3��J��i���$�CRV�I�W/.-|� "��1��$��&fUj�i?-mRM�RU�J����"��a���z��-�5�T�ol!v/8@[��ئz4�G��g���0N����M���Ζ����4��a�Iv����ȩk}��T^S^�\{�]aEL#����X:G;5���g!�؆�,�9���i����e��;<-3�R��x�����fSyp��6.H�L���o�g ���������'�3&����I��r�AE�!����)n��lu!�z>UӉ��Dm)$���2���X���@��f�k�X��|��IUP��րԸ��^LT������5�2����%/��S�j�+A{oQ�k~Yِ��`.��� �{�6�V�E��Ƶ�gl3<i�2��,�m�:��[U^ ��������d� ���LRi��4Z.�uǎ^����)��B6�zͿ]��� �gv��QX2KD4�{Iڌ�|̧+smcvo�jw�¢�A&C}4�0��&�O�[ ��^���D����% 78�W�U-ŭ ��_L�\��P%���Ͳ�����P�H�3��ϑ�^Ini\����b�:f���5�{�}������(�v��a8�(����\���k�p����).���_)�dU4����H�ߙ�Y���zGo�#d�Ԣyy���v��ˋO�V@�����U�ꡔ���������X7tS���Ep� �5�`YA�U�!����i���ڑ"�*���ik�F�O��� ^6�������R�>ݝ��?�$=۱L��>�3b}�&����O��9,R\A�w+[�H����\Ƅ�J����Rç�u� [��A����r��UD��'M�-wr@��F���m��t_���W[~����9#��aD���jnC���`R��<��c4P���A���z�P*���v��h���l�o���?%��bA����F�<b+-��c�CEu������k �>��ut���ٓ������'�M��kfhs��ܦ�'glYHxo}AO-q5ٿ8�y���<n#ҙ��J���'C|�1�v�V�$ϥ�����Ș�l��|���[�W�-C�]�Z�=dû���|�Zᒍ�ڭ�Z]�V����UJ�k�:SMb��:�|�!fa���'#ˊ7�K��H��hp���?�K`��# [�%�%��Ƚ�����aYGw"R���u�W�!!z�b�Z�Nܸ;6>t7�7�"n�=����*+ܙ�ł*���9�=������.�+֗��8�!v;���:7�4��g;"ft��ﶃ��GW�{]p������� ��sg&{�!u�SAC�>�ή {%����N� ��(/?-�9���k����&�Z���EQ��=���A�@�~���Й:����N���}a����+�G֝�Ƞͩf��E��z����΄�kw��Ȭ^�cةn.k�r�]P�Z��d��KA��E�u�k���b�0�����e�K����7��&�����*��V-� ��:\&�Q@��k�oḱ/?����F�"��;�@R�@[�u�D��\^xf��J��Xu_=�#�-JI���D\9��^)wʕ��6i�����yݹ�8� ���~�Ñ�m�#�x�@G+���Z���cb5j�a��JՒ��RB|�}Pw2_a�/����� ���R�]���[IY�DnS9=��:�"z ǀ��5c�~~i�"?Z��)7��.RL���0D�N+�Ք�X�/X��nf�U��ؾ����b�T.�0#�jGhm�Ǩd�y� 9����1=���!h�h�V1$����P�0N����-ݘ��b��b��q�hg�"��&����pDە0�Y�dhd^w�1�O�Ӻ�X�у� |�?���Х���2��ȁv�f}/쪨^��E+V=A��%�(;�s�M�$��=m%���3��K��2"�^mH�8 h��t�W����0?������@�u�Y ���2�^�V�)Z)��ӲV��)�R��\D��V��O�YbD81������t���S��O������}�}�t�:�^��dL�)�ӱ�kH�LйK\��E#�����O~#�kO�W0�oX̢U��df.w�q��DI��̳]��N���ĔhG�i�)C�S���ph֩U�YC�����G�;���PQ>u�7� (6�[�y�D���sFm�{�b�JZ��LU��6�Q�i�T7�#]gD33�L8Y\.ϵ�dU��Px�������kZJWG&��s�� Bx7d��;��g�������;����3;�6D,* [#�؍3ɂB8'%b����㊆T<���<}p-��Oc�+�TӼkW���!�����90Xq˃I�^]I��<� �өcM�&��U/~(Mސ�s�.�=)W��ι�׀�ooƊ��2�i��ԛ@:�3깰X�a�����a]sNjY\֦^{A�����"����Α M�ZTt�(1��Ӏ-�H�����*�ץyb��/%`�j�t��r��KuY��7Be�: �$ó�3Q�=���a@Wg�.�'�x���gZ_U�� �Y��㍝K���Z5�h=�ůE܅58�@�p�L����E�%Q>%�M�����1��Pf��&���� X�ǽ$ܼ��XF���m�� ����f���"��'[)p��J�������ͿF�&��%v�W�%��(y#M����s�����vR��d��Rz�A[C�ٝɜN�fN�U�5���6�������S ��KI�Ҁ��_�V�r�_/y����`�5�r���Vq�=x��?�w�j?Z�{.)l�!r�Xʸ����h~�cZM#���h�#��|m��Z.n���!�_NO�K��Q?��$b�y��:�3rL�fp^�riԁ�ϵ>Q�[�5M_[^U�ǭj/���W���┘�ݐ����#��j;��=��,Ϥ�- ?��N,��qBI��e�P�xř�.���`k����6�E "���ơ�<�������id���h�8wdɛ��V ��N���N�~?�P%<��G��(K/�'W\��)��s+ќ����o�5�t}p��Fg`��o[r 6a�Y���&*U��H�B��=Y
Static task
static1
Behavioral task
behavioral1
Sample
9d53bb3562bc81c13ccf28f63f3b1f7da99856e5d1fbc03dc247741165127aaf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9d53bb3562bc81c13ccf28f63f3b1f7da99856e5d1fbc03dc247741165127aaf.exe
Resource
win10v2004-20220812-en
General
-
Target
9d53bb3562bc81c13ccf28f63f3b1f7da99856e5d1fbc03dc247741165127aaf
-
Size
2.7MB
-
MD5
7e2b0ed4df81c2794d447acc30d94252
-
SHA1
fdbdc5af30bb29c630138d5f11bf6491055af878
-
SHA256
9d53bb3562bc81c13ccf28f63f3b1f7da99856e5d1fbc03dc247741165127aaf
-
SHA512
8601b3e32653bda19873b3fe243d8264d931ce0d5e88ba00c36f66c13e68463ca389f4fd29223e6ae349bc75f45f61e15ef42209dfb60e9bf442065197d3a463
-
SSDEEP
49152:rW9Ql2l3JLueylpUDmLmeIwgA+hv4d8Ldb5qSD+t53X5DVHk1:Fol3U3+Og7hvhLdb5N4R5+
Malware Config
Signatures
Files
-
9d53bb3562bc81c13ccf28f63f3b1f7da99856e5d1fbc03dc247741165127aaf.exe windows x86
6a5fd7b3aaf2ebe59c2a44e5d323ad4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantCopy
advapi32
RegEnumKeyExW
user32
IsCharAlphaW
kernel32
GetVersion
GetVersionExW
GetVersion
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetTextColor
version
GetFileVersionInfoSizeW
ole32
ProgIDFromCLSID
comctl32
ImageList_DragEnter
msvcrt
isprint
shell32
ShellExecuteW
wininet
InternetOpenUrlW
urlmon
URLDownloadToFileW
comdlg32
GetOpenFileNameW
winspool.drv
EnumPrintersW
ipinfo
QueryCityFromIp
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ