W�& �D�����*ς�~����{�)�)C�9�����\J؞�[n*���u�pB�o����tg�(e ��y�I ���t�trrX�nd��'?q�ޕ����ߏ) ��@;(P��`���f�L�Ҹ�|�����2�1?��uOE^���<O�aM��p2f���?�Q����G�����˔$�c���?������"��~���� ,+�#+�99C�@��� ���A��#�YD�����km^~��9���}�<?��a��ȃ��ל��V����y�z�zQ� @�*�ᬋE��D���� <K�q�mHI�b�^8�vD����L�1�X��4�`�;%,�0�л��]I��$�`\�D�35�w��h����7?W��4��d��@��3���ݨwT>�x���<� ���]4��;���_\�&y5E<ʶ��.?¼|�u"�Ѿ=K��=/U!gm�9����U��芁�Y�-`j��-�F��m���s���\3� �uI�d�ͱ~M���܄�S��i@^5B�Y�����}G�2�T�j�k����Uj��i�J��o@/ ���j9�nRǠ�>J��Yk���ʛ�Z����Q�]++v MA�&���R�ܓ���;�s����xښ�������[wU|�!���&�J�9R^h�i�:��,���Z�����a5M&-xf�~�o.bW+��#dۇ�2�2����Wv3`x�5�]�-s�xV��������0�Z����+:�z�Y�-T�y�ф��a�O����5>���� )2Um��C%�K��N�(}N俋���~�z���YSl|:��[��9�y2�ʨ��A�ү��[F���cԂ���i>�6Z(�5��#K��uq�U��(�ot����KO����V�#���l��H/���J�d{XD�sE�%��}"�8���i[���_��IEߥ�]�/��2+�^����`hO��J�Z������ݒv(I��Ʈ�m{t��!��,����`�xBH���3��m���p��Eo�vg��ꁪ��|��&���"cVXRTi9ķJu�$@~�A�7�\9�9�mB�'K�sj�ٹ����8��GW$�-ƌ�Z\+����r:\��G�"7�v��'��dq���Vl�/$A��p,�`@�w��3���)"�NoO��K�A��~|K���|>�$�61��(�3+�͍G��W��q�o_k��'�=��u?�C2�e��2߫>�;�B�>0G�b\F�����A��-%l'�/ܸ EP�� x �H���5�� -�d]� �L|�л������$T�d9���Sˌ2�-�jh���3�,=;=E��� ��;��:*ˉ�vVz�7q,&���g(������%��"��/���s����rPso&��pU,����������[���!Ys�:�d�?|ށ�*]N1�#�X�c��k���c;/��$�ʼS��U<�n�>�m�NXT��+�m������~�#S�X�� �CE4�*S�Ѥ��o�w� ���`�#��5�#��t�@�o9�f�"�Q��68Å�87{��K3ZM'7A��Y][�(�a.Y/,=&�!��r�`Z��q�Lz$�gZ���W�������#· ����R;?�x!��ZO{��i�5�P���m9\��(��>ER�V�V�&�L�`� t�m#sH>����s_T@��?�;�G��Q���X�*$9�!�B=��S:mnwhv؊r�]�~�IMcv�F$�zZ��O��Y+g8}R�D6s,�\�U�� hH�U�:&���:ĺ�+jj�TF'��3��.�J�Z eG晆u��s4c{B��9������r)7����dw���I@�_8'��'Ī!� �=�AV�ٿ�h����ރb�S�I�r��������INt�����/�?�W�5s��ME��o7�p�w�: ^�YJ�2=F�M�0��ơ�)G�&�/p��Aa�w �� H=e>�� ����L�Nh��)\ֺ������Q)����������B��B_��B_O���R�Häl���IJ��&f �C*~,��xhE��Y���|7�A�3�3:Qs��'}�:������f��c�����8���A����v"/ ���܊��:��A�E/z_�J�vC�@�:E'���~P}�+ջo]����?�'�so�b���r&3�!w��'�ZeRcy�f�c�Rڜ�gs/����瘧�%��u�Pn���==�Q��P�Dcύ24[��.��C)�*wIs��YY���W0W�l �W�� S�M%��� ��Ǎh��~� �ā=�d�)��G|�M��?%Jr�'u�O�������`�'�]P���վŽ'���a�X*k�iW[��|�q���sDx�s=�g�R0�ߎ�m��CHЅ�ʳ3P���ހ�������E:4 ����p�LȾͮ�֏l��RR���u���y�k��IaN�/��:an�sqn�����be�(�{FD����*B����^�-QN-N�P5.�IU���������>�7���_j�L`Q ,{{��l��F�}���&/���I؞�|����|e�Z�!�h��G�%@�<|�"��x�?�dT��)���ڟ3�����$_mAw-��Ν�>����/1�r�-���w8c��U5���N�T�w���o��]0�� �f�ԍSt���+D�-�k�ڦkx.r�Y�cٟ�xs��0�j�p�.~Wз��`7B�O�{�q������]Ѱ^�o}f�Q�y��+M$t_n���L�!�{IcL7��lY xp�m��ͅ��qh�^�t8b�_�T�K80��HB�^�|��O�_}�Iӕ�2!ߺ>%�@��r(��11*^�j�χ_U}�t"6P_�dxZm/�PX�����'�qI���S�2��6�7�Q�[���MՄAy���Q?�I?����J�%���WPk�/x��_jt� +R/�1?!Vy���nŦl�|n"<:�j��%�`u�ߟl����,��렮"wy����]B��&�����!���]��@��t8��)q7z5��Z��M���ż�փ3ٗWC�� ܩ/�����kJe�� ��Ō9X�:ݺ�Y
Behavioral task
behavioral1
Sample
c94e9b2887bc234f8a8349d5053b0b17612b175136d41a774fa43dc662445b0e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c94e9b2887bc234f8a8349d5053b0b17612b175136d41a774fa43dc662445b0e.exe
Resource
win10v2004-20220812-en
General
-
Target
c94e9b2887bc234f8a8349d5053b0b17612b175136d41a774fa43dc662445b0e
-
Size
1.6MB
-
MD5
b1d3f7c807ce9fa1c7066a1624d3c59d
-
SHA1
dd53aaac66a2d14242ef341d13da431a69f09937
-
SHA256
c94e9b2887bc234f8a8349d5053b0b17612b175136d41a774fa43dc662445b0e
-
SHA512
904d35440606da0e0ed57962d7e6e661c0a8a07bf898920cd889ce7eb7a2b6ac73f794b282231d132756cc1ab013c34d21219432d58f5748777c3cfb1e5c92cf
-
SSDEEP
49152:ADdU3xvKl07sBBq0oXIvEqFSSpUpb6fcdU8tOd:AqKlwoBqsPI
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c94e9b2887bc234f8a8349d5053b0b17612b175136d41a774fa43dc662445b0e.exe windows x86
ef84d359ed4cad6bd314e553411c4836
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtectEx
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
ntdll
ZwUnmapViewOfSection
msvcrt
??3@YAXPAX@Z
user32
wsprintfA
MessageBoxA
ole32
OleRun
oleaut32
LoadTypeLi
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ