��W_�q7(��%,ف����[�u���� e�,�|����W�O)y6,����f��'�M�ܗ%3"eV����������qoO./����*vr%ߖ�EW�YJ���R�H�O�E�_L���U�k�=(ۚ� �"sp�����A���#܋��Q��H^�$R�~�YA�tg��v8K?�S�w�.���:".H���>�S���A��n��k{W���d� ����˳���V"�� ��p;{/ɏ�`x���U��~��D��������o�����J���3T�?����'�GG()j�TOu�x9��)����6Ve.�~m7�d�5�l�s�z<H��X^s��;�w�CHJ�qI(������X�cyZ�^��-�ӂФb���e_|Q���`�<)�ǃf�x���aP�������'z�o07=&o�M<ۙ�@����rkR;jܳ� @\Ւ;)@;� �����E�-qB��cm����P�Y���s��:؝���H2z��������M*(�%�9�fZ8_Fa���Y��7YLl����_{�NKi1V� b�?�B��$Kz`��On�.&Y��T��p�Oѱ��N�� 1Ρ�!�!({{ђ�קHA"K$Is�q%�b4�u����#�r:9�&�g�3�% 4k2�A�ԩR�6}4�O����'V��=%`܌n2v���h}��gJ1�LH0Sr�;ڤ�Ü�����o�l|���9A��6�ت&�A���g����"@�j�.ov`�vg�R|�q եD����EPB���VGX��\�h��k\;f~f��< .P�[���\]ut<Is|��D+;�`;\��/ K��]���U/��B]*c잡��a�[J:ѯf�T�Kn�;.�9�C���`_�p�����){I��^5J�HU�a-�V�`L�4�b%�����k�5_�~���S�a��$���K�ABY��6v<�� �&���5[�/�.{�����"p{�:tP93:G{T(<�8B��$X������j�1?��b?X�4�A�9�i�ǯ���[��.�(�at��i���Β��̔����Ʊ�l���)�f�[�r67go��<�����O; R8ۜ�g��gK~�7��J��'�m_����"4�\�H$���k���@�kd(vă\7�̪��'��p����2��]L8j'ƻ�� Ϟ�㪘��$�z`�U�k-P�A"Mwl�hx3���S��,�c�������, ������^�h&5q�[�n��s���@���}�X���+���<��I�`�Ƴ�@/��κ0��9¢�'.���l��KE�W%�t���M���n�hȒ��-�N>��7�Iݩk���3���}��K�b��/����o� %�2���C�J�@�g6S#>#ɕHcV������=}�Z�o6�!�~.sK�]�Vĭ�T ��X�f��d��M�4�;�nO��H������}���$N1i.� �[Z���^�!)S�_`7����חe���xh���oCt��lK��?�����g��:�ک�C,mUc"���M�u�h�����^μ�����L��:K����e�[8�Q~Z��E.����O*2�9��(8��|:d�Ž��B�=Z���КٺJ�����t��M���"y����F$e�n�^{l2�X��3�s�g�O��%�6��r+P����7�v�[��^9�8=ܕ��S���_���t�؍�p����r�aѴ�R��&e����BH� ��IJ���;�:�S����MY[=�ɬ���E&{T� ۾-���������J �T��..n$l�s~���z���+X�m���R��W���N���-X���Cd��s�r/vU]����0�tz,Cq�EDO����:?7�NON�ڰ�2F���pX��>�����̃�:�<'��6CHK����M:_�%@��=�Q��7 ��/9q��d�2�p^ה�i(+����qn���Bˣ``�\H���(�\��/a�]��d�s%%��F���fn����.q� ��"�yͳ���?�RqIK��� �]�c� �N��z��B��c6��_��A�8D������瑫>$�Z�̜�Qq�q�d >�5�9�0��Ά��dU�LkE���V0/*��{9���[�>4�� ��6/���p��%���~ {@�L�Ə���|�(����+�pG��6��3V���W��J�(Gё@]�#Y���#/�\��;����Z���H��l���}�^EK�,Ek?���;�1��<��[���5�n�^�G<D�; ܷ���g��� �7��L�q��k� ]����2 �; ��*FJ����VӰ��o,G݄,;Y�C���h�����hi�gU�����دZ�!�2$M��1+`<�#E@������Q��/0-J�ϔ䙞��Gݬ͕�.,~��e�"�Z�@I�>�Ôc�j��/�.,W(�d�5b��֘�� ���s�s�TT'"ng[�0��q����N��vR3��=���ds������NR��x��=��5U��>��� 82��Pժ��d�^��|����=�E�hw��*1A�(o?����B�B ���^�_S��&�{H��)��ZN��**cd�k�7ހ����<�i�k"��ğ�1�9��rP�£p��0����1��$���>%�����S����G�L�9���H�qׇ�9zIa~��>2��jPh�]8��g�����Je�k������;�y�2� �Q!<>$�mw7��9J��d�=s�\}��y��� ��I�WV*�lth����g���hP��ѫ�*~�ۚYH�4�k�����9�B�M�s���9&��Ʉ�^��R��ۘ��GΓ�����H�ΫEдWN�wI�kS��� �B��Y��b������bY6͋T��X��B� �m�v/(q�d�_�O�� \�D������usA@����Ω����1O�U��2����W��@����A��]�:�Vh,r#Km�J/V��)U�~��i�1:�n3L�N2���Y( �h
Static task
static1
Behavioral task
behavioral1
Sample
f6490d0def29c0c6638a203e3a0102f0c5d51c39e2db80a1b933783ba991eed8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f6490d0def29c0c6638a203e3a0102f0c5d51c39e2db80a1b933783ba991eed8.exe
Resource
win10v2004-20220901-en
General
-
Target
f6490d0def29c0c6638a203e3a0102f0c5d51c39e2db80a1b933783ba991eed8
-
Size
10.4MB
-
MD5
f68cfbc83cf1d510fde6230501bd82a3
-
SHA1
ff9519d0e738cfc400c917ef70b27e76fefc49a0
-
SHA256
f6490d0def29c0c6638a203e3a0102f0c5d51c39e2db80a1b933783ba991eed8
-
SHA512
48b4f3f103638643b593f830a87f7bf93897fb0bd4dc211d0c903736f12cabb284d09d3434e405a1d254baab19792cff08f4057273d1ce5328154e0f243e2717
-
SSDEEP
196608:+OHz1pOvqhlTrz4teOqn/MNMjBi+787Mn2s5pZ+J+WKnZq8WCUanGnIw/RL1e5Kv:Lz13ZrOMjBp87aD5py+WKncEGIw/l1U7
Malware Config
Signatures
Files
-
f6490d0def29c0c6638a203e3a0102f0c5d51c39e2db80a1b933783ba991eed8.exe windows x86
0701a95d0270c7edcb43b610395b5001
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
gdi32
ExtEscape
winmm
waveInReset
advapi32
RegGetValueA
urlmon
URLOpenBlockingStreamA
wtsapi32
WTSUnRegisterSessionNotification
shell32
ShellExecuteA
oleaut32
SysFreeString
msvcp90
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
msvcr90
_CIcosh
bcrypt
BCryptGenRandom
dxgi
CreateDXGIFactory1
dwmapi
ord102
dinput8
DirectInput8Create
ws2_32
gethostbyname
dbghelp
SymGetModuleInfo64
psapi
GetModuleBaseNameA
iphlpapi
GetAdaptersAddresses
dsound
ord9
d3d11
D3D11CreateDevice
xinput9_1_0
XInputSetState
d3dcompiler_43
D3DReflect
ole32
CoSetProxyBlanket
d3dx11_43
D3DX11SaveTextureToMemory
comdlg32
GetSaveFileNameW
Exports
Exports
Sections
.text Size: - Virtual size: 26.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ctr Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
typeinfo Size: - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fieldinf Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 208KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ALI2130 Size: - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ALI2131 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE