�_��O v�����UV�m��|��3�[�@/SU�������2$d?�f��)�a� U&�@3r�n��߿ j3Ϲ�$�������p��ԏ��KW�6{ҧ�IR�3�]�i�,���[���b��9���~��j��^e����_H;��o����XM��I�P����NI��h���yxw@�z�- ��e��Y?� �ɕ��A��lۇ�h��W����*�xʰ���BZ�����$0�ՇI֠�`3X����=��h���*:|:� �~#���\-2.>��B]����G��8��r�������I��3r1� ����{Q�l��Q\�<�|e�F=�0�I �G���gH8�+���%�=��c �.(������{N:9��w�l�I��:W�G_}zY�"lq�b�L���Hh&���E�;��7Q(�vlĕs�F����~F�4g>� ���Nk�%�F khK>��ι����M�XːR� ���v�Q�aML�|vH��\)�ET�ԌM�z0���MV���s��D�.�r���Bq`�:j�𤻝�[Oxic{}P; �l�f�������c�d�?#[���Y_����z>��G��YKK���U�PR��^����s�Y>�3̼�����s�"_xOC�ɒ\�>���.�8���b�i�&v�������bІ�t���^���3�:���Ϛ5l[t)}���0�*ŦY����耏?����k��2�>��$������n�� �b$�V=�[�c����m��r9Ӧ}�}IUa4#[6X�۪��tvⅥ���h�xt�3�&�ۡ�?l! �����Ԝq����priәΟ��������~������f��'���uŶ���u3'$z�b�]��jM}��KG��� �9��VS` �}���tI�G��̙؇�-�ۻ�f��Z�03Aϰ=m� �2���~�g��^��z���Ͷaˈ�u���-R�U{��fq���g���-ulWg���)]"zoQ��,��&*��3T��G3����%7&$`�����C�r�F���(��I �%�4���I�wو=W�|��]�u��8S,]�w��l߭��M&q�-=�N���ޠ�����Y���Ӷ�d�;��}�����g�"�$����]�Y6B���0]�M���'h|�hM���L���d�.?�S����~����� �����|��<)%E���M$1B����U�3��3 �.�Ho{�"Wx�}4ޡ�H���7A@�f-t� 8�F��H� W�eCrL&�3.E ^X]���!��\t���&AO�F7�6��j�A����'��������\��� ���ϳE]2���((#��B3�6����|� od �0�6�߶g����:c�!�MAG��`��g�2{c��>"�U�>�9�����J|��kU��۷���'�\p��^O�;yQ��m.F> �;գ�90��Nc��u\eF��8 �_�,u�QÀ��_Z!:+�"أ�u������,4��ۋ���VQJ�刈J�G͓�gS��fa0�f����Xz���A��'�6b$��ͮ� ��}XU��59NC��"x_P�ݩ7Ӯ�&�(��G)ĉ���; }������A�%��eu�Of���������1��@���{�*�i_�����^aQ����v~����k6��c~���#Y��������7�4���{�/�ν�Ed�T-�?\j�-�3Z ��3;g��7��[���� !���y{���p 5-��*Ko���r�ގ�`�f��O8.�f�k�9(k���a�=c8_��"ۘ�����yy�L��'�E�t�^7�����^/@�ڝ�-��%Y9Ɏ85���{���u,�f|��\��2:����x �0���0Z!�W�Up&�4!N�FMT7�Ǽ���B�VG~�:������|<n�+U����$2C�KͩG!����EŬֿ|�'����.��[��u?�O3�Ap�a>��0w^�C��yfE� �"f�����Te��(���?��`��BDd.t���U�1�T�_O0͕A2�e�J�kIB�������_�#�*��b�䚔R�7���{z�|����kA/=nF{3�7ɤ���^��ծh��Ȉ�41�'�Ұ�j �G�ʵ�����U=I������)l�D� 3 E�Y-oG�+�.@ec�Y�Db+��m����Q0�����%N���b`���.q��}���i�os�}a�y3�&��T�i+��[���������a0�����vg["ٺd�H�`��7fE\�,�8��b(2��$Pi!��������P��X��2���Y%�-��.���(H�֊X�e�nYѡ��a���� t���)PUʉ��\�����W�3>��,���'���Z�W���B~][���y���}X��~��\����3T>g����ʕ�{9���ʒɐq{� 6��px�Ɏ}�#}��G�Ag��`O�jCF����rD��Ґ}��*8�E)�?k�2��j�R����ᔇ���T�P�F d��݈��k9�U�=�O����a�:ȸ�1N�LwL> �`�Y,;3�Q��nRƆ�;S5F�7^�^xv�&����Q���߆��Fk����?�e�c��4��փ�i�_��\�Ӽ0��F;�?�F�����5H�%�ݮ��*��w%.s��:Ck� c��m�����`q��{�E1]�r>n�!��:?�8_þ��Τ�n ��ぅ�̀Z]���Xf�����_ vbp[����F_�m�|mn�c�j�X���I�B7�����O�:H�h�^2�V-x 8m|^���s"��fW�G� 7uO34���e�?9�E�c�YI��g�vR��OË]B�ɭ����t��d�0�m܉���0"�x��_[���V9.cf�(&�3S��0>�L�0��D<��(��&?O��w��w� �j.�8��~XVu�R#���(:&d��Q�^'gc;���Lx��&��1r�C�X�uy�B���2���lp�n2$���h�-�����R�K��C`�cD�rJ�Kն?@��;+����|.IE��Q���-{pSH���|���R�8p�S�dy%�1�
Static task
static1
Behavioral task
behavioral1
Sample
4e63d181d00478e6935dca897bd1c8a4f50cf2816d61f464bec0683046f70caa.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4e63d181d00478e6935dca897bd1c8a4f50cf2816d61f464bec0683046f70caa.exe
Resource
win10v2004-20221111-en
General
-
Target
4e63d181d00478e6935dca897bd1c8a4f50cf2816d61f464bec0683046f70caa
-
Size
5.4MB
-
MD5
0bd39673ec7721c079f29509acd6dc49
-
SHA1
55d53495c48d34154680133519d3f1508514a4e9
-
SHA256
4e63d181d00478e6935dca897bd1c8a4f50cf2816d61f464bec0683046f70caa
-
SHA512
bbe22d31ddbabc155e9d9f74e8f9f5ab4bc569039b521586ba46a3ed8814a50d5ccda839e3a31faa7565fdf46d3f951f3f4d96ae088cecdffe2b65a8685e8961
-
SSDEEP
98304:9WOEM47WulhlGSCGjrG0WMQU2g7a0qDu1Bgcxx8BCOVpT32HSzzTR0:kjBtPvrG0WMD2vWgF/rTGHSzzN
Malware Config
Signatures
Files
-
4e63d181d00478e6935dca897bd1c8a4f50cf2816d61f464bec0683046f70caa.exe windows x86
12da34f662dc64c947b5e022d90076e5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSysColorBrush
advapi32
ChangeServiceConfigA
oleaut32
SysAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
DeleteObject
ole32
CoUninitialize
comctl32
ImageList_DragLeave
winspool.drv
DocumentPropertiesA
shell32
SHFileOperationA
wininet
InternetCloseHandle
urlmon
CoInternetCreateSecurityManager
comdlg32
FindTextA
wsock32
WSAStartup
oledlg
OleUIObjectPropertiesA
crtdll
isspace
Exports
Exports
Sections
CODE Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kazgfkag Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kazgfkag Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ