-��&5��7u�����]v���������y�93f��4X���)U,k�)�vl���|/N`b�+�9�td��+����k8��S��8w\�a�Xhx���\(n�]ܸj+�CC�ɂa�Tb�tv}M[��Y���iǞ� �=��ߺѴ��z��V�W��rx]�[6/O� V�sa�ȫ]L\���T�:i�L:z�1�%DA���(ʩ��9w�ՠ:6;��̼l��?�ϲ�K>�-2D�{_2�1/�٪��[�wh�}~��Z�"�"[ ��%<�nkII������>��sWR4B�Ӭ�\ь��J���Uj�%�����L��z;ⓧ���1�ƹU�_5M��U�dER�H:���T���N;Ɨ�c3��:s1�r�M���Cu�7}���]#v�'�*|���'wHذ�<���@~��w59�Q���>6Ԟ����J篤�V���t[jȰ^P�Q d������./��.��`����Շ�\F�Ȋyvۛ,/ٮ5����cu�8~���F��~�j�G���J�\ew� Qb�q.�-X3y=w��C��"o����P"I����h'��x�C����ϩ�A7y�E�8��9>���}j�?��C���'���8@L��T�=e�o4[Ƅ���/y(��h$�~[��{{T�V��$Xy�ǪV|���x��!�|LUyؕ�/pT"���eݏ?p__���,8-�&��~�����UJ6&|�5�`gx��1v> ��䝾��G�u`�f����Hƕ�U��O���dZ� <!���UA�������O���^$K���o�y�p��2Fy���;sɧk�� ���q9������=�����3�q^Y ���{~h?�0/�)�3�FW���([ L��<�¹��G���|ڧy�� ��Է���h>e����w-�K���P�OK�nR ��%t��*�4�-��awZ��0 �E�pI݊�nԬq2�� �'�Z�lV�^��ӫQH sB�����vg�KY�5=�+Ʀ�eI�`ø7����*�l��.[��.�B�� '\����8��eޔ���@�EJ}~V�27[�����9��t�(Ra�h��i.��{v》��\tҍV�*X��?� .�%?�1�ڪ�ц<���q��{�C��m�j�p����ͅ��6w�DEXU`Q��l���T��0k*�?ۼ�SziBcP,�0�Dc5{�X �]��S��4+�c4\D[�����2m�\?��T-U��ǤJ���w�f�*����|fZи*�Ժ,Yj�~ڍ���$w����jai j��@q� �GRY����hcq,$�T���� 2y��]Hs��Zxy�Ɯ �ս�n ���g枀��/�'Q��b���ic�y�`p!��~�l�HkaƱ�gx��ӯ9�e 7f ߂ǩ9R�|t����Z4�?c�LO����Ć�կ����� c��Ъ�d9�@0��O[�K��<f�R�ky?bR5���1KH5"!Ƭ8�^F ,��"��R�5��r�Q!A��Kh�t�|��_�b�Bq1 \*��Vz���4��c L2��ɳ�AﱞJ�uC�VS�����F�-;k+�^�m ���i�[�`2���M]�D-���a�R��|���:�W�Z/�>�s��q9�uZ5B��2�|�f�5���j`�}-+C16���Lv��x��#0 X'��L(Y��%�F<M����ę��P���&�dTG�x3�����G/� ��)�G���(-���ʛQ�.~������T�|f��C2f�f~a��b_D�S�Dђ�*��"��T:Y���X�b�t�l����5\Kׁ��.���D7�8�pv��NH����Ar*s!~f�tx~����fj�T�6�$kE�FR�[��s��=�^�L�y��a���H�ͼ�Lc�����Z�n��O"pQ�T���,�86�-��e۱V{!]��&��J�����CLkϼ�܋B�4����S�ږ���O��:J|,e�smX\P�z�g���//�{��*���5՚��!5c|a1}����n���ӿ �f�πeH�x ���5�����1q/qnH�;��'x0�_�R����b2���X�'%��#�*��Ef!&5BQ�F_(��,<蹁>k=�ƽ����Rx]\�@A��,Gt�+�Ƿa$gv�/0�= y$�!�O\�4�������CI�-b�kӰ#�� =�<�Wz<�tx;�$Dr?�+��>Q7��'e�<��8 ���`]^s���0@�5�Z��4�Y;�t��+�V$q��zc@n /�Q�4��i'��$���#UX��b� >V�-�/�1��-�9<o����C�3� {|��ss-��+f�NJ`�Bj$��~������_Xl�5f̈́�9��Y.��R�=� �`d)r�_���ɓ���+(�KZh���ߏ@^��l�|-�Ź"���ls�C�.j���TX���X����*)��=�&S i(����n��&������Ӹ"eh�a������d�����!�f=�"�I�߸#%��6 &v�ad=���?������{��Ƅ�f)ES-E�(�T�(/���-�ޖJ1u�Ǻ9�^���-��˨uk e�����=���BR�Ū��|^ב���e(��t�=�#H�l:C��Y���e;�m=�K.��]ư�(�S�_��B�˼�E/$9l5�]uDk��U��jĮ�К�}<J�.��T��E���}��1|������}p�҉����6cxj�Ę+N�%|����L�w�uB"��n����Z�%VJ����`����pX�h�>G��!݁i'���?VHms|F��.��L�"Μ�_��jko��`�V�yM߯�l��m�A�j��8pQ=�ӕlc��ڪ�8�8h�H���Q����O��S��gag���9I�K8����~v��W��Iд���5z�O�Y��.#%LxVhHտ�*�X� z��B���- ��/������ Df2�/7<������J�K�����8b�9W�r�5`j��I�_V�l4ZT��~���z��W4 �g�.�o������u7%�'���,���9*�l[VI��
Behavioral task
behavioral1
Sample
f6ad64b1a7365d8acf27c08e3cd0695ff17b08e1773cb49a9ff414ce4f2f180e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f6ad64b1a7365d8acf27c08e3cd0695ff17b08e1773cb49a9ff414ce4f2f180e.exe
Resource
win10v2004-20220812-en
General
-
Target
f6ad64b1a7365d8acf27c08e3cd0695ff17b08e1773cb49a9ff414ce4f2f180e
-
Size
955KB
-
MD5
598b8917bd226bbd9e8f6e3d271cf2e4
-
SHA1
4dfbd49a885cce891f69f08192aaea201bf7d8a5
-
SHA256
f6ad64b1a7365d8acf27c08e3cd0695ff17b08e1773cb49a9ff414ce4f2f180e
-
SHA512
46e7769e9cee44d9ffa252d3cc9effd1501bd319eefeaa94bcba580dfafc9d82149227be2523759cd5fc0f797bedec100b0b8242a88f05c5f6df40a720b3bb33
-
SSDEEP
24576:WI47M7CMGWcS6SqY42mOyalrFGs7CDQkGKFGmj5Fq0OUiNrcLkOrak:lRcS+b2VyaRNeDQkGK8mj+EiNrcVrak
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
f6ad64b1a7365d8acf27c08e3cd0695ff17b08e1773cb49a9ff414ce4f2f180e.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 255KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 783KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ