�ͮ�G%�����Fc����4��Ȧ� ��������Y{Ugdc��݇)��0[�g����b��cp���5��ϕ=�RR�(�g�X�K�����/�ԋf��A��}g�����v/�:�z�v�<��o�Dر[C��3�W��>��c1�:w�o[���6/:������p�a�S,����8���~����z���5���[���'QA7���Vϯ�` s{}D�f�)� �Ň#?�:al3MVn(�dK ��祋r7�x�K{�d �p4Y�(����( ��͘��V��H*+����o5�[ca������H���{�ACQ��"��E������s%�[0LE��G�@�D�[D��R�0���Xoj'�V*��Q�����b&�k/�m0|t��Ƣ�P�(�㻞s��CcyC�>#.ی�*詎g!����4����Yjv �@mUl��U������e��K��Cf�t�M�m��;��M�4?�7�k?�6_������^M8@���f�7���J0�(?^�aU���\)�L�"�4w�M��y=�?{��ү�ክ�߄�ؿ~m{�����brn���0N�TY�8�Ҽ'�������_o�H)�.(���rɑ���߳ڔ���H�-<9����� ˩��id}�J�'��`G���� D�DW�T��}a$�^���l���V�%�U�:�\N�� ������<e��E�d�xP�}����h���O�bih*��&;c�5�]�S� �l���V�O��<���}K�+���hg���=��L��+��%�����{�A#��W�f_�O�N�x��To�U��i�|zi}�\�#��_�F$k�`��������m �����5+�]����/��`J߬t�U��]M-�it�u�o��w��^l����(�6���H������D�z���7��ڃq�P:�<f?��i�mz�3IΈS|r��������`5�{Y�]��1�Q�EcM�^`�����sUlXԂ�+��NZ�/>�����������eƾH��2��S�}��ʐz����UYx�j����Ԝh�+�"���<�_os��l�hxG��i��t��w��a� X��J���ĩ�d8�y#�$��$��Z��`���S<������r�~ܠ{��XU���f0(�:��6U]���ݔ/L ��F�O�H��f;l{�!���/J���A�&� I⠰R�@�h�AX�v�� *;��IX�[ذ�D��ǐ�_�����ً'��z��0}Y� �]L&q����ѐ��\} 0q��A�&����!"�#�i�pw��C�p�L�B�_8��� É���ۦ�m���{�����y�MEm���^�['��sJْ�f���#���º��J�n�m��_A41�����J��1�G�}YNg������Q���͊ :�sq�EnB�A�Y��˵�WiiT��[�$������P��u���,�(�D��d駇C�=>����S���$��<���Z �\�O�Q���5�q��Ge��CR�s3��7 ���U���{�M�>����l�]%e�O��K��[C��^2�G8�>�8>�@5��Qk��� i��� ���b��R��v�G�^��3/���]�u��s��M�;��Z�H����R���_%�����(��U?��@B� r�� K~�� ��I���VƐ���U�� H��~���9}���c8�ƠD{��=��y�3$j=� R}�����N��"jޙ:�������V�LИR���wަw�RK�ʼ�;��H�_y�=�B�s]u5��Y�U�CBC�e���+����Ĕc���'&�zc�Ns���&�qZ����9���B��Xyk��X^���*�w^�e �&�5ߖ&Ǣ|VF.�imqӻ�Iی�z�8�o�vR%�?;�0��a��-�%��%� � �W�%�b�����L��4��P[;�Chu�9#�{'O�Ě%���!*�[�G��[�x<?���|�pÏ�+8���/J@�CEZy�O����0fٷ�s�97#�'���p�� ���ց�Z�Yb6��5�p����`� �� �'�30���d�b�0]����VN����s9ǷE���;?�B[A���zŏe�����I�?":Q9MZ���F�n���tC#��f�X��G}$ʊ(2s3ީL�tSk�cs/�5X�|I�Z"�G�*�v Iv|M �`,��ٿ�� QA/��O������ ���&�̵�Z�\t�g,�9��4�>��� �4bT����ݏ��Բ�LU`�C�D���d�p2����BPh�>卺��@"��!�����М�Xֶ 7�}cW���TY �kВ[��̦�"����{8A{x��D��dx�圥C:�9O���J�<\������Z�x��Ozoy�_9#�bWҊ���`bM=�[�k<͓`Ւ��/���F��,��vn[{�LN9�Ww:㿏@3��%r�l1EU�ƞ��g�#8i���W!߾�<�`QTq���L!����zXX��:�4L!4�o�h,��x���D��l��n���N���Y���!���h�n��H��pz=�¶�����A���K)��Gl�4uXg��h�����.��[��/H��'�G�2�cC��K�{����=y��5��4PF;�<�ui�����!�����nn����vҠW�+��-5x�ɀ6KyuH!�H�� �d?+s��'�tD��tT��>뤼j��I��)�-rF��>�NJ,}e]�����C�Ǜ�H���{~$��I�JI��^�p+�%Q���8P�_!g��L!�)"~�8��9� ���<�7�����z��Ϫ�*L�����8ܳ������:L���q���r���g� �vU��u�4R2����ĸQ_�Sn�281s���$$��L<|�Q�64x _�ߡ�ҍ��y`�Z�i2.AGz1�2����ډF��������:���0��������@�b]�+�6j�aI�, �P%ߖ)N���QZX(��B���s�Ԑ���Ͻ�������G+�fǎ�Fi�.�*�?6IQ��n+��r'<VF��y}�\
Static task
static1
Behavioral task
behavioral1
Sample
5b0b583be5e8519a201c2dfbeb7f78de1b6650f4553edf69fc571ad181c2ae64.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5b0b583be5e8519a201c2dfbeb7f78de1b6650f4553edf69fc571ad181c2ae64.exe
Resource
win10v2004-20221111-en
General
-
Target
5b0b583be5e8519a201c2dfbeb7f78de1b6650f4553edf69fc571ad181c2ae64
-
Size
1.1MB
-
MD5
e36b63d6c4f4e282ecfebc2d87502d2b
-
SHA1
137721b145599d4ee6e7c525485d69f8293c7f98
-
SHA256
5b0b583be5e8519a201c2dfbeb7f78de1b6650f4553edf69fc571ad181c2ae64
-
SHA512
a87132bd48dbda4e10a450058166e26247cc5f1e1b8a031249da39367b01e13f2a619d48d5420da597b66c4b99691b9dae5bf4921f8f5aa846b81de588b7440c
-
SSDEEP
12288:gWhNr1phuidzSNPRsOT/UyWFY3Hie2qxdYK9S3BCWbHnSg/2kUxETd9azfsKjj9Y:Dh/elKOmM6qx+9HSIqzfs2j90Dn3lwY
Malware Config
Signatures
Files
-
5b0b583be5e8519a201c2dfbeb7f78de1b6650f4553edf69fc571ad181c2ae64.exe windows x86
b4917b66902557c44880b0b492f4fd8d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegFlushKey
user32
WaitMessage
MessageBoxA
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetEnhMetaFileDescriptionA
version
GetFileVersionInfoA
ole32
OleDraw
comctl32
ImageList_EndDrag
iphlpapi
GetIfTable
Exports
Exports
Sections
.text Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ