\��jW�w������턴�Ȫ��|d�8�(�V�6����ur�<���?ǟΘϩ�G�.r�o�;%��6��DwG�� �� �XW�9sB}�#��J$��%~4"H��5!g���8oV�� �7=�8��Q�4`��KE��E��ok0��M������c��=���+��=�P?sS�� ;�|ȡ~� �Τ���A�fhL��Q�RG�o��j�!܂�Î�NM�$�M.j#k��F�gG�'�l�e�y_)�v-���^y&�����n00l��-`�*c\\���zΑ�����y�o25{ �v����6��&����2�u�dr�Y�j�Ȥ2�D�èXᖡ�M2q�j��'�O!��H���њ���Y7��c؎�iy$����G��4�B `�'���Iw������*O�I����B��z�>x���)�Eo8��KՒ�ᘶչ��:Z���Hs�~2wdf�+�\ʤ��م��NK֛3�b>��.����_�;�#�w��4�g����vϖ2ʇ3����ׄϷ�JG�������ȍs��ۙYm�i��K_L?UR*�l�+o�*�f}���Y���U�_��r_�͂ ��t�@��h `������ᯨ�*88�\�Ӱ4�>B����K��ܴz� `��+:,��, |} �P�/BfH�Y)�([p�Md��s���G���mи��3@��������A_lr��H,R$zB�@ �,3�����1Z��j2M_�g/�a�z9V�����Lq���4fh��k����6�ܙD�.�qH����L�س" r¡�y�SιӖM*߃����Šp��Wn���_������` D�w��K�R����VUk ��v�ե|~0�n*���J��֨�E� N�x&#����R���'���p<L��ᘷ}� g�S���I�.��9�j�[y� �XC�<mVy� �k~�H�*r�v[bt��ay�&]UA�<}�����A`ւsE�N�P@���N���¶�y|��*,�Im�4�ơN:�#:�=��� �L�ɰK>�ͫ�ujqۺ�9WF� ��QE�.�ΙK#��VL�*B��J>&��%(��^���%~4� ��gb���G�^\K����������g�l��q���z�h�Y/��kt��b�c�-',LT�I1�`��ċޙ����H�*!^��*c$콫�-�j,��Q��1��i�8�$�FmN9�J#I��a�{�8�-�V ?GS���#jti��H�Լ N�W6�� W�$3=5$3�ODm�"�D#�`���K�6�ౄs-����� gZ���s���a&8��4�/0�c�B�i��Z��:"�'�S��� V�ׇ���<��棿"�#�֯�����-���O���<�wCx�~�S�.w|�!�+\�b��u�Ϡ�q��i�:R �5��<�z�r�|L��s�FMJ �NT�t>o���CP{2��Fjw����e����7��*c t(��W �憅vr䃧!���/�ۍG�>�k��o?��|�-l�S�vp4V����X4q�52Q�0~3�-i��N�6��ƕ�]GJ����WG�����r^m���;�C��l��p���� Oc�/��2����fc�Ym������zǿ@��� sj��"��][:��� >�*d��V����:����QV�H�)�0`�V�A��Y�!*���U������@x6��[�W��̜:&>ޞ�X>����C4635������v�}���@X!g�06��ۭ�^؝�S���.���rQ�"��Cfڿ�>Z-�h[��0R'Ca[�r�{� �����#��-]��G�Rn��l��������Nn����5��]S]d^���܄a[Lwt��vH�2ʴ>�9ޘ���{ᓞ�כ��"��4[���[��-_6i�=(�X�A~��];�5*��)m���I�[+>b$ �>d�t��}�'� ^�!@�u�Q4���˻��u������@@������r��o�]���ԝ��!��(��9�p�f�p��� `߿#��Ⱥh�C�����jLl�acF�V��E�Uե~��֮�8;�^�,�����I�&y#^=��u�jv��<�gŢ����)-����u��Z'h�K�GE� H�\���YϏ%�P6��*�Y��5�1Aq���d�m2q�jtǷ�_��͆�-�m����<�w���\���%".#{ayfO @��h����k�j�m��?B�NU9,r��U�k�>���)�F �sC��/�>t��qbMlq�5T����/��#��j�ޮ٧Y��I�L!���F�o���U����<�C��d)�?�N�53_vYW����a*6��PKРj<9t�3�~tJm��b���x_��.�Y�T�i�N㭾�s��](2�H!{b���,Ʉ�[J��T��L��bcT��ü�N���y�a��y%��{+���ȶ -��l�o;��4ܦq �:*�gO�7�nQڇ�B�������3�F8����e-�;���}h}��~Jט�e!'��}:�)���v*(Bd�mŘ��������+ݧ�E|q�'�U��|�oH]�c (���ǘ��w���� }�b+��J[�����h,���xh��q���r�ړH=�:���M�}-�3aU�5+-D�t�~mNg�a�Y&�����[�ɛ���nL�����j�X�J�G�1���' DvZ�9�C�ڀ F6��Q~+h��R���8zڜcfu�.��#5�^[�ur��ُ˷CD�A��֣��z��83��u���;�$�)�|��<�YKuv7�>H���X)�c1�(G%)��>���]�v��k���0.��)�~t���v��XX��v���}oz�c���0nO>��gC�/~A���"1JB�|�0�B�zp�O��7�-ͯ�Շ��0�)�$���+r��k�*��/����ر�!7�5�H6P�F�y�>��M+�w��_�c�-8G�����,r�?�%�̟��i����= qV9q����c���"EV�95m��!�V��D�\{`�R��Q���O#�! 슴
Behavioral task
behavioral1
Sample
e4f13e00127f991acea67c51a68fedcea50fb64c049b9887796d1871bd5bf336.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e4f13e00127f991acea67c51a68fedcea50fb64c049b9887796d1871bd5bf336.exe
Resource
win10v2004-20220812-en
General
-
Target
e4f13e00127f991acea67c51a68fedcea50fb64c049b9887796d1871bd5bf336
-
Size
775KB
-
MD5
13b45c754f31df34c1fab72e9cfebd04
-
SHA1
bde6a93c38a8e7b6ecd1dda403551c6567ab9abf
-
SHA256
e4f13e00127f991acea67c51a68fedcea50fb64c049b9887796d1871bd5bf336
-
SHA512
6224f0a230c6c4b7813817795d0ba2d4d2a08e0794841f2deaa5d4d7ef5f2be595574b15db131d5ef7f240655021244c4699050fe367f3c36158ede5b39d200b
-
SSDEEP
24576:a7sXgg/jtHO8zcZXyAviZrerTI6vKm3U:a4Xgg/jtugcZCA6ZrerTBvKq
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
e4f13e00127f991acea67c51a68fedcea50fb64c049b9887796d1871bd5bf336.exe windows x86
476aaa74f300b3feb4d240746a698edb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCommandLineA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FillRect
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
VariantCopy
mpr
WNetGetUserA
version
GetFileVersionInfoA
gdi32
GetPaletteEntries
comctl32
ImageList_Read
shell32
ShellExecuteA
wininet
InternetReadFile
wsock32
getsockname
winmm
SendDriverMessage
avicap32
capGetDriverDescriptionA
msacm32
acmDriverDetailsA
ws2_32
WSAIoctl
Exports
Exports
Sections
CODE Size: - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 35B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 6KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX3 Size: 735KB - Virtual size: 734KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ