�:���y]��|�!���h1Ac(� ��vk�RA1~<��x4��q&�B���[Z�O.W���N�������,�wr��>��Bk]����y��u��c38(��.4F���\�㼄��Z}��KU�����a�]ǪǠ�#,Ȟ��%x���cb�kkF ً�D�F<�(x��4��hc�}퇃 t�=��,� !?S?�KP�6�8����6Ȃ��Q�V��3q(@xPp���8��I�����PJ��i��"����r��& �eG�g��s���X��0g k��ʁ���tة��n�&)�,^ ����mY<���X�hM��N���J�����Bl��*��h.H�V������Eˏ ��bL��a&�P��bߏti�}�|�9o:�[�j�j�h�ziJ�" Y|НsXE�tЙ �L���8Oȅ�1b��'��i�I���;����Q���� ��C6"$�,%���S$��* ج�a��a���0 T�e"?�7��3����{���~[�S���Pr̹���q�ܝ��|���@E�<=<��<I��t�����V^*����]�T�;�1������,��+6�:���~�, w�gNVu�я�Տ�=lX�G�a�H����(u� C�풗|��}�"a�o�ƈ�KG[�]�#�qxۿ�(-�@L�És��^���1��\�,v�q�7K�]�_2�D���t�d_6v��ѕ�����Ϋ���it%a�Ke���Z����e"���u �ا�������iNe��C�C���Kc�*�X-�b��H4��y�W=�Lh�tX�N��:��hc�i 7F��5���>�ty:帼��Gϋ�t�9"���>�G)���ȍ7 ���8ph@�1�%����L��Zj�,�4ܣZ�X�ܮ�����7�~�3ǫ2sN��Th��-����X� s���7�N�[�\)�/D6;?uۈ0����y<uLeO�T��֖P���{ى��`C�z�;�g�b� /`�r(�dd3�,��p~C��3-�EFL��.J���U�_�Z�r�?[U .��j\Or��w0FW��z��F�ے��=��x�MR�p�1�*�p�C3��b{�u�@���q������[rt- v�#D``��������0�('c�^g�����Y�v����,wQL��#���n��jC��Z`o��#�C��iԀ]+��ݳDv����������{�$F@-�:kf��0�Hϵ���; �SoF����_���+�kQ<ݥ����+����q���wt�uJǫ ���8���ׇ��K����J9_�����]��yӌ��>�挒w�a�� ��W�kΊz�����3���8�1>oe�DZ�dr���W{gN< ���S�AhR���E�^����M�s���8��spI�W���R����PO�(-~�B�G�f�e:� 0;�R�e�x�슮� c� ���y��"��1��8up���r����Fl�^1�L���_��;�~[8�̮cd���zR~�D�wP.�8#~�Ĭj���#g���pk�{B��ӆ(g���:j �U)���S���]6sp�K�τ�@�����rS-֮܌�/���rù�9��d2S�g�Q;)E�ӏ^2�F��_�kjz|�i.6��P G]Ha��b��Z;���G{Nh%Q۽��H�G"�W�eA}������5����W�u@b�e3��n��[���a�1�y�� ��g�[{��p�!�"����XV�/p�"���b6.��׃XC=&jƏTW���_N�� ��Ɇ�r.0@����ȓ�K�\?��.��X���T4��bQ�@�=�,@�qryܭ)�31���(��b0��T"���wbRy��������+l��n�'��Kգ9<n��f�D�����i������q���9���Ø�d0(s�-�U�W�9s?��M��FT�m�02���>�PB��t`ո� 2n���nJSꌖ������e�*�����֪^�j�'�u�q��UB��P��P�s�pd;0�6�\m �UlL�F��. _i���[?�=���j.�LW`���~��Pe�W���Oڹ�ei�T�$�;�Q�>3�����9Ȗ�c�����і�Y�ټ �<�;���2�m��-��b|�IG=t�AU�,���}��`q�C���#7���&�s ��"-����>۽��Q�����eQ�z��I�����=H[�Vm���~B��χOh���X+u�� $ �2��[l��Q�c��<�dafV��&��n��j�����U��xR��1���& C��m��5�J]k>E���>�����>P���x\ۙ6�8x{��6��� �`K �J!S����H���no�4�����Q��S� A$�'ݺk�ן������������yA_��� ��*�8@e-l��!�p4������NwA�O/d�!?Q��棎����dN6[��(�e��������,���W�[�>��w�4@�V�F�[A<8Aח���a������G�wC0��Dv��ѩ"���Z ��T��d����#��|s�>x�� ��g@ΣI��d! 2�z�&��|)�r�)�\|lF���aH�x��¸����+��3�+e��D�i�U����ů_���Y����d�5��X��,�TJ�9ߊ�1��@�)N����Y���]͏�Y`b�S�(��$��Y�c�)"���p@p�-�M������f�Q3�� {_,ڟ�{x��)}�(���VQ��*�s�Z������q�ۈԫfЩ����WT>7T� fz�6�"C�&�M��8>g�U^[�KY�������=��zp�/�`a��J��g��s�������|�[���A�|���9��^:�um�������ȴ[��&�ђ��V��j�m���,ߕ�]i@D�m�$M�Բ�{��(�P�}��+��'ؼ)��X��v��%d�� �_�^�y�����g�=���Ԛ��mԎ{0��4��T��d�F&�р�8ݠLq�I)Z@b��;~�D�цM��!ܚ��͘���⅁/�*lM��{w?�8*oQ�W0(��U3D���I�
Static task
static1
Behavioral task
behavioral1
Sample
77a9b370dc8a3ff923127a834d134a55e5a3c8eb438a76c726c6647e546107b4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
77a9b370dc8a3ff923127a834d134a55e5a3c8eb438a76c726c6647e546107b4.exe
Resource
win10v2004-20221111-en
General
-
Target
77a9b370dc8a3ff923127a834d134a55e5a3c8eb438a76c726c6647e546107b4
-
Size
3.1MB
-
MD5
75afadd05e88f68ee897a56c078e3102
-
SHA1
34ab40eb8f1ae38f34a432156355a83f2bb44bda
-
SHA256
77a9b370dc8a3ff923127a834d134a55e5a3c8eb438a76c726c6647e546107b4
-
SHA512
64cb05d3f540019287cae2cedda113ab57fd7d3a19bc7ef93adaa4af2946e0136b122050eea9ba276d8cd83f61c2f0050f5ae83dbf1e5c9bf1da25731622e716
-
SSDEEP
49152:XJIeX2quj4wwgRodGFZ2xf2zpdtiJTwj/0HD/KVOD5pA4wzocvR1GqJfQ2quTXrS:XcT+gRoIDndtiaj/0uVN4wkcnSA2
Malware Config
Signatures
Files
-
77a9b370dc8a3ff923127a834d134a55e5a3c8eb438a76c726c6647e546107b4.exe windows x86
579a47a56835e639eacda91927205ea4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
gdi32
CreatePen
CreateSolidBrush
DeleteObject
GetNearestColor
GetStockObject
LineTo
MoveToEx
SelectObject
SetBkColor
SetBkMode
SetPixelV
SetTextColor
kernel32
AddAtomA
Beep
CloseHandle
CreateFileA
CreateFileMappingA
CreateMutexA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindAtomA
FindFirstFileA
FindNextFileA
FlushViewOfFile
GetAtomNameA
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalAlloc
GlobalFree
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
LockFile
MapViewOfFile
MoveFileA
MultiByteToWideChar
OpenFileMappingA
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadProcessMemory
ReleaseSemaphore
RemoveDirectoryA
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
WaitForSingleObject
WriteFile
lstrcmpiA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
msvcrt
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_controlfp
_errno
_filelengthi64
_fileno
_fmode
_fpreset
_get_osfhandle
_iob
_isctype
_itoa
_onexit
_pctype
_putenv
_setmode
_stricmp
_ultoa
abort
atexit
calloc
exit
fclose
fflush
fgetpos
fgets
fopen
fprintf
fread
free
freopen
fsetpos
ftell
fwrite
getenv
malloc
mbstowcs
memcpy
memmove
memset
printf
rand
realloc
setvbuf
signal
sprintf
srand
strcat
strcmp
strcpy
strlen
strtod
strtoul
toupper
wcslen
wcsncmp
psapi
GetModuleFileNameExA
shell32
ShellExecuteA
user32
BeginPaint
CallNextHookEx
CallWindowProcA
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EnableWindow
EndDialog
EndPaint
FillRect
FindWindowA
FindWindowExA
FrameRect
GetClassInfoA
GetClassNameA
GetClientRect
GetDC
GetDesktopWindow
GetDlgItem
GetParent
GetSysColor
GetSystemMetrics
GetWindowDC
GetWindowLongA
GetWindowRect
GetWindowTextA
InvalidateRect
KillTimer
LoadCursorA
LoadIconA
MessageBoxA
MoveWindow
PeekMessageA
PostMessageA
RegisterClassA
RegisterClassExA
ReleaseCapture
ReleaseDC
SendDlgItemMessageA
SendMessageA
SetActiveWindow
SetCapture
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowTextA
SetWindowsHookExA
ShowWindow
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
MessageBoxA
wininet
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
ws2_32
WSACleanup
WSAStartup
gethostbyname
Exports
Exports
Sections
.text Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 45KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TMD0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TMD1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ