ʄoz�T���c��|aG����Nvn����8��S�G�Z�qC���{[��Уw�`�|�<pS������ŧK�;�-1��@ys��'h#b#V2<�>o��������;D8�YPG�]�z�� lZ���f�3$Lp�ݸ��吖�Om���������1~n�l���%j���lPI�J����>��*�0�g�X�� ��Ǐo5�����Iu+<���ks�F �@(2�o2W�I����ƽ��>8�=���� �+K�,I�ca�Vs�&5��mK�!hJz#�4 ���U��4����3a��!7�?�~H��l41�p*!�7q���-��{��\�� S/I��>�0������ ���*�5Kq����J��N�\�Z�-�/�1t��f��6��fW�Tm8�����%�X��-ģ�D����e�ՠ}C�M힀���� �X-Q����;���@���,0�����Xo ֻ&z��Ћzfax��.���&��P�0�J��[��"Dק֫���s;��ܟ�c=����/`Ї��l������|��W�6B%���Qṕ��U�\�e`*�!5��7����8#';s��G�Um��E��3̏��fQfB[�9Rhu |��CPT�UX3K�g9��7���h���� ~�Z<��FC��A!�*T�d-C�Xx9�E�ި�` �~��m#5�R�bQ�2�H�VP����m��}(��%t��\����VG�0���0ؓ��*5�h[���� 3J&�3���nT� Ӳ@�xk��l�� o�L�!�O�jKnו�.�'�A�����2�>Tt��\Qc�`�:Hӂ������$�oOx@k�~&�]��6�}� �ƨ���bC� ��A=d��vu�� ����o��i��^��������wI2�ˋ&�ǂA"@0�q�F��ʫ#|I[���$�m��C�K�Kv�+0���9��j��Zi��h�6U̿�b���k��u� $�]�0#����5���a���F � ���v�hO�$Q\MQ����L3F�7R��7�w�))D�8v�d�����rV�� �V �u��Ŭ����u���.`I�b8�b@ ������-�%�� ���Ě�Ɉ9��aє��M҃?H[kn� 5�oS��W÷Q��ѡ��t��D@�U�(pV,D/�@��J�>�o������WW*Mi=�o6v�J�.֨��B���#5>��doT���0���3�%�*D=�7�6����=;��p �z�6VY���?Se��K���� ����}P R�R��%!'���=3�7l���� *��D������x�2;$�l���\�*�����G2~��0� ���L3U��L���h����z����h4�gS}��QKXF@�U�{�W š�!Xab�Ĵb W%��H"禥N���f�0��&-6O~kv�{�Rp =\yTo$��a¬�;Yaʼ4ݝ?�<!���;� ���̒�Dn������ш�/��N��=� �c�����R,ZS�`Ę���\`,]�\b����*�rA������'8K�k�Mx�ɸ� ��~Ċ���U����mЂ�|�r���mK7�����}��Rŀ�&2�R5�~�� ��1��R^W�,љ��<�X?��R@ gq�7���3��bt��?�CE`���~7�"���k�1o�czf�2���g��\J�{�Hٕ�^�h����rJ-��ǰ��.d��DX ��@~9I|�L����<Z�]���~��,$1��a�9y�n���v�S���Xb���7��0׆�i�0� ˗4�qS�t0����$�}�? ��n�4��j��E��ɜ����j5P�}dxBD���v!�V�>� ��=�9��p�_�`FM+�^�;y�%PV����J�� 7�:ꮥ�N� ��!�}AoQ�������M7o~�:��+7)�_�s%2Ob�\� G�6���,�u~c+�wY��e�^��y��7w�y�+�z��_�������Iqe��Vh�����v��7 �(}�R�� ���q���)��� U��f΄|"��tgȋbW�w��S}͡�t�J����;��m֪�y�9@�jfu����3�\�/�;�����eq�g����o;����,c+��"���^��R�jE����)��;x1��(�ɼ��������:�߲)�E�Sb��V�KG�38�����U`Y�Be��HR*״�tU;�\%�<T�wZ����긘J�3�=�R�H;|58�:dž!���_�3�ny�(9��f.cH8�{�����,�%(�*U�v�A�]CS���?������~����/t�� N%7�z�*�v8b�Mv�_�(�����M�5J�@I%�w���4#��ou��~���P���b�yU���[ �N���۩p$~��5� �1�����Sa��Q �4���~��J�}v����0����w��N��F!�0��P=ՂJ*Aϻ}�n�yE��'P=�:م��[��`P~Q�Bc��vh��VX?W r�Ը��� Hg/@�w a��u�C�ȶ@�+��~8�m��*��i��*!��&' L�4�U���`NܛWͺp�P���<ق \�6r�D2��À�ӎf����5�F�^�{�""��H���Y���*�M\*�$��lo� t��<g:��&�:u���oͧ��6��W�1�<.��K��ć\�ֽ���vߴ�Q8���d�n�D���*�qz*�|�{�ފ�ml��xz��q�Z�W]�������Nl�C������8�QR�eŲ�ܻT8��dW�/#�@�JF�H>�&D\Nf -�cXi��(FY��w��0;��.qAV��{^������b;�7Z�ʹ���X�T�{��@���K��pN��?���% ����b���쏘�u��A����lz|���>�և�vMA������,+3o��G���#O�l�����-N;|`[���3��6�& dL�Dۄ�����z�ӑg ǐ��_��Z�MGW��I7y)�����~{@EċG�Xr�s!I�����$�i�6��2-~=3[�"K
Static task
static1
Behavioral task
behavioral1
Sample
13d5eb19fe1cdb4854b09ad78bb530fe49bd011e1d3e5b44ea2d117d6a90ea98.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
13d5eb19fe1cdb4854b09ad78bb530fe49bd011e1d3e5b44ea2d117d6a90ea98.exe
Resource
win10v2004-20221111-en
General
-
Target
13d5eb19fe1cdb4854b09ad78bb530fe49bd011e1d3e5b44ea2d117d6a90ea98
-
Size
2.6MB
-
MD5
21669f7cd764903708c619570833b73e
-
SHA1
00176c5faba08ab8cc23742667fe2a76dfc68ace
-
SHA256
13d5eb19fe1cdb4854b09ad78bb530fe49bd011e1d3e5b44ea2d117d6a90ea98
-
SHA512
a08ecad608fe4e4591d0ec34b4afa9df92d5d1a827dcd5c5f43995234872dec1a394db0b87ebbcfea0a4f150aec8cea98874eeae26729054e1e07fa805498521
-
SSDEEP
49152:ghXaNWvIHqlpls5wgKP0yht4MwbIOjDStVY0vEgxTm:glaN4lANfyhtYVStG0cZ
Malware Config
Signatures
Files
-
13d5eb19fe1cdb4854b09ad78bb530fe49bd011e1d3e5b44ea2d117d6a90ea98.exe windows x86
97c0896779481af8ffa81eb15427f869
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemFree
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
comdlg32
GetOpenFileNameA
winmm
mciSendCommandA
Exports
Exports
Sections
CODE Size: 970KB - Virtual size: 970KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 13KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 362KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ