6��sל7�X�kZc�F]sc�y�"�x[�C������霎Ҝ�3q�=O� 9Q��'&^����V���PD[lR>� �G���=X K���-H�n��D!�WM"�{�6�������Ld3$�����ʶ��.��_�����Uw��Z}�j� �Ĝ�<ႛ"�-����w���r߷܅J*R5���E�i��ָ:�Q�C8"εT���nx�l5I���֚�0�g�w^�'�@ю���ؼ�/H�l�$�c�AGP�d��Y�Sɥ����DKP'��Lz����i�Lp�C�6�AGjn-�85 <����h�OѤ-[1��B 3 2^����Jh3�u'k%Y*�]$�4���4��^Z�m3�^�㾋P/|O�]P��B��/��y@_���z�!+c�-��X�+˪�UP�Q�uRM�j��c:�y߃�a�z`��y�ȥL�@9ω2���X���?�� R����?�������p+��Jz��!"�Q������)��2�gG�q�(�8a��������;q^�P��sK2ӑ�t�6K[�Rh����N�Fsڷ��p9+E���R�E=���'皍V��Ź;<,����/P��.�5uN�\a��ɟ1�g�����@�y�[CF�n8�ښ>��h�ۻ�Iݍ����K�ⲣPAd����������r5�]Y���ܦ[=��x�ѿA��<�*��g���]�x�Д��������EB��q��cK���g�r�SM��_Ԁ�#V��7�����6%fw�X?�pϔ�m��`����!�ث��;�j��\��f��7�҅$�-#�����U����J�.44��+ =�UzlH� ������H��8\aL ��n�_^�RqO��,ajq����yu�[�v %2�u�z�K"�Z���!��USǯ�Y�q��v��(~��:E]!��ʵ|6��{�Y�V�n��1"�Zd����V����Z4{��wF˂�Ĝ�Pp'�:�i�Z�ޒ�F��}.�S%k��s�_�OyO_W*���Ed *�U F�bQ��Y��1�έ-|�;�`��!u����)7-�3�ٝ��F��n"�Ý��s]r�(�=�k�ה���f�OX� ��Ц�=�MoB�xL^�ϻ�-���B�D�2����U�<IvyL�灧���Oc�i���&k�Z)����E����|'Y�"w�T'+]��~�Q`=�4�=���4��FŶW��f�Ϙ��V�VOza�^��4u56�W��~��I��0�a�ƣ�e������Lp�"pHv��h���=<F� �i3�os��2��ϯ����j�º;���zg\�?>2X� "*���}�|)D8�EQ?�v3ĕ\}�^����q�^GZo�Z���J_��h`|��U0Ai�/��j��OM�#Tas�p�? Щ����B����� ���- ��JI.��fq��)����~��'��K�Re��F)AC�$�~� D�;ޏD;��2�JP/@IR�^��<��G��:�e�[8.�)8�ԋ�����z��Z��ɢw�����!]��M�@#c��~(/=]�?��Jk����1��1W��I>P�0���-������}[�O��t��7��}�cX�b��B�W�DM|Y*�ha�?�����"��UT��`����L?r�Yi��Mt?��Ǘyzkӝ�[F)�2�I 1���F5��-1b��l�O]$��hcI�~o~�b�TE���<����#R[�������!BaA�<�y�!���dq�F���Nv;�)2.�-�S�d�fi�I ����y���d�Z�!@>��W�v�6�fXӳ;��YV�o3>I+��9 Gz"z��#l!�rP�/�{%̷4)� }�%�Й����)b��X�&�g�N�>[�̾��et���Y��S}�TP; �?�^�=H�|W��ۼ6��>�ؤ��}�3Av�4x0�Vq��W��ew�}�;�nu {��w�|��y5#�0�8���d�ѷ�E�JxXC�Q�7��.0�~d���B�R�w��;Ԋ����W�[��6a��)Sv�3�i�����;����ջ4/���� Փ�U�D?�����v���&V�ws匹'�����%5� ������8�ByFN�\40N�j��.�ؒ����F�h@����&Î� -��3u�an�Y�@�,��ٱ�y�Gn�����=b����C=s�������-L�\^����aЉ��Q�HkT笃�F�+B2��a*'^��k����K�FT�ҵ�k�_lv��D �K;���R��*�m��M�G��?�Ә��r��1�D������B㝌K[��e���0@����� ��kg��M����~�9�$�ϑ���������G�\,T��R��+q�S������vF(]���=��k_\��aŲ��P�����fٟ<�cքaI��}Ph��3����^���9��A���4�*�����8�C �������[�qN���/N��{I��q��� 6��qE�#��u=��G���r^��e-֏E�ԣ� �+.����ϊ���ȏ�e� �!�����ؕL�<b�DW�H�ƀ��tbS�RP�У$���u|&��s�W�md���@M����{�:N���|�I��J�;^"xx:������HBD�9,�M�И�N` p�9`@臬U�����W�FD{��t7ZEa-;��W� vY�������ÙB&F�ݿ�p�$�4/�1>q ����מ���3����Y��C�қ��(��`���3�J��A�<?��Y*�/��iCpRez���4�������TGN��[b5gݝ����c�us�,8P�v��qw�NG�ܙQ�`���r���5#�����k�2��j4x�ӹ�AЍal ��|�6m+�l$��s߳������׳W?ފ8�Q��!�Y��9�� ���_������K>p��%H�]mS�W2���Q3��g9����?亩 2��''Fld^ 9���`�yS�ᚓ�1_9!I�Oȷc��R �ft`<h��� �d�V���~��ڲ�i�A~Ǩw�i�kRE�}v�"��k��`�,@�K? b�
Static task
static1
Behavioral task
behavioral1
Sample
58477174aaee41ad7cd48d01a66474704b42cca38a3b263c83d5e23792b21d8f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
58477174aaee41ad7cd48d01a66474704b42cca38a3b263c83d5e23792b21d8f.exe
Resource
win10v2004-20220812-en
General
-
Target
58477174aaee41ad7cd48d01a66474704b42cca38a3b263c83d5e23792b21d8f
-
Size
4.4MB
-
MD5
ac7128cd395234f87ba7a908c7e12a33
-
SHA1
17ab09fa1d449c5aa7b44a7bd0d0668ba0740ded
-
SHA256
58477174aaee41ad7cd48d01a66474704b42cca38a3b263c83d5e23792b21d8f
-
SHA512
41c40d3a671fd958d9b26817420173bc3db6fd7d02fd1a630bb8e41d8347c29f943fd38809d59136407a9dbcdd4c8e06b5ac921bda7971d5115d5184ed0d7f9b
-
SSDEEP
98304:RanImIGpQq/G31CN1mUpmhDWMmzn2wzYLOGEYKZwF:RanYpqedgmhDWMQ/U7eWF
Malware Config
Signatures
Files
-
58477174aaee41ad7cd48d01a66474704b42cca38a3b263c83d5e23792b21d8f.exe windows x86
97e6624037718a7d724dc49cfa3da0d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
getpeername
kernel32
GetOEMCP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollPos
gdi32
SetPolyFillMode
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
SHFileOperationA
ole32
CoFreeUnusedLibraries
oleaut32
VariantClear
comctl32
ImageList_Create
oledlg
ord8
wininet
DeleteUrlCacheEntry
comdlg32
GetOpenFileNameA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Exports
Exports
Sections
.text Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE