���/�̲�����ZU��A�]��0&i��:��ۛ��ڑ�oo��u��ߝ�i�)��&Eิ'ŵ������!! B��];6��:�#��s����:U�f�&����{����+S+L�M�=�cj��[tF ��,(���B���9j�2E�� ֓�����9��Y�A29�3H1������0�)#4��{�h���+�Yz9A�v��y%&qLxY'���p�y�&�O]+ �j3��!ߘ��ZI=C��O6 �8��x�'G·���0��R ?�� ���2������ UxpR~X�\�w�"�H��c�p��I�0�8}Z@�z<���n^Aj�-�\���|����(��Xt���-84V=����2��C�OFRy������X��Cy�x*^Ʒ�y#]@�Yß��D�ٰR� ���=ᄁ���`zH��>�̷�����'���GޮA�9�`���"Y� |��BGZt�]����%�p����0�zk�sQٗ����,)�r��=1�G3���6�٭�G� ���,����zM�Z�n���j�J�'?�6[�}A}73�<�9��{�bZr� �4n!5�%8�P{'���n^ "ҁUA��t��ْ`����&<�l��Oʷc�,�H,��^1�֦�̊����K�������^ � ��|�F/On�� �� I�B?���n�����cP0B}瀙�C�x|�\� ���Ww���X�*'U�Q��ly����l���t%�i[MvT��N�Ĺ�dM /$ 5j�jx�@2NT(��e�XHxW�];��'tV�p}XB�����@��Z8�ӭ�S�wF|�#��=��R�e�AQ��`D<.Gh1��Q@S�0��8>Gv�-_|Z8�txE�~� mF�Mֲp��|!�!Y,�n.��v������AI�T��<`*���Cõ�}�H�+�fC�����@2qb��Q�)ୗy !M�@4Ο4<��j�V ��8E��{u.aѳR�7�S�1���� �� ���c,�[n�`xhl���9�!L(DL�ꌁ�FĔhq�a�)��W��u�d���8�����6�f����U�w3�+IˀxKc8E2�9�0�R�s$S����,x�@aTNt�"|M��i�tO�E ���H3��[b���>���'2���}��9����3�֯����� ƿvf�Lt��.����/I�0u�W������p�4NIV����V�}J]?��=�9�\IT��7��B�&z�ąi)�eZ��m"�,v$G�lW"c��W�r'xQ�")��!����|{���V0����^����}���rx$<b���A1g4�QXv0W�y"oԙ��ZI����K8|.eiXE�R��'VQ�rlO����Ch�CX�ڎU�A�hYƔt$�(|����*v�������+fec��?�`AG����l���_19���-����TRo���ܨ8a��p�0]���5�]���=2��k�:�V8iQ��j6 c�<�DH�$T��`>�A/�'��uafvb�2��S�/z$��ð!��j_���Aa���N����խ�]9XCR��O-݁�M+���`�dy��S����P��� ݅��(��k��pǐqf��� 6��=�Mc�tZîe�!�}L����� ��˝��"�g���=�C�7����,�+��Ŏf,���̺�e~>����3�6OҡrӖ��ɂE�@�����d�nmB��#�,����`�V��߶�m�i��}4�eh=]~U\��e�4rH��� l�ڥ7���V~��0\�JF����đ��C �}�u?�.������Hn�Ť��-G�'�lK�pc`�Ŧ�÷�w)!P#^b'+Z��k��P�?�������]2��b�>�e)�P8��U�m@ز�����Ɗ������V?�y���u��X(+�>-�d��3���dœT� ��jF^/j6����i�������,�;�Τ�_����.y6� y��@�%�f܋hl���x6�~ R�v�V��x���g��^����3����PS&�R�M����%=���g�\� <���f䊊�:`t�pCEpK��s�ƚ�[���ww]�3d����{��NE�� �m�u|Q��U��n�* �:?ua�.�3pn�!6��OQ p�FD2(�Fy�s{��50D��F�U1���sO�� �� ��yۺ"p �d�6���$"n&�&JX,;Ck��� ��&`��=kh*��Gy�<�"dXHCC6�M�'���Hݶ�6n[ES_��dJB$�����A`B�x&�[`y d&B����JK�s|�J8��#���N(¦����R����╾���x�sTM�X��v��` ��H�t�z�ި���y\W|��Z�Ъ�x�$J�S�"�Jo�$�α2�u��s�9S}���Z�����r���2FLNi�& ���������d6X�{pD��@S���O�����O�x�k��EnvP�� ��I���H��ڃys�Z���}ݴ��`2�5�R~jRAE駹�L�M�>R~/?;V��e�D4�Rʆ#Ǔ�d=pdP�X���w�^ԣ���lR2�<���bd���Y����u��D����iJ"/��Or3��%�MO<�v��� >�"yLIo�{PZHTk~!��������(^�mf.V+s,'k���7�$H�!����,#�*䚏�Ӣ��V!�M ��*���Ō�+��jdr�]o�*�?��ݵ�c�Eǧo^h�W'xs#��o �1ϲG������ku�7�Z�4]��7qo~����� �0�^�z�o�TID���E)�c����3I���pO%�:0j�|�_�N0P0�1g�禱�Ǝ�˺ =��-�Um�g*��j�`&���s�.��'²8�X5�)�6����#=ڰ�%nڭ�9�!�����/��O�G,�7�ٮ�������Cd9��P���%aV��jzE�sH@y]2<�ˀl���N��c������_jg�; ���W������ �ɣ�Z�C6�Nw��Г���|�2~�q[%ګ��K&�t��rp�c ���_�PJ^6ǂo}k�ዙ�k���&|e[;�_��;�,�N�%��Q
Static task
static1
Behavioral task
behavioral1
Sample
96364f9241514193f1482770bc11358ea566c62b63e5e2a31204608d69c1bafc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96364f9241514193f1482770bc11358ea566c62b63e5e2a31204608d69c1bafc.exe
Resource
win10v2004-20221111-en
General
-
Target
96364f9241514193f1482770bc11358ea566c62b63e5e2a31204608d69c1bafc
-
Size
587KB
-
MD5
03b59cf2ef4c0f8456303a3255c265d6
-
SHA1
b90ebb79846baf1e7d7e0a0cc6fe30b0172161d3
-
SHA256
96364f9241514193f1482770bc11358ea566c62b63e5e2a31204608d69c1bafc
-
SHA512
989926de3594c6054207f729a27364c78736c33a858fcbcc57dd9b279ec024e64fc6a00c0b8c7d1faaea4827738e46c2084073aac386c8fd18fc523a5b66bc1c
-
SSDEEP
12288:b5WngNzM2VSkBvhYTxNTlUWWjWzR6g78NloZXCEaQeZQd06:bwngN1EkqTl26NRQr2yKeZQd06
Malware Config
Signatures
Files
-
96364f9241514193f1482770bc11358ea566c62b63e5e2a31204608d69c1bafc.exe windows x86
86b0d90d39183c9c4a4c86cba7192c03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
ole32
OleUninitialize
shell32
ShellExecuteA
wininet
InternetCheckConnectionA
avicap32
capCreateCaptureWindowA
ntdll
RtlInitUnicodeString
netapi32
Netbios
Exports
Exports
Sections
CODE Size: - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mac0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 369KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mac1 Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mac2 Size: 534KB - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
quqtuud Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE