǫ~,�1:���pu�����oIo0;��r��Qy�3�~���;2��|肕�5�#C��>N�8��MOͬ�@.+�K�;q�-y7xd�ԭ�G�dĬ�vr�J�|� ���ۡnʱ���χ��Rj6��ֈe��y�c��4ϩޘ�=A�F�8|���e�! ��DA�ʯ��Nk�I������tW��QD���}��w �':��X��#aY1�r:�t -�?DZ������L"���O[�s�:-� ��l�[�I~ս9[{q�e�ߺU�G-#>�>��l㶳e�S��>|����%f���*�8��$��섎��������c �� �bq5����I5��2�7ZB�8ĩn��P�kN��ct���Ҏ�9�Z[�,���-ckr�y�w�}��1�ԙC%X̷mY/,�-��U(6����1W�U*�eW�)Ŭ�|1�������S%�$�)���~Q�$�1�j�=S��p�ڷK�a1���9"̛ ����eْ�U3�C�����U&���~-�{�9�9+���٢����ՇGa�> �-�a{L����B� k�3 �f�a~�kNs(�ךB���b��b���lyn)up��M��"���?C�.�f5�F�>߭��[���:i��mM!a��v@<��Ȕŧ+�ߴ��X���1�jw8!�����w�;y����9{ղl~S�ƺ���m�<:���p�3r�#�t�R��y�����2����[����&H�g[,0���36ky�D���n����Vģҋ��k���l�hfm|�c*"��W>�yy��t4����9�4�4M���mtՆ=�����* ��a��l���Ĉ� d� ��ƫ�6 9��o�O�9��%I�S��y���2.��x�l�>i$`�_]� r1�{�����V����3 z����r�V,���])�'A��8�Lx��e�/��Hv�m(�;����ziV�? zX��U:hmGW䘕�+n��^��>���L�1�؎)x���jֻ2���89=/��V���і���x� ��2q!|�l�O����z��� {�$�s hL�'Ō�G���p�� Zm@ ���u.���� �?�O#�Q�O/��A�qy���5����*������ĥ�v~ i"c�h�l�]��,���S�8?��h��P�8���1��F��j�0|K�-��?l�)>8L��e'>A�_Ђ�����8��"���h�0c. �L� ��i��BN� �1��yze�K�0��2������U���<�Nj�@��0ڢ�F�K ]h�`h[N4y�Qj�+���E��u]�`�ʪ��/��%<�:��ex;A��!/O����!�l��/)A�,�������� F��g'����ce@OxO�7�����DC��CPr%���xQ�LJ�(�#�?sI %1UKo�l�)� �X����J��ܨ����Ӈ���V��]�Z,?�i6e��hH�Dr���������i�k9O�+x�Ѽ0�.�Kw�Xg�7s���������N:(^H�����T�i�ΗD�A����jJ���,}y�{:��e-iX-���"�٤��8C�1K�1�_��g�[����a<�̷�[�a�nZKp�w���6���ަh�!A����=��4<�=�|�G�ɖ�P��.���A���wZ@t�!{���ڣC
Static task
static1
Behavioral task
behavioral1
Sample
e291b00660cda0dd3f0ba13fa0ac1c6c31a1cf37e655729180759b0ffe0d91f7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e291b00660cda0dd3f0ba13fa0ac1c6c31a1cf37e655729180759b0ffe0d91f7.exe
Resource
win10v2004-20220812-en
General
-
Target
e291b00660cda0dd3f0ba13fa0ac1c6c31a1cf37e655729180759b0ffe0d91f7
-
Size
842KB
-
MD5
c9e01927f7daccf7c5e578d278a56326
-
SHA1
e719e38e0e4a05d0d8ed7ab828fba8328eeb03fe
-
SHA256
e291b00660cda0dd3f0ba13fa0ac1c6c31a1cf37e655729180759b0ffe0d91f7
-
SHA512
5f75bcc75799fea5a587c88bc1d93e892077b059cd1f724d2e2cbd4d95b7f75ed9ea3dbbea45714410bf2d53c904ee5cc68485f4361dae96e4056685bc688de9
-
SSDEEP
24576:HYu6wJXyZzjfSrfTs6ggVQTG7vgqkisR2t:qwJ8qbWxovHRd
Malware Config
Signatures
Files
-
e291b00660cda0dd3f0ba13fa0ac1c6c31a1cf37e655729180759b0ffe0d91f7.exe windows x86
7963ca669b2e5342c33b164691f70c8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
advapi32
RegEnumKeyExA
oleaut32
VariantCopy
mpr
WNetGetUserA
version
GetFileVersionInfoA
gdi32
BitBlt
comctl32
ImageList_GetImageCount
shell32
ShellExecuteA
wininet
InternetCloseHandle
wsock32
gethostname
imagehlp
CheckSumMappedFile
winmm
waveOutReset
msvfw32
DrawDibClose
Exports
Exports
Sections
CODE Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 834KB - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ