^1�P�'��љ��!�v/;�&�OX� W<q[�c�� �P� i"��!�H�ͱܤ��'�����| �x��"���)�eL���u�L���$��?�������Z�܍�N�iW������~�fJ�#S�w���1��"� %�'>{FM�e�A���!��-?~d��-_����'��d��@��+�L�����nt83����$^K�2�����yrމ��W�#XV�JJ^��Fn���S��줡��r�$!�r�Ą����J�ĸ���?�Ɯ;��hL]�G��f�3@�]G�.�: ���`/h�Mrn�\[�����z.������A3���;6�z����S'0�5��X5=J�!c}�$�j�%P���Q�_*���@�����ށ�a�8�a� D��-�EF���^���k����5��E�ˇ3�d�H|Κ�qz}�ύa)PKY9�^ bP��v�8�3�BYz����$����?�v?y��]b%fP�����+�|*��!XG���]?AM�mIj��F˦�&��p�Ɯ� ����bh�A�P_TY(6��|�<oH�0)ȼ�G�>��VL������$<�H#l�������q4w_�~������ms ���d����*��{|"��:��0S�[�����ߎ�-JI�.ļ�!�&a��I�P2>��(8"^�R����nж�^���i��E�J�Ⱥ:g{�m&9��N2����cS��G��ΦZk�:{gȹXGB�(��j��Z�8O�>Ӊ�| ���M6R���M�+��F��Qj��9^���e��� V��L���voo��[="m�N��:@�v�����>�IY����[�ul��=?3���*WF�{�h�5����x`к�������2+R陁?M��|ǸMN�����1�:�m��-����_�$K���������s؍�MgYg���|��qBZ�P���o�:��s�J0 ��:6klb�RK�3�Y)��.���q ΧS(��W͎����W�Ř�=*�_���:"����2b�����n������.5�g��m$_�B �Y�6kS�½�ydC�~�O�p�������x �B�2`����&�ܯg�py�u$Z�2cB��ޮI��r�j��A8[���B�<���y.��S�L���.�@ �c�cK/�!���>��>$�P�7z$�<�"�[_������D ������>�a�=P(�i��#Vd �nQd��"�&r�aM'�^�~��E�����E����ݘ���7ê��҄�*2���P4\{������C\ ��r\邖1��L�G7=yS�A�0���ln�}���`u���RN�\��W��o��(�)�� �"Km}Jש8!�FxB�8���>y�(J�^/+���v������PP��^*��Z��:�+reOA`u�WB��-�#��%��#�!�X�H��P8�S��f�#��8q)(�2 ���jB�nB����c�*��m�DL�B,� �F>�m���|1O���膀>��&���+���$�緓��4���)2�ư5��'f���DlAF\*�UPh�f)�ޜ�M��V$k���3� ��)�����y�g [H��yC��j�"��_B�J��ax�aZGA.摅&�������n�5c�{�DS[��j��*>�����;f�� �~Ch�ce}����^dtX�f[��Z"�� �Ԡ����L��?��͟�}lY�9�)��G���ލ�(����5TIw�PD�6���Y[q0?wh��r�����]bg63��m�k���st@t{��۔�T;B�8�-_��ص��U�����������/�4v�e��t:���������*S���n�x �T��u����>�&�,���1��|v^a�� �Ⱦ`ͦf}��b�f���+4<igg�]`��@x��?�����+������B�l���4z�=��چ��4���O��u����რ�,@��Wz�0��Dդ�n����2��YҤ�Q����i��.w~��kc��å��>�}�������c����u��6M����;���)b��3��^�K�X��pW��9S���`7�@���`�Z�e�Ћ&�W�K�D:<;M�x��y�ҕͩOD+���@-��N�{]F�q@�ȝ:���{����6V}'#ZF��W��-����1��N�V��,z+���t��=^]��R(D������]���x�6^��;�� �y�e��ٶ�|+�%Nxm�7?m�بv�FS(�K��UxӎE�,�������p;\P[��̼�� �b<s~o��Xߏ�Y�(�\V2��&���X��z�I�"�#�Q��x�!�D�A~��!Ls_듨�����1���Vc��)� "��Ldf�%a�Z�E�z���W�σ�&�B��X���T����7[��?�3��� s�ە>&@?�*�V�e�5�������Č|tn�I�� �����Xt�/���!�P����lG���%�wG��>�aWi�G�~��/��ba 3��� }�@��h��>�wXt���8'ނ/�����IJ�|�}��`�C� �5��!$7�r�Ξi}v�|Z���ǯ�����Xk�M���J�t�wf~����s;�MN����N�ؑ��_�p�����#L4�-�s������gn����Ƀ̦�l�U�d�p�N���!k(WK+Z����%� �{�'��L�'2_?��[G�qx㵦�YQ�,^\XN�aL����`�W�<Zy<8b�pd�.%W>[�Z�[e��e^�����h8cH�f��K%���y����d�6���j42��_m<wq�%��^����D9������g�� XuVb��ˀR [ �l�����Ef-_��n( K���˃��'٬�h�:�"P.x���ga{�f�ʚho&n?x��&��LE�p�=���ᤍ�(F�����Org�a����!A5�<ƿKp��l��5��(w������)�'�����1{ `����Fe�� ��Ok�HdD5X�o���%����?�"���/�]�*9��ī� .�gח���Û���ϣ���.����fρr?��L��I^A0B[��>
Static task
static1
Behavioral task
behavioral1
Sample
fecb1aaf7ea76f0fa8327df8472694525c3ebdf99f7aa3d1b754af4e8f2aebca.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fecb1aaf7ea76f0fa8327df8472694525c3ebdf99f7aa3d1b754af4e8f2aebca.exe
Resource
win10v2004-20220901-en
General
-
Target
fecb1aaf7ea76f0fa8327df8472694525c3ebdf99f7aa3d1b754af4e8f2aebca
-
Size
444KB
-
MD5
caa0572355f095ea59dd4fbbb14bf631
-
SHA1
efc9cb217b9a5fdb332e80e7c32154c3438ca6d9
-
SHA256
fecb1aaf7ea76f0fa8327df8472694525c3ebdf99f7aa3d1b754af4e8f2aebca
-
SHA512
87fa6d028a08c86f3876df5b5750f5ab2974d3f17d3d9073409d9b582da267bfcf0ee48bef4171b1d7c1d36b9f3d850e0b252b255659acdefe256ad9856cb90e
-
SSDEEP
12288:XRPUeY38vE49ejoMwtFW930De06oRa0zWx1bszA:hcWsDws0DRa0zfA
Malware Config
Signatures
Files
-
fecb1aaf7ea76f0fa8327df8472694525c3ebdf99f7aa3d1b754af4e8f2aebca.exe windows x86
b9c80bedc426895de00a71567a9dd304
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyA
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
psapi
EnumProcessModules
shell32
ShellExecuteA
shlwapi
PathRemoveFileSpecA
user32
EnumWindows
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ARTeam Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�������� Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�������� Size: 424KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE