'���G݈Xމ̧(E^Ki=v1�>�B�l=㎭D4�پ��Yk�X���/�l����-�{�VK��}���u<��������=��Ƹ���� !�:縤D�|��V�kʫ��uN~�M��&�� 攆N =pS�+���xC���O4�cvp��:-8lй[C�ya���[�{w[���[��#al��Z�c����!ӷ�ɻ#����W����Ra8�c���)%�����A��'2�w�����ۦ3?�!�1S�ob���i�8�n����������7� `RB@o�(Բ�����<Ar���M?9Κ���,PC����h��/����oϐj�5Л�(�5����R��%�I�r5ӰT�J���ɞ@F���z���%.��K�%��d�t�X�c��CX������Q��qr�W&�ދ�a��Η1�Iԅ�%���b�jU�'��8o�>\��� 0��Ӯ�5[k�����������n"v�4r�Q�VTw��]:u��3D������=�iͦ/����0U��)��>����*��'����FW^�(ovf� Mt���?!��0|4��Qp� 聳���X>���)+JN�g�$)�lň�.��[�ms'G��{K�U悥"��k�sq>�E,�5V�� D��̖�&� �T>�Zpȃ/��4�O"��P�%�����P������l)�ƣ�Wqp3a��i[�U%���-�ư�~ܼ+J�4C� ��� j0�h��������rc���v��s�a%ޯ����r�1;+���R���ґX��c��k��Jd���Ss:)�lW�)�aÒz�3�' @�{�jWp2�µw��s��k^��|,�o�I]���*/p71�F,ٲ�X!�X����sk����[tƙC;��:#l�+����.�35����[��(ˡ�斘�wp����.I�k[��f����2�|��!��T6��n)��c�������Yd�-������.fVG� ݏa �3r������=��&����z��Ǐ�p�>*kjz���I�L�^d*����5����_�Z���ۉ5����cAP�����t;C1H3�ȥ�}��T��,\��c��b�U{2'(����#�C�N�kJ�ůYьX`�"��ץKcb��6�|4�!!Ť@�N ����l���y��&ט�:� ��E�h��6��s�6fP���5�>����qw�N����Jo��g7�с%")�< ��M8�������FQ�>X��@]��F,i�j1R�S���#.ȴT�{37 D B5����$��\h���I1�^i�)U�Ϲ[��1T���1L�yo;��w�J��T��G�1?a�W��h��oVM���Ac��ҙ7x�M������3M��h�K���y{ʁѬԆ�!R��dl�&����%��AZ���Α4�KN���]��G��]� �#�Q�!:'�A1��y��رP�v��O<�����sg4(��'�����'} Ni������>Ҫ��NJl�������r����?5/��p[�B���Ͻ#'� �7Q0������C��SLZ=,�O�u������Y�vCe� �Gozwڟ[�x"��F"�i�o���.�5��p��$]zMY���B�9g�� 3?�#̦Y�2�_uy�+E ���~����PM��BT�_��]�F'�!����:����i���7Ls�bJ m+���.�0R)�K�����w�J],��|��F���I�`���X��4G���y�gy&��7�6z��g:����uďPr��ڨ��A��/ï?�=��i���A)?bL�Q�J ʭ�D��8pB��#��}X��`��a+c�k�ఖ�@��n�)a ���x)��P��!D�Lě�C�@�8 �1�<� ]U���)�<��V`LuM�lZM�� �Z���뇼'+��庩��a���)��H�\��+9�F_g>��Pf�/�=�o=+ �5"�)�V�T鯸���?� �����yZR�v2���D��]YzL�L�����_�K�V~���l̴��u�z0���ܨJ���km�*��|�� ���X����8�?�(?'�Oj�[M�_�������e���U��XW�����S|����)X�� �vI���@����VX��D|1h�Pz������S�R���ɒ�ͥ���9��Y����4&��������2��I�w_�(�[�LpT�A�&�����o�#����}�Z��="�i��9N�UiZ�7�-m�,��C5�q����s���5�w��߇L�!~���G_��rqG\�G�s$mo�(�[?r���UkA�H��#[���^���L�ſ�������e�ұ�b��:`�CcI��?�� eg%��Ҟ��������pU�����̑|�;iO�ˣ1~�&�@/8ԫ�B`����%��Oo�A�VD9����Lnh��2�&�S��۽:��W���ώ����)�0�\�#!>!zc:r�3�M��9�i?z����e(J�ڇ�W�S�3D�dٲ=b&wI�PFD>���$�Ҙ����� �2r!Ԗ5�v���O�+�Om���v�]h5�&V�B�8�u{ƚ�7H��RRC9s�]�i���y��P1�`A� ����I���Eb�ZA�mT0n�ݢ��j����ͤu�c\~hI�X��e`�d іN�(�q|d ��gA[��b�x����vB~���Ib�b�ǏeӅ�#�P��b?W�,�Ҿ�-��%]� �%� +HR|��_�E�\�J{�A>Q�<ҫ�r�L=�8�K�8�fH/�h���T�Xc�=���U�G"�WC���4�ݮT�f�I����05��N��$Vi,�U�B.��~��@��ϰ�L&�π���8(:߿���elq�DŽi��mF]�`�$]�U7���¡:���"��s�E4��UҔ�9��j?�pϒA`��=e��DrJ�ua#u�>-��;h�R.h��q��p�:v 4�2+��F�p��߂����@D��Q�=�;BL������jB�Z�P����a2S|���n�w�t���^�~.dZ'{���M*m w�WtD4sHZS���kz�����
Static task
static1
Behavioral task
behavioral1
Sample
16151ad8b2b7db99bb0b54316d354513cf79bd820f6af85f20b14f0d578ec035.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
16151ad8b2b7db99bb0b54316d354513cf79bd820f6af85f20b14f0d578ec035.exe
Resource
win10v2004-20220901-en
General
-
Target
16151ad8b2b7db99bb0b54316d354513cf79bd820f6af85f20b14f0d578ec035
-
Size
2.1MB
-
MD5
9c5145cd55628002c8bf910608764f89
-
SHA1
c99184860477f40728125bf6c1a3d7005b8b77f7
-
SHA256
16151ad8b2b7db99bb0b54316d354513cf79bd820f6af85f20b14f0d578ec035
-
SHA512
8d32a873770a8240fc4ca914679e7804af263009842d9b585040e050fe0f184c38bca63748b5a0708b234607ec5931cbff7cedce277447d67b37cf3c331eaefb
-
SSDEEP
49152:HHrRnXcLxd5chG956jK/WkPMARIMqqque7rn9CnzH:HL5qxcy56jK/JRfqqqvn9
Malware Config
Signatures
Files
-
16151ad8b2b7db99bb0b54316d354513cf79bd820f6af85f20b14f0d578ec035.exe windows x86
36d249be0f61e75635e95ebf8b38bb48
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaCastObjVar
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE