�#E� ��x��~Q���c�\��<�y�g3�Y=��` ��T��vh��]��#����Nj�N���T�&q����] b�u�'*�O�V+�������=#Vӈ���@����4:�,U�me&���C`�*�a�{�š��r�R8ukYV�� �ȍxSV�U��q=T>�Tعgڛr�� MKtw5�a��ȁ�l{t�Fc��V7��˾�����F��ŹdV�.)g��t �/�G!�PIʹ{Eb���S�/i ��R�����ȡ�@3)��a��_U����8�\��x��1�$oъ�Q<0-6&:�h\�U�ϛ4/7��μ�4�a��..��$$2G$v�E3XZ5���8�3��!���s�H�U����'�(�� �%-/��Ow��# �,)ޜ���i��T�w̓ްd�o�>�-..��Hc��K�/pRr ��Ƽ置�F5�V�ӵ������ypG�U�10�Ғ$y�����S�rFUH�N���"�^��^/��{�(KJ��dh�����F�L#C�"��_Js�c.��R2J�1�Z����!��n�)�M��D�{��~\�c�fG�&m��c���d�8�����+$�` >�����y��HBw]@,��p����5���z*c��""1��26xh̟5�r�l��c��8xT�i3w�+aJ����5��o�+��X���C���A�j��~Y�2J%n��!���|�# g�r'������վ�5��-��qn��6y0�Z�T�*�OG��4����VO�!E���n_����j6���SK���*IIy���r��?�"���#��7���;o�`��2#��e ��- �zd�������[{��GZ ��u5�4l|7������r�cMu��PĉF���#"* /5{��N4Y0� *���A����)����g3W| Z���� c�@Ƃ-_��D�v�f�ѧ�I-?�xg�NԂ��F�u;�f7,��kW��g?�6�ق.�'��N"�z9x��Vk�,�P�!6m��+0�t��j�:!{fm��O���lT���]Ǘ���wxT���V�#)��P�v�fhL�r�"\��'\w/�Oipv�����j¨'ge�P���}����U�b[���ֳ�oZi��Z5�����Ν��K�h.r�%�XO��,>v$�l�5�x���@�ޑ�q��6s�H>�F_��O2�����;7+i3��C6$Kd/��V'�b��B$�ԪI�DGu��-}�� ���������`(�x4� �����<s�4e6h5�K�ѣ;,ϭ�^��Y�'���4ڹ%�k��i�h>3���i�!reWt��ҷP���Ã8zwn>]�Ę�ER�2B�������N��/��h��BҶ� ��wO��{�����E���'Jd$������jN�!��Fe�+y�{��W�c+��`А�p�J3�IP=[�z}jPlȎ�v0��\�A���#S���rޙ�GOe�k!���-���*��h��L���$�j�I�~�rQ�w&G� �s#��(�|�"��QOF��.��1���� ;f�����*d��mm��6�do����<�ϕ/�{���b�X�)q���XMz��֫=�3�Z�|��N��l��s��]���/-�{�pl�5qG�;�W�M����?w�l#� �h�2�ca�1ĥ��,��q��[���O�?�-�m� �r���I`K� ��)����h�Z���A�w���:|$E�ɐ, �X�Ɩ���9�nB���� �Q�_7��c`�k~7h|g�� +��~����*���H���x O tXJ��(�Ȋ;� 8���/�i&OU���"��������?&$�T ��U2�j���p��OR�ؒ�-��}��}���Q����I ��s��_b9�� R��D���� Dk� Xddo<�cfM��1Z<�{�g��t���b*�2�._ :@J�b���(�4�������#q#O8x��<qc5G�:cw�;��QO���;��M���IE�,����)Q�I�w �&���@/HC�H3�����, G��ek�L�q�o�D\|a��������;h;�Q}r���ͷ�e����������V�W�m�7�����;�!��D ��?b�φ�����V�M���U���������6(��Ta�y�t9����/j%~�9J�u��#�F������ŧ����z[ϥ��ٔ��o|�<�g�h��7�`(0�S�w�o�p�_ӪNYk�c����B=2��d��9����!�Ʒ�~����ը�&���O��=v����aq0y;��$'�����aa��;�մ��Z�����-���S��r���,L�+=��K��+W !G�S!T��S�f���ql��Q��C/Z[��"��ã+�Ѡ�H�#�����JgU��s�H��-?WtK=ڄH���Ro��?�S/63��<9���D��P�k>� ��R����бMw߶I��Ṿ�)�ӰWK�qB��B�'ߖ��V�bCJ�H�p"i57\d{}g����|��?t��U�U���쑆�B'2Xտ)��m��ia_��Y:�w(�B^�����u�2Q����i�W����f���F���It^��5��2�ߚ�k՟�U,8uKL^�q�7�)`E�M�%����A�Qsx�I@���:��*��si�}ٙ��u����A�*��S�9:�O^W�8ς-��*�ǔb�00��L�Sȇ"��G �74��:�����,����Hb��!�n�(���ΚO=�^w����u��C�5R;����|%(C���^se1�b�o,X"���w�a�xD���}�7#��#��>���ۅ^��e��������^�z���6@�J�CW~F06x��b���s�3�{�d5ɛ����D�3��>�����M�s���錝��^F�����C�B��$,�:u?v�h�(�Y���ݻf��=�.H��N�A���|�ν+v���L[���J����cD�� %W1�=V��E�2 4� S�h��G�]�I���e�8���� ��(��5�#��?ľC�|azqYI���:��z*
Static task
static1
Behavioral task
behavioral1
Sample
ee15808c3f18fa57f47642e19dffa06f35c4e1ea04f46396975248de2a33078e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ee15808c3f18fa57f47642e19dffa06f35c4e1ea04f46396975248de2a33078e.exe
Resource
win10v2004-20220812-en
General
-
Target
ee15808c3f18fa57f47642e19dffa06f35c4e1ea04f46396975248de2a33078e
-
Size
1.7MB
-
MD5
e411c1d47ce1947572afed0e14ace78a
-
SHA1
e06c1518a63e6c601bac3a465ec9fe052c55cff8
-
SHA256
ee15808c3f18fa57f47642e19dffa06f35c4e1ea04f46396975248de2a33078e
-
SHA512
9ec364b637d5cb8fc69a547e3fdc16c57c8e6b4d47c345e11ea7c70b8a84bd7e37989977315b3315eaaff35b2227aac945756f9eed2dfa213774dd54266de6fa
-
SSDEEP
24576:Vsbi7u7TqlFUZSbEOukzrdwxivOAjbLxZVgEenfZqMzGsMQIpAARTU/hmem63ak:2bqlJukiAjblZ1bycAG21x33JWk
Malware Config
Signatures
Files
-
ee15808c3f18fa57f47642e19dffa06f35c4e1ea04f46396975248de2a33078e.exe windows x86
b822668dbfcb2cd8d887ad6b67ba00af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
mfc42
ord561
msvcrt
_XcptFilter
msvcp60
??0_Winit@std@@QAE@XZ
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: 4KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 820KB - Virtual size: 818KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 860KB - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ