�eH4# {���;�--�3��2��O$1ۋH�Gn��&Վ[Lޮ.3���,���%Z�ۻ���c*zN0Ai�{��%�Q�j�ͅ��_���u1��� 4�wM�e��+�]�?�y�sn�6��=XvtC�Yy��ж-U7�ͯw��� �w�v�ʙǟw%�M��T<O����,���O�ȹ���St/Rңq;A%\?����e~�[i��70e�RT�H��Z`��Xt�Y�\c��M�_�r�x���LF ����Q�̢�3���U�z#�&R �Y����$��EF����v������ԙ��γ2Q���V��q]���ox�b��^�fw���T{�v�j�(%���kg����Y���zI�jD����`�H�0R"ZU��t�0'G&���]#G�}N���7q�m�����������Z� ��tp������z�u<�%�N�Ut�8=���ߑV�I<�С=��g�� �_kFl���ϖpD�%K�3n 8�,?)�]�A����D�R����HV��A���2�(G��`�~K��~���0��E���#��S��\D"��{���ۛ�9ӹ�ОK&�wL�|����=Z��Z��[��U��]2��,O:2�j��W�+�����oWg�*�� �::;�ߨ�&�)�W{�b���U���(�/��/q,��tnL�ރ�$k��$9�BJ��6`�f;Mb玲���Ϭ�!;�PEr�u�[V�2�lNcH�w�������D�uZ�i|I�:�%� �)B_��0�X~>�L3E`h7z�VaOU�Q��Ǔ9)��Ro�e*B��϶P� L� ��>"�_x-|b��ɩ��R���P����lH:ZV��t/I�Ts�p\u @�Bv��E����\��UѫBa�-��v5�,�&ޱ��Ü���NR�J��N��5�Z��r=$�|�*o���C�����gʙ3��G:y����3j���4B��@ ��xq��n�r���|���b�gyOOOR�N)��:�l1rC����pe�*�0�� �&�y� �֨%ˏ��0�08���I��u�a��4����$K�-�6���H��,D�2�Qfy�Ӌ�L�69A[>���=2�̚��J��(�3 �I�V����Ӡ�3��Fh�+ڏE(�ry�&RD�fĕaӹ� ��?���̲O�4������"t�Ժȱo�t�,J/���Q�m�'D}�%I��҂R hLn f���F*� � �<�O"��>iG��oJ�%�VJ���A�]�nh��I�����gQ��L�l�L3�{E0_��,�L�hT} ����m�R� q�eY�����<v�������K*�"-�K�ժgM��1ˤN�f����GT��������R�с��̶�����I����y��@�= N ��.��R8��l��f�{�)a@=�,��1j���[$ Cg���_�v=�m���]�_��\�mfS"ܵ_ƑH&��}�&~�f|��z�]_�}(PtԵh7NU=a_�P��J�:g�p^{|�O�b،��p5I��7���*�i� E����e����J���I2y��R���'�h�Ԣ>8�����~�n9��U�t�$&��sޒ0k���}��=�s�Xk?�?�a����F{�����r�͓y ���6�O�ܵb����A�gWɎv�H#(��y��V��Z�́��vz��Ru�)�yJ��8�(7=�w�H�����h��L���L~��@��E�<�Y���k��6���[�-a�A]otL>]��k��v��v\�qXj�e���+�}�3���-o�Ykڧ;�ݺO��Qϱح|ݿ�2��M����/�Ω� 6�v} �n�e��C:Bh����p��=����in�َn����O9q����C/J"ΙV�9; s����B�Y��}�������hc��$�]�,@=�D���>��� 1j��=S$F�m<�05[sB�<�Y��=?=q(���i$>٢��j@)Og��哋����N֯3dn�� y���w�GR]B���,�$�g�W�w���M�t7��ܾH��N7ܬ$%R��.a*C) �P��,������Hs��J&qT+&"�+�u�U���c)G��������u�ls��UAV�+�Պ{AR�d��|� B�O�7�f6۱Yܦο���l�� 8���w��<� ��6|�^�Ƹ���< t���׃�y��:(����i����_��,z��S�g����J�KդE8;>3E���Y�u�f �N^u�����=F�ݰȩ2�c�v6A�@#���j�"M9������]=��XY���P)�-�0�T�^�c۞T��_�����i�L܄��H���������hв�,�� tr���OT&��3X�y�Q�_�IK�6�M��.ճ$V��l�ѳ6��@�.��pϢ���&�����A��pAh@F��s�Y�����}yS�u�Z_*���>����L�hnE�=��� �� �BS�2�h�Y�,���,�E��Y�ַ���)K��R�$�{}m�! \o:��t�"������,���|��I��Q�ۼ7$�4�k:O�?�|�ʮ<MWm�����K6�x���&m�aa�3S�Z���tm0�(2�@�c ��'���Rh:#h�����D��\�5�k1�֤�IlU��IiV���l�H��Kg�K�l���|�<�ju��ٔw�T��4I���p�)� E�'���Ń���^/�G��R\���L��̈K>r��� LaF��@r����!� 7|�a�D�!��+�l�Y�����+3�8�\�l��"�t���N��5j���ʜ�*Ꮌ_��,�{������y�P���:�-Oq�����V0�M7V�h%�α��+��Dq]�u8�p�����ӹr����@���pr;��)�w��,Xe�9��`�@l�i5b���� 3K���A���8��[�B.ͮ�wA� kE�����-�����Z�����' �$��� �m� �bO]������,v�~5X�� Il{nO�+&�d��=����ϣ���f �2�l��|������t�g�\�ܓ�u�q 7��֘��
Static task
static1
Behavioral task
behavioral1
Sample
df5e7a803f45fbdc6592ac6e19dca18801480d89c9f4b03cebfaccf2f4ed70f6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
df5e7a803f45fbdc6592ac6e19dca18801480d89c9f4b03cebfaccf2f4ed70f6.exe
Resource
win10v2004-20221111-en
General
-
Target
df5e7a803f45fbdc6592ac6e19dca18801480d89c9f4b03cebfaccf2f4ed70f6
-
Size
1.8MB
-
MD5
50c6782e553266f9767ddf488b9f40b8
-
SHA1
3a4f6f76ffff5a89adadc4c17446775976323be1
-
SHA256
df5e7a803f45fbdc6592ac6e19dca18801480d89c9f4b03cebfaccf2f4ed70f6
-
SHA512
d955350a251c587fbd5e5326f13c0c43804eb5835f9cd1162f22868c6dbce0b92ecd77f348b2cfb3dd3db6fef071527d5f931af4ea5b8abdf435cc67ac9ae056
-
SSDEEP
24576:GorPWQHz6b9T7VGdn5/jnzeyRp7fd+CibEVEyoDUFZaHz6Hh2NEe8pVKMbuH86i:GmgbZ7Up5/ney/fd/ibEVXoDZ5KVK2
Malware Config
Signatures
Files
-
df5e7a803f45fbdc6592ac6e19dca18801480d89c9f4b03cebfaccf2f4ed70f6.exe windows x86
b5139b660af95186c88b9990464333ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiOutPrepareHeader
ws2_32
ioctlsocket
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetFileAttributesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
gdi32
CreateHatchBrush
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
CoCreateInstance
oleaut32
SysAllocString
comctl32
ImageList_DragEnter
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Hi.Chief Size: - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Hi.Chief Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ