��4ȥ<�G/Wޤ9g'=�8��B@S���������Lx�m����RQ=)�`��;hb��>8B�~N��ɜ�G��3��p}Ңn���w��� %،��0���1 ��6���hae��j!{I��D��Zb:Up���${_�`�O/-f�{�������?�}'�<fSMNd=��cx��\[E��T��,�X�{���c�|�5}\�KD��/[p�iA}� 3�x��%����G�l���{�>��*��?����x1��@FZ��&�+oر�Ы�����3��\�6,����-��,�yC�c��Zl� $f��;���~m������ �i��y�v�(�)�y]�k�'2k^ u�3�ːu�[��OG>���j>{n��F7V���4�2�������� ��˶y�m��35 o`�l;rtT�Hih%'�kL,�����wܨ3�Wrc��Ys��k��Jl=~�0҉M�!u^D�d��n~T�gP<՝�<Ϫ!<����C�����5�\��.M�#jG�E��.l4st�N�9�:����Y�0��k��&<>_�ReT�U7x���OG��&�ԍE�Xo�Gi9�(8�p 9:���0@�Wpj2ߪY;��J9�h"77��^��Y���o�.��d�z��1��!h7��Ќ�I@���g�o� ��_[��y�BP���yY�`�|!uC���(��٢}�*��7�e(HR˕�_�4?����-�� �s�����~�t%$�`_R�'�U�@a�eNZ��c���L��5�T;N���������9�[�xT,�B���T�7��K��:�T @�Jj7����D��$�6ò܆1!�K�n�Z�;���><�(U{�#�1��3yc��k�_<-^���z9,*]��Ϭ=��� ���R�"�>�$�:�4��p����bH��NXk����Ɩ9}�U�Ȱ��v�B�IЄHj�~�3JY���֛�Y.�b�oE�����U�y�����i��#�OC��������\���2���{k^4. p@Ђ�Rg7���F�=�Ï������s!����ř��&=X��̈́��=�;Z� Hm����B�_��E����(��I︈Vv�j��O�]&>�Dk�t�K�ͮ��*M���.�mר���=t�v���A�Tf���*5����� �2.��2*�̙Cw �7��n��]�$x����B_o��`�N@�/`nb�ڼ*&o�E�o�)���%�zs�F�q wWP= �4�Ձ(� ����/߰n�������-�P6��Z}�N۞�O��A�(��J�,�����y^O}߇ޢJ��ҎDU��E�.����.V�]� �A�]r�̫Kn�s��+u>�"z�P1%��;Ӱ3��� v�Ɗ�H<�����cbAUI��l�J��O` ���r,"U#T[����`�����}_iN6��K����w�7�,-����צ�>��� hB��:��zK��v8~� ۊRM�s���{B^�Y��=�o-$?��Yk�3^������uo�\��������a�=]��~��SA�̎������G�F�ȫ��5�6-���H)ƽ#��m�D��u%$�BQ�L�ib@#m�����Ě2�Q1?��ѯ�W-�gf�Cy��������[�`'}�������� �W��1��=frܛ�RF��vaZ+�lp�f�-$�\R[�Ǒ��Jc���\{��p��T4�O����gZ�^A_O�^���%1A�aWk��v��c�u�Cq�~S�� �O@���d=���}��9&��"E�ļ�����U��O��%@0�1�z�zz`���[*��S rB�R�_Ū1��4{������[Iom��v_��I)���}�:K1�h�̀�C�E8yNE��'3z� ��d-KTLy�yv���#'��<�S�~�׆SE�����l%��b��J��~���h�w�L6��i���0Ϗ��N����6��g��:�b%��ӯ�Q��oYqi��Op�_"D<x�E�F'D��V�jQpRIK���w�s�u���ɂj#5�J(f��>��J��pm=MBNg,�g:�1�l1Qu-]?0���yY�`zbT;x�ϞRdy��r�1u#w���ݨ�ţ)�T0 �Q�7[��x���r��X���s�4}��D`���mq'�u����=Y8[���Ι�Y��ކ��z����G�Hm�j��|]���!ve��$~dƿ����{k7���8����H[O�n��=���Ȝ���������G�����&���}선3�h=y0e���`�ެ�Y�z��G,%�륺 o�!/�B�1�R�#<e��y#v9�g�noن^]��4>?k��!P��ʅ 4��������H?ؘ���1#����h`g�.��x�p�:J�h��Nψ���&{���I���W7��k&��b�,V9BM8J��T��-�)j��yts@_/[m}��t��,R���ꂈ"�u�m�g���*Ri�����SB=��Q KCr�VBWޅ�E٦�#�V��MZ����y�+f�ϐ߀�1Vn%I�˾�Vi�f���#�D��x��Ӥc���P��Q�'��;a��`bl ����ge�SWg�\\Ǵc���J|᭪y�u��X*p�z�=P�i��Ҩy��s�l�a�_qnl��)�x���t�1��Nj{�����"�)Py����y�H�*h}U�\�i�y=���c5��O�����8���iMA�8�v���6�X���耶��"�=<�q��P�{Y�q�`�AQ� ��5�������H�@i��F��j+�Y��ea�m�vJ�v DԹp��b��k�+�EmF���W�e��a���^���AD�:j��w�,�wQ-{�²���A�m:��/��g#I�n0^��ߔ HW�k��_<�����#t�����v����>�hP�d�����%cFO�/�����-�38J�%�]3�EaU=���8���|q1N-��/��*��W^ru)�������)�r��+��w>�����p=�����N�X5��"R?� ���
Static task
static1
Behavioral task
behavioral1
Sample
cdad04b4240f49097350ba787b23967cb6eebfb4dfe1c71f2398ed798fcfdf2d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cdad04b4240f49097350ba787b23967cb6eebfb4dfe1c71f2398ed798fcfdf2d.exe
Resource
win10v2004-20220901-en
General
-
Target
cdad04b4240f49097350ba787b23967cb6eebfb4dfe1c71f2398ed798fcfdf2d
-
Size
991KB
-
MD5
9ab93d1068cee206fcba6e3ff009e705
-
SHA1
c715938330cb99e87979e9cf558ae2afc73446f1
-
SHA256
cdad04b4240f49097350ba787b23967cb6eebfb4dfe1c71f2398ed798fcfdf2d
-
SHA512
912d571e9a236cd7aca6e799602b1c97e487e8a63c73d0e28b82ec2758a02cd88009f158079ea3ae3d9ab8769a931cf9e4ed91e3c24dff97ef85ab60df38c233
-
SSDEEP
24576:d7e1FBeqGqVTAmQfubSeQhpgyY3imLgWWcGMM1o4nDyuxnAE58IR:MoqGqVQfaS9q51M1o4DnAE58
Malware Config
Signatures
Files
-
cdad04b4240f49097350ba787b23967cb6eebfb4dfe1c71f2398ed798fcfdf2d.exe windows x86
7010a8718734b47d679433445693ec43
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
MessageBoxA
kernel32
GetACP
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
gdi32
UnrealizeObject
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
mdll
setnc
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 308KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 982KB - Virtual size: 981KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ