C(�=p�`�z�W����ff�7{7� ���Y.�y�T5����7a�;�n�����?1�<�A!�)F�\J�3�� }z�ی+���:�����@d��}�FGS�^�ld�'\�o����Ľ���+���4 M�&+��/I�/� ��q#�`�]+ ��RWz�D�����zHV��w�-�y㿺!t_16S���B��H�h��^��� ��":�������*���0��Ied�i��4_Zڢ��6 Y��}گ��h���v �̬�cç�;�t��[jgS�T#��m���Ȍ�.��U�U���{s3�~-R�Ǚ�O�2�������1��My�E�v���o���,��B ��fWq~�D�o_��Qx{�_q���=?4�%�FH�h�l=��I*���a���T����_ H�l����6��澨sj��?���Ƨ|�n�x�h�>��h��-���2��R� �V!I�����ɚ���"��N�q��sX�}5���dL�Î!�m��Sq�?���0�"S}�?a>E1�r�h��E~��C�`�m{��|��5�ŏ�f!�w}9�G��aG`HVy��!s���3E���| !tw���t��2~V��9;@@d���%�,�xZ��;�NFtC�,�%���6ܫ��6��of+��Oez��b�s�Y�X�t�������+�w���h:Lm]�r8;[�d�<3�gF���;�!��@7n'�(̥#R��L=7�/��t�c>g��TM�m,�1!�P��2���'<P3� ��gW����������z��Nh������'�>֙�!�:$"6� f�!+~�hpl���������A�h�QLUa���T����cܸS۸�9� G�Z���:.�5�u��%A��a�(v����M�ұ,d�e��}�ʘY��Rd{�!ئ 6Q�%�̀(tu��WTv� ��|�3j�f6� lŸq���{�G��ǿA��ur|���[��:�^HʬT�Uf�#� ��؉�9�HD5c�¶�9;>S�w俟\T��G� `V�H�H�����9�:w�������7�M;$�<`#�P�<���T\��;H����ϱs�ߥ,%^�����·����9�F;�W���Aj�9�դ�A$������C�*�چ`־h>�9��'։� ~F����6�L�U?aG��"�y��eԏ-3YV�k���p�H�����c8LR���rDC�O�Q�`2���ڏ�LIi=YS���z��f"��,:+�qc{���ѧL�aV%_��T^�&B��9>��1[�C��K��zE�^d��}��j����)�X�=�渎�1� �H<�U`WI�`I%Sx�-_)��L��������,��Vb��fU𧖄��ii'��U�1��K�ͥ�ܯB@�2� C��EeɔW?{W�� �:߹�����^:��h���l��)A��є[��/�p]I�M��_��c=���Ԥ����&(!��I?(�0��F $ Q /Ax������cv]���r�ف����eK��n�������0Ģ�m=V{ S�M��)��'�mDі&dzz�!D�����H��.��h��l�H���\i�W�g�y�@��ZA�$�!�$i���~8�W����a�]���;SL ���p��泵��"v+�Fm��I���:S�I�&#j�8��<e�[�v_����c��ؐ%`���r_�Gb]�����vc��~\�9�c7�DF�C����ll�������iD��z2Բ"��p�|٧��)����F[ܛ�<��`���3WF~5��<|�����N��o�i�8��4��<Y���1��/:�1"oU����:n��xhoPe�j�(���c)~[��==c�t�.��˒�>�b�!&�0�1O�<��7�d�I��JXm!��wq�N�X���������/�a���B���W�j�s��u�f��I�:T�P��������ڥ�C��s]6F#|��>���7f��|E�2%)[�c��Wc��X�z��eRbK3�hjC��5�Q9 ����7W"r*�NzJ'H��5��1J��g��Z g����C'�B��\}z��dE�C.�z?�m�a��~f�a�_1���Vd������$�u��{��p�u!��n �i�$5N���H����긼�}s���)-�Q5 9*6k�P��wb.��|K��|�Z"v6�$�z�XT�� ������(�����A��V?bE��$�B��:;���EϷܴ�>��$�F_�iDs$f`�E��,��M�3��ď���= �œ�dW:��3V[Y>� ���܋&)l�j[���_�9 �����X�=�{#��B����'���6I��Z_>9�����U�Ԍ7v�1+2R���oy[ض��[q�B�?y����ʜ�}[�D��4;F>��\�Ezؓo9��nMW��L�[��@���N��Z���^wVF2 z�e�ha�H��D�F�7�%�|���D'�E�|��-M��Od4����\DƋ�����Ѧ���^E��ӯ�O%dx�m HI�f�Q���ǧʛ3��7��ʤ?�<)%ֈ���<%;Q_^)��f�����Z(!z�DJ� ����Lj�d[��!���W������?�Z����h3���۟�&�g����x{�L1�B�������D3���뻙\rV�����'?b5g� 8�tZ�a� )��y��N@�8�L �[r�tLe��r��v���������n���D0�X���#��Jj�KQ�UqX��CI�pd��ߜ�m}��a�����}��a>�+t���4����;0'�z?6 ���,�p�1(T)�j���{�0��k��Tϝ���R������$�4����j����8W���d�p�-����V� w��O�x�qA�f�k���͋��Kq����"3��4��b8�SB����@0��JC��x�p=�0���֏��Ƚ4Tec0�U� Y�1;�yk<?���!�SU`�4����z������@���*$ �a�G�p��g�B��� -b��@Bu��Y`9���v!.<`l�P2Kw���M���ɉ�GǪn���VW�o��
Static task
static1
Behavioral task
behavioral1
Sample
caaf5563ac13f9f87e8670fd11556b6c87e32e3124aaa72bfb98a6ff91797f99.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
caaf5563ac13f9f87e8670fd11556b6c87e32e3124aaa72bfb98a6ff91797f99.exe
Resource
win10v2004-20220812-en
General
-
Target
caaf5563ac13f9f87e8670fd11556b6c87e32e3124aaa72bfb98a6ff91797f99
-
Size
484KB
-
MD5
017a5b4f045346fc24b03e3f8c3478bc
-
SHA1
d32419b3a12498f99d2a23c26932d9d1f88a3b62
-
SHA256
caaf5563ac13f9f87e8670fd11556b6c87e32e3124aaa72bfb98a6ff91797f99
-
SHA512
f558c66add659b4ca2d1ce4df36a1faa5844c9ef1043883ed38e01990a429a57920bd04b561f12058dc53afadcdbc52565c9bb6781d02d694c87f83c50dc3b3e
-
SSDEEP
6144:rz23cThIspZ0RGrm1GEN4pPJiaYHQFyWMH/ZrmlDLHrgjOk+D0T/xLETaivTc:ry3ALpZTmQRiaE5JMvYVAairc
Malware Config
Signatures
Files
-
caaf5563ac13f9f87e8670fd11556b6c87e32e3124aaa72bfb98a6ff91797f99.exe windows x86
37dceb71e1aefe5023d8c09c43472218
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
CODE Size: 259KB - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccg Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ