N��(5 ڤ!�����p���hK����q�g'<7~��X��|k�̑�]��'���{���Ri�CΤI�`��I���;���w���D�jͲ3��������K܋���%@k��L�(�J��7�f�2�6j<�(��t���}J�i� �=1h�ڞ���xP�C"���_j��3��Ld]&!��y��>2:��rĿ�=g)Po�87P��(�%�>�(�Vf��n�b*]{�M/@ 5�����zn�ژ�v-���P�� ���p�7�Z��n��#�ww��)�ő�����Huaf�ץ?�}����O� �����<A�A�����_9����>��^mɖ���o��} )�[KF.[�mY��?����ǂ �w�9=R�Y�U��oT@������V�wN�'lH�ŝF�7�}�>i��� %��o�|���0��!�.>�u�LY�7�7N��<���闬��s��BU�D�t3 ���|���r�z\�_s����3�M�%�'S��Z�-��`��ʥ�كE�u)���l����U&�aʸ�=W�cpoh�ּ�^�;�a��o=�N�Nٟ�He{bTw�����|*��bؐ{��\���cL�N�g�~߮<�aů��FDٲ��護B�O���̝�]����$��D�Y�� �y�*�� :S�G.FN� ��������`ޤ��ܧ�Sl��� �w��� �Rnv�i%��X�U��� ���p�>� �1�,��u�b�D��^�.Ex)~�v���bۏ�!�+L�P~��H���:�1��uQa�V���=�QK1[3�w��՛ӊ}�D� K��s���H7�����v%qG��kXy3�`�%jP:�,�t�qt?s�4�����rîf����Vz��A�Ҭ���d�h��oX1�B������M�"B����(�+�����Bf���ߟ�OK���]����Y肝���e�Fxh���� n�eVhq���/ΰ�F~kP�iU�9�s!���F����F�Ek�J����{bY�7A��U���jE2����"�#q~/p�ݦi@2�t;��� 2�*`N3�����%��Es=�-g&�Y�ϑT\1M_��l��%�2�:F�U[*/��`Z�1�����ٍ�]��d���9ݲ�Y`E��S�d��۰�R�E���5�����MҺf�ūZ4N�+|�:e2�!y�k�o\�%� �c��jr���t�@�)5�q#tv!�N�a�� �?a��/��0 �~��Va��b3�QX�8�k���K�;Y¹5����@X,8�C�0�j��rWtF 9�70j�&�L�N�U;�4�U+zl{m�����]��y��26W����Sv������2Ê�օ��S9�wwUq�p�z����g��[��d�W�>lt��SO�� ؖ&�p����yiN�\B��O92Y�=j|ڽn]�H�����Ĵ��=Г}�#Pq���������/���G���Ɠ��Z��TC&�z3C�*���l'K%��Q)���ʄ����U����6p��@95�/����0G��W���K�ʽ<���ppq��/:f`���8�������Z�'U�V�3}���ݹ�K>^��-��:����d[/r���֍^�%a �vr��6@Ш1�Xv1�E����ne�K��V���M<u���1a`�A8��d���մ�>�f��e��黑���ϐi|t<�5cezދ�����W��N��d��cIO�ر���FT���1�{ݝ�C �OM�K�D��>�ܼY�3����J�U���#)��ܗ�o u�G@T����U�����vKY|�1H�� �_�[I��l[p|�S�U��$��D�*Z�2KP�t[�c��A@3�[L��&������1n�wl�T9�]����AG2F��5B��%qϊ;����V>��r�/��� �2ݑM4�<(�`iQ,�/Af��Ԡ��=˛7=�{�K1ö�O|͂-��;O-=�c�R~O�)뻧�?��� �;���W� ���s�7pz�L�C�L�Q�b'���3^�q¢���M���_l��鲰��mA����3qI����Cu�'"1x�l�md���͇-���t� �-+�X��K������^�t�ldBk��k��$ш�}���[�o1�n>�Ѯ5�{�|������ܞC�}��dN�\���N;���k|�C�}L�A�_OR�3m�ș����&"��AN��#Ām�:�-�@�sy���IJa��,>;����Fg ��:���!RR+���o��l�|w��<`��_�:�4t�Y���Kc�n���EY�Pl�D���2ᕭ�/�9��J�=�n.�S�h����I�����=��6*�bȃW'���l���-����"@��C��(ͧڤ����d�^\��?NЋF�M� �ڰ�ځŭL�Y��`Q �o�a蹿$��T!ؔ"Ojb)G��H#iĿ���W�����K&�g�y�6Fx͋�ٖ϶�X���3M�kc�/{�!���²�>d��@�ke25X��^ܐ��]^$��4����u �BY?n��"-t�[ � �����k*������h��������b���'vwᾞeF�3' �ӕ�)�aa�]�|����u��BA�s�J����'LP�o ?�5I d/���i�ۨ�cꎫ��0t^5u�&��� �3U��]���Yx�U�y�'�> �K���a�OZ�✋�0��0�^-��Q��e`\$4�7��q����������f�C�= ~�o-]��C9��A�$�<�V⋩��h�P�,K#�;��tAc�II pQb;��H$/�qVg����`�A���Ș�յ�N��'��PA�\�AX��@�.:1Wb���H� ���J���>Hݚ��S��&���1G� ��#H^Lu�M�5�����kjp�&��G�B�Zȸ_�|��fL(_qA��MFS1VܓH=V��߁F���{�����N��f�˩�Qf}�H*x"F� �J����ކuU4M��=�@�jZa��Q�g0���������f+N�H�f����rz!ǜ���(\���?Ei��%�S$:�Z%��v�
Static task
static1
Behavioral task
behavioral1
Sample
c1ff2943f5cec66a6d03ff4e1248081828f483cca69e2937f88edf6f2e4fc413.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1ff2943f5cec66a6d03ff4e1248081828f483cca69e2937f88edf6f2e4fc413.exe
Resource
win10v2004-20220901-en
General
-
Target
c1ff2943f5cec66a6d03ff4e1248081828f483cca69e2937f88edf6f2e4fc413
-
Size
7.7MB
-
MD5
de0e6ee26e5082faab891e193755a470
-
SHA1
a12c45cb521065d2620eec13ff5f2804e18724e0
-
SHA256
c1ff2943f5cec66a6d03ff4e1248081828f483cca69e2937f88edf6f2e4fc413
-
SHA512
b4d42881ea1931414bc068d59fb47c2a3407f4624e79f02f70691b11d840a52094f826a495b2f11df36c56454c5962bf90e10bee75eccbf18dc0f309cd167c73
-
SSDEEP
196608:rw0VpK1I6ys7UG48qTdTdxyA5NETrswMCIj7kc:rw07UxRAlT/yMN8r+CInk
Malware Config
Signatures
Files
-
c1ff2943f5cec66a6d03ff4e1248081828f483cca69e2937f88edf6f2e4fc413.exe windows x86
d8f4fea52e3a9bf94997ec04c0521220
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 6.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WSD0 Size: - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WSD1 Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE