Q�첛鎵&����v��U���z<B���������gw;7�N����;@�����<����-ÝD35��s�;��Z�D��8��\�0@��F4��M�"��f Q:�����"{�Gπ�`w�G*-�V�u|���X�@�Շ)��S�0k�<Ayn�m�OP!e���'9��O,L��]eRK���woa���:�� �J���y��QO��N%"�4��2>D���{ ��D�a��I�����ҦGK(���-fdD��� U�؇��³Wf��hwi�ؼ�E���vYr�����!#��C�Q���o����t�"��_]AɎ`e���{YF����f�Sp�&_S}4�WV��ܛ�o=jYr����)&�J�À�<uy���S�4@�K������`cCO�9��˃{~��$9O���pt�tMK��]�!~~�u������x2/�?;�24������}mT���"�lB��l{��j��ܺ��%�-Xi���f��s���pyUL8�/ &��z�3>��?��l�B��u�~�@E��s.�"�d~ i�G��߁Z��t�^b�N��)�\z�E�ľ���0�?�k�W�9CdwLR�0lY�A/N������Q�Q:˺���K��@?|�s3�QL�2�����Vs mŤ�;�����ɟH9:��m�+����#S�`������$<hO�l�ߨ-p���43����1~3^�'7f² 5D�{%�-1�"�Űa��w�_����V�7Q{iv N� ��VI��k�������rtފe��U�Ӳ1�@A��p�����'��.N�%e�A��B=��N����h{�z Gs�İ�}El��i8��F���!�jQ�?}��Ƈ�da�-=�Nޮv8p&�ae��6�oc��(ڠ����1:>�!Ƶw�9�L�գ�tv��|�"�}|�����|/���"H��OX��&��F���/�K��˨|��7����A�Ej"R���"bBK�R��P@�C'B��|�Be�����~�f&b��=!02)����i�[H79A�`L��/�2�x��[ʯ�g��)|����R��}e\q� ���-Ʉ���#�� �ɳ���.?��H)��<i(�+��7�i8�H��n�s���}(PW[J1�N.|�kL1[B�X�J/b�0����<r�zߣ@Dg����l`�F��E�w!}���}r��0\������;�:�E�9����e�?�n��$��;�Jը5ܡ+�l�t_͉f,�j�\�V"y�V#�� $h����C��B�������Ar��0�6h�0u����j�� eR��G�"^;>���m��L��{���%����p_u斯�,9��Y��/��]J�/��\W㭀%[�q(�=;V���Y�cX��%�O4��@wżV��3X�[*�� �4���V��&_N����N��yD��l�c���.{��8^�l���/�*���Tŗ���z{��I�-*Ζ�N��R�K�O�X��N�HQ/֜�l�VY]��"�N\��fu��^��7�q�Ј���I���x�"��:Q|�����q��IP ez��r�4���IH��T;�]�f� ���'����tk�Jh�����+�H��4�u7������A��@�i k�2�gx[-̬�*�C��37���>��Ab�U_T8�U��0>�=��Ú�d�m�[*4@���-x���� S��7��U��maPF��;U&ۑ;���A&@߀"3D��E ���.>%���l$�E���s:S��1�<:l�-a�ڀ�$kt�H��x���g"�@��P,��o���+U��ƚ��ޔ�;��m{��G��3I���� J] ��!?mA\��� �_s3��gQ�[� P���pN/����s|�h� yjIѽ�7�-1H�tG a�i\铃�Mq��1��P��];oc���8�\��rLE>��4�z�p$�V}<X˩fބ��a#���-��!�]P�%X;�"��P�uHCB�ӴO��5,F�!��_{U��8�e!��I��S����V�&�;�V=��x�|�",�V�B_������ϳ ș�H~_�I��OX���(9�bc���S&�QC�mp����m@kt9J~�!$��)�R����K�Ż����9���{(� �5��cdC�(%���nm:4<�],� (Ur�6��[�����K��x�����K��M�mE!2<�\�cӑ�N>Ռ|[~���D!�Y�T=,���a{�[wqct��7P��>�Ʌ����Vr��xԌ�䷗�`Y�H��-(+;��Z�CS�<�a#hי=ԧ��P���/�ЄZʾ�O�V&%��y�!� �d��w�A�A��I��^�������m�?��E���f��d�O��ʾQ�J���}T����?2���e�N��}�R�1�ә�ַ@%���p�h�T��^0��莨V��)}ױ�J����y8��U����V�C(#�-*��q�u�3{X�Q���@�$�ᑠ�C]Z���K��;�F�t�� 1�5���N���O���9'~�p�$0e<f`��'����`��ؤM���=GK�|�� Iz��&\�V�_��;���k�ϭy���:1]�)�y�9}6�`s��PO���#\�C)�'.X��9֞㹃������3)�=����N�v�I�X��R��������%s/��:�02Fh�n�%Z�C���o�H��VK���Q�\��2�� �X�@{S�A��=���~0wx ��+w�e�J��]��>]Cuex�^F{�#<ڊ�ϦĜ�g�����{�&�̗�P��� �C��*w)�ft�e���ߨ���Ls)��\juQ'�`�v�"'�����Eo�S��'s.�*��� B��H.:�%�)�?��K�e����5)��ɜ���U�ϡ���������=�#Yw5W{�aFMa��i�)/HO�w�*��F�hTŞ�2��6X�A�J���p�8&�h�9n ����H:E�+�l��̓�o/�K5o4�����^��M��mz& �S���tzuD��+�pH!�
Static task
static1
Behavioral task
behavioral1
Sample
800d36b621313a8b5ec4da88d5bc5ca273331d09058bf583d2b23bb6fdd3d9a9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
800d36b621313a8b5ec4da88d5bc5ca273331d09058bf583d2b23bb6fdd3d9a9.exe
Resource
win10v2004-20221111-en
General
-
Target
800d36b621313a8b5ec4da88d5bc5ca273331d09058bf583d2b23bb6fdd3d9a9
-
Size
4.0MB
-
MD5
2df1cc60a643ac34dd96e4ee7d4167d7
-
SHA1
4fee9d3af9109b412a48ffedde91bfcdd0dbc280
-
SHA256
800d36b621313a8b5ec4da88d5bc5ca273331d09058bf583d2b23bb6fdd3d9a9
-
SHA512
67868db19d60f376bad90116e0db1ae3cc22d61d0f508d4b853cbd2ec85ce42d5529bac19f6757a3aa7baf989c4beddbd56d4504b9f0a51a4151ba67252d13a8
-
SSDEEP
98304:dArKB7FzjcFYBbORhSYhvozPc+KZB1VAVdT:dArKtYhQ4sdT
Malware Config
Signatures
Files
-
800d36b621313a8b5ec4da88d5bc5ca273331d09058bf583d2b23bb6fdd3d9a9.exe windows x86
c9d8c27d2745d114589c0411458d63dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadKeyboardLayoutA
advapi32
RegCloseKey
oleaut32
SafeArrayCreate
version
VerQueryValueA
gdi32
CreateDIBSection
comctl32
ImageList_SetBkColor
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
msvcrt
iscntrl
Exports
Exports
Sections
CODE Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ