����77�ݜ��lO���@����>1��>x�a6H{15OQi����;�����^K� �mrzu�+J�^��%�X�&*y�$��eV���C_�$:�&���|<Io��͒���Џ�p��qM��ǧ�T|�\�a �V?�ו�����e�^��ܖ���>PS��=�aֱ�g�]���k0�M8q��a��I��0���t��h�TE��D��-��u��d.2���)�B�j��!�cuI&�W�������8���\�q���t�Z�<><���W��Bt��. �{��!��QU��oպr�d�z�y\��8�D�0����w�Mm�W���> dz��Q�W������w��r�M�� +�y2Nb�I�1l�� ����>�ԏ�6 Z���u���&�lAK�")�������q��M����N�� bj*@::���3d3vQ�HE��uj�����7�V�I@�b� � �v�b_������ҕ�ϗd����|]�����QۣMc�G��;��Wr���P�=�����-"]���3]ŏ�$��ф4^S��`���)�l�L�!���F:v�T����Uz��H��v?��z�7O���Ua�� �ɥu4�efzU�������r�_c�{!Ȕ�M//�٩��T4��H�oe�l�Ќ�Ҳ�u�%�E�!Iه�$��ew�ȴt��� ���ךab��U�y�ѱ�� �1�8�ԓ(����` @�ʹ ���3���T��~ B�Y%����!�Xy�<: o����d;ņb��.�*]�1�ܸ~K��F�~n��7<õ�F[uO%��OO}���RD�/�D �_���q���وR���q�v��q�#��vP�u�����E��FSz �w!x�{���n1ڭ�d��^�z6]?�Z+�n������]`�~W�ӎ���^�,w��3W?�gA�oK��E��oN�زH��!�F����6���j{����a��j�(v����4KM�/O��0����W����1��J˒L�&Aɾ����am|�U�]�,�İ"Ş��y�՝d��.�k0�������@��9��XF�qy��������%m�r�|���)�ʛ��d#���)�z=�딏c�`�ۄ�u94��)H<s kq����u8�����:+?��b<{ E[/�ؑ�q>�'=Y�>?jp�i������AR�P[#��:(5-7�G��\*����Uav�o�g�{�`�����L����}��"ab���O�m��lX\3�1�g�)��Ty�d)�0�D�5 w�J�� Jy���W���I�r��E�96���\@�M �� ��R��)�pZ�\�@���h�� ���q8����K5���4.B�[*)�U�1��d��*��@�b4��_(����=lUy���+�&m��1}-��D���0���L3.�튧�/����f���dJ���~�w��W{���/�e�\"śr����Hn�;VOx����6�ɻ^n1:��Z��.�,��Ӏ�S5���ċ�3���/^�*趫[�e���W���~u��{IMhMp<C�A;+H��P ��nP�rV����?�t-=b��)��bt�֩�a�z���C�aZ��/�S�OBg1 ,5owv�j��jL��S�w���]{�l�ng\F+��סD��=VO��d�#e4��JXޔ�>����o���������p=j���6T�Ҳ���F���F��M�,c��B��]��Ċ����g��/�q�J)��)��aqw^�w!�8�����O��F0uTVlr���tnT4r���؍�2i��%f�LފW��C�*�<��쌆YW��#ofڒ��V߁��a6N���7R���S�[�/�7q��K3�����1���b��� ����}��V]�t���3E2{\_<���Z�jXx��/Vj�/��p���~s�'����L\�\�̶2ղm))�~=�m�e�/�ѳɔ�p�X*bء�B�\�]Av[�*��MMm`�r#q<�L���qq ��|�p����p2��@� �_�"[.[_���� ��.�6��#M�!g�R�)ϰ�*v=u����(pJ�G�C ={wΏ�H�W<�z��q�*�g��9_�Q���;D>�q�\'�I|F�,0�*3�������w����\�J�AA���p�9c���Co�5;�P0���8n���� &�H �vdd�Ͱ6-j ������ў�!#�r�%�g���lصDF���H}rY�ǮL!����Y�G��>���J���`�t#�>�M�H�#���x�q�6+�S�{�b"Iɔmd,_9���YK%�,Ce������K��M��E���S�C��:#u��@��-?������B;��a+P"�]K��ux_u���@i�/�"�Q�����23���Ҕ.���;�Rb��+7� �<�B��]��������zJw�::�������,<��^�=?}�P3��G��͊�n���,�diB\�I���Izz���YsX�%T]!�8rvԸm�;y���x&��F��sg �o�g��;L�y$�jo4�br���d#ϻ\{FB�;��\,�=�}op�Ů�g}��P�á�:��L��XN�]\�.ܞ����,�.7�0Ꜿ��_��D� �A�>���E��2l���5�쁝�=��c��U�Vy��l�a�~zc{�r�̌�_�~�Hޛ��+*��%���& ���5#"�=��`��1��:����6(`�� �q2&�da��*�"����'��;a:x�vH�u�Sy#Z��n����L͍����+p�1��dF5�����i Ojc%ΠD�c6����F�I���� �*#"r�3G�@�J[�eT��geS���y��� �?��駈����`~�WO4E�X`�_�� �-��jP� urX�!�ƺ���J���`�B������Ri1�9]�ޖ~8���G���Sr���^h�#`�~�~�b���%/��B�f��ܶ�ߖ�Ѳ����9`�.�%�9��4�W����RtK����ZL��<ׅ��]�
Static task
static1
Behavioral task
behavioral1
Sample
ae85aa83a5af4b0903a52d66ae8019e969a695401a78e281e0607b22bfc8aa71.exe
Resource
win7-20221111-en
General
-
Target
ae85aa83a5af4b0903a52d66ae8019e969a695401a78e281e0607b22bfc8aa71
-
Size
150KB
-
MD5
43d78c35ac858a021255e24999b94cce
-
SHA1
b791756bc60fd870a932d94b4b04685ddb57fc83
-
SHA256
ae85aa83a5af4b0903a52d66ae8019e969a695401a78e281e0607b22bfc8aa71
-
SHA512
b695f58ee04b2e7831f356907ab870206ee964c3de3621630fd7cbeefb185c55da9c54377bb7e2d5d9102589cc3cd5513127836677b8e98a02cc90080b47606b
-
SSDEEP
3072:K/SLlWacsRrOLL4PAPcEmti26w331dvF5st1GlL4FCOCXiHjAGzSVZy:K/atc2qkAPcFIU19F5sfGlL4FCOPHzSn
Malware Config
Signatures
Files
-
ae85aa83a5af4b0903a52d66ae8019e969a695401a78e281e0607b22bfc8aa71.exe windows x86
651d65350888f9129e9faa2ec0299fef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrlenA
lstrcmpiA
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualProtectEx
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
Sleep
SizeofResource
SetFilePointer
SetFileAttributesA
ReadProcessMemory
ReadFile
OpenProcess
LockResource
LoadResource
LoadLibraryA
GlobalFree
GetVersionExA
GetTickCount
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GetLastError
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetCurrentProcess
FreeResource
FreeLibrary
FindResourceA
FindFirstFileA
FindClose
ExitProcess
DeleteFileA
CreateRemoteThread
CreateProcessA
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
wvsprintfA
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextA
FindWindowA
EnumWindows
CharLowerA
CharUpperA
MessageBoxA
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupAccountNameA
IsValidSid
GetUserNameA
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
ConvertSidToStringSidA
CredEnumerateA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ole32
OleInitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
pstorec
PStoreCreateInstance
shell32
SHGetSpecialFolderPathA
rasapi32
RasGetEntryDialParamsA
RasEnumEntriesA
crypt32
CryptUnprotectData
Exports
Exports
Sections
CODE Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ