�}�2��+��rW �,��\�P��/M(fzVz��IN �(��kF]����J���R��n�@��6���;Z�E-��b����G��8�: �N�j�W� �Ҳ���A�_������>K]8Lt4�I�d�*zc`��x�Ȍv���a�&R>xr��W,�3��T_��9�U� ��5�B͛�7QsX��,�`��Ƥg�����Gi���V��?��m�^��A�Z��CPd^ &V�#��s#��_�x�w��$��)c��[��/��6=k�@G+����.�4�T��G���qh�F�����mVYo�c���c)cվ��L#m��ݘ�n�p�@�1�ˑ�x�P�n6���K�� ���2J������� #�~��5v���w�UV�§i�r]T��520��~:x�q�Ws��5���CM 2�)qG ������ ���b��"�]�"�oLU�a@ �0��xzV��Tߜ?�뤉&�����K���0�жN4d����-�s ��pһs���?B���<����)�!��ɕ��쬎���Ӯ������ <��j��8u [*<���� U���_��v�+xZ8�_�,xk��L��[3��O^�ѼQ����n <L������麤{��pkm�i�X��Q4�d��!/ r����wX��F:���e�n|�ʷ���2�ь�k�;�{������<��,_�2x@E4�� ��V��������w���*s9B����J%�J����W[}.[p�U�S��V�.�=O{g��X?ch���5]AҠ�w������- b������~���H&R6@�=���3~(̽O9 �,~a�A�VR,����)��=sJģ��ϐ�В�VnRd=tt�J�#�? ��RD8����W��8=�ݦ(�`N{L E�!�T��t����+���B��C��OYݡZٺKZղ��?�*ł�1PG3Gm�k����O5W� �z[�V^3�q����_��lLm���߅d��K^������wڛ�櫍���Q�P�� ~!,n�4�!M��8��^�ௗ�膼e��$�x�{�";Կ��W��˂�6�f;��ZB�wC���f�{t( rr�>�r6�,$r}�� ��d�d�5�D�Q�G�ξz^a��$ �w@�t�����?u�wT��LC�j����;��/!�xw3��4w�@�G�.��NQ��;.?6��0�4����:G~�/=8P��>�6�NX[�#S;�<��SF}�K\ش�� *���*J�TZ�Nz�H\̤S���r�����(���Aѹ���I���<����V�FqjEu%j�&�i����T��~�=��鸘���Aُ�_U�K:���x�PMj|ali?�w��ǂtށ�P%��b=��,�eW��IҢ)=����{���������P�hw��|E��,��og�=�b�=� �=�p����:2�+&s��h�.S1��X{��`�.���/&#�o�=^����-6�3�mߘ�3����J�[%�2]@u���U�f�z+��q#+��%-�>k� l��$�@�L�����E*��M��ER�p,��ch�a��(6�N:��V��\}���NI��b����]��Zj�;B���]��� �y�L�#^>�Ir��ql~ٽgO��\|�z� ,�9gnX��m�c�g+ua� 'J��P�6��:��/P#�k�EB��l82e��T1����6���\�����<v�ʶ�����-��2����� {i��"\m��qKzq��:2\�L����k�g�aӣ5>����^��;7N��e�� ��^�{�u� @_g�v��_&d1�|��-L�Dh�zM�N�Dh"�C�o1[{$v�{�wݯb�����b���o��l[�*3ּ��[��6az���Z���"�� <�2�4ْ2��=��j����.��=l���RY]�.�n�r����S���7��:��Q��Q#�b����R��9����=�D8�@F���2 nW�#��6#$��n( a�_ G����{���{! ��,[�]�k����M��F�O�l�t~Pt�گ��A2RR.��N:S���}�0���g�����[QiH�e���d'u��ti27nCѷ�=�A �V5|���?�B^�!aj�>��(W[��szՈ~�m�Ì�f��\jV�D:�ï8�����/d}��0ǹ�l�u���SO@J<&���{bzB�ڤ��������0�C��iY��P�� �`�G��{�Po���z���-|r�\Z�UB����� �BrЋM(@ti�ý:r�% H�����k�/<ꂖ��80s43�;��v��JC�D�{x�%�ǗA���w� \�SZQ��{�V��摂��i��7PJ�^R5�� |CPg�Z���^A�.���U�A�|+�MD�p�yeMܛ*����}��b�\dl�gկ�x-�0�uPoҧv����k�W邞`�=�[ӚN%J� �R=T�It��9'��� *V�z~��j[-te'����h}������b��Y�v0��L�L$w�̘w� ��h<���1z���J,`N��p@�'���CsS�k���� ���=����E0��� �fyM�|�w�'�_����ڡ�Lg ���z�� �S�o��0�v� ���[����g\� �IJQU�N�'�L��((�4�G��q�2�ά��L��+����d�V���t�0 �m�n�S �t�%Qu��O��$@̃��zl�j}�p��� m��g�Q�j�)��A�F+�:w(r��ƽ�U��Y`l�K���0�Jd��/Y1�oCL[a��>Պ-q�9��#r��s�AT��b�^�b|j_������7����CQ�+���v�����Խ�C��0 r���}:�A3�n��Y��� ���p�ߌ��}�������i7�p���t�y��ѱ�����[\2Rd~��>���F�<�x]�����4P��#"���U�Y�A���X�L]���ia���-�,�P����l����nT��� Y���a��U�Up�:v-���h+���"�;L
Static task
static1
Behavioral task
behavioral1
Sample
b0c967057e251c4352aee351d62825afcfa1cae6692d90556ead1a8b0c4a9d02.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0c967057e251c4352aee351d62825afcfa1cae6692d90556ead1a8b0c4a9d02.exe
Resource
win10v2004-20221111-en
General
-
Target
b0c967057e251c4352aee351d62825afcfa1cae6692d90556ead1a8b0c4a9d02
-
Size
1.5MB
-
MD5
8106ea42822b864ed7dc927ab921eb08
-
SHA1
c2ea1995f085273210e3a5774600866730358bf7
-
SHA256
b0c967057e251c4352aee351d62825afcfa1cae6692d90556ead1a8b0c4a9d02
-
SHA512
b66773728219e632b8bcbe02b520e7ec10b649a03bd0c974097a0d41a683d6c5a43ea5ed2bc86b7a300c3e7d275a1fba1d01a504259854611481a4a7107616cc
-
SSDEEP
49152:Ka5cUus4cdbrXz9sPDaoNuOLO2N2Xo3tj3Du:Ka5cUus4cFrDmbjuOL9N2qT
Malware Config
Signatures
Files
-
b0c967057e251c4352aee351d62825afcfa1cae6692d90556ead1a8b0c4a9d02.exe windows x86
9a2bd9b17182d72334e4e6360b485e26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegDeleteKeyW
comctl32
ImageList_GetIcon
comdlg32
GetFileTitleW
gdi32
CreateSolidBrush
iphlpapi
CreateIpForwardEntry
ole32
CoRegisterMessageFilter
oleaut32
VariantClear
oledlg
OleUIBusyW
olepro32
ord251
rasapi32
RasDialW
shell32
ShellExecuteExW
user32
ExcludeUpdateRgn
version
GetFileVersionInfoW
winmm
sndPlaySoundW
winspool.drv
DocumentPropertiesW
ws2_32
send
wsock32
ntohl
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 493KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE