y�k���yB�.��.���LT�$�,��-|�s3<��$Р�f2�(�65!��n�UӾ��k����*��}��e��h������<��|đ�� �������h�[pc���C�e�5��K:g8����}�yv������A@K3�*C �gb�v�Ovg�l]S�����a':�y�O���z-y��n���b�oL�&˻XϏw�8���F�����xHڅM�>fi�a�Iۇd�Ū"�>Pu��ji~<2�=�_���nJ|�!�ݠ���;���� `{��E#w�jK}9R�!پ�4��Ep���2S�q(݂�����ΰ"�-��x~��i`�fb��괛&�!�@{X\tlQN�v�����2�/*n���,��'� m?a��97h@�)�K�D����q��DT�_�SMx D�c��j����S��쥾Ԝ�C�&P gK�O�x�"��W>�h"����������^����E���a��|+��e����'t ���.Д��¢0�2��k���������H(�����4��@�Z+g���5�b/}��z������S��ye��44f�� uU2$}B��#�O*nޘ��#�"\0G�B�t=�T+�<1A���=tCތf��GX�b�-�#��=�ө���(���"[����8^�e��G \�?ϓA��|�A��v���!�i��(���1�2�ǹÒu��.,�\���|W�r +��m ���$&g�*�����Fr�� ��<K z"w�����m#�f,]����v����=�j����uj�,ZCz�o�K��90��s/I1��8����'fo>M��.ٲ��M�6�_{koB�y-2��{KL��|s5�b2��ω1�O�ʍ���Xo>%�98a�碨��jP�a� ߕq�M�f���y���?V��u?���l8���4���+ �SL�kGTtGыm�30A��g��mtm��I��� ݠ��5+"p�S{d�w�]l�E�������w��˪��Y���m]�Ղ|GJC�.��+=�q�f�\wV���\;�{���īc�BvU}�M�,<�42]��40��`:=�Mx?f9����R�f.L��J:O��/ӢC%�v�.����{�ӠO.�� ��r�d(���<P�Tֈ���5��1!� 4 u�҆�CO��U?3=�+D��r�(�u_��M��K�X��@�*�L��k���"�x�U���]�C��w�5��042m�!lK:D������y��Qvc�ĕE�ȇ��X��I��=�����N��,�L]����[�8��.A��o����2m$�#O���E������C�CT ���V��,)"�j����D$���G`P~����k<V�W0���ׂ�T�-�����%5G�Dw0?��B �#��r������BO�`�*�������w����V��ᶥW�M��>ݫ� o�t��]����L�k�7�M�m<: W����&\� �6�,REp�s��������CXO��܍���p���a�������ܬZ+�i���ޛ�Dt�Ӡ�7���.a�i���� ��㓌%I���A;c�^��i�j�#����5k@�^AZ��3�(Z�?%�p�p�?n�cŷ���);����e���WO�n�)vFݹO�l��$x�>MW�N�Ӑ��k��뢤���(�>m'�n�V!T��_~?����L�T��1�. ��X�a����\s�nx��VIP�U{o�Ӝ�i3(F�@#�n�6ugL=U4��l�n�X�������[�P�p��������py���,�>�A���_u������?n��/��=���b"d�j9��x8���'Dm5���5&ey�*� T0�&�=�=_i���j��$��j�Xt���e�b&���j��,pD��>"�3!�&�������L//�*P*�;�!����8}��9�=����P�/o�'Z�q3��]*�R�i�XEt�q�����N���o�ݱMkہ��.��%��.�����C��f��/Kߩ@�0k�ɸ�D*�o�����ۿ��姻�y��߰U?h�/M�pW��L��2M�� �ϥb+����lH�Y��3 8y`���[)��Ͷ���Y!�˙���`(�\軨sK���!Ԕ�Z�KN�my��ʺ5T��KhP��zK؈ #� ����ŪsSpk�nq��I3��A� ����4���r����EH�j�D����^�}s������=�vC5l�ϩ5�F���NԮoF��ب ��F������И�|�2#�AG�8�1[�BA���Y>��VG_9�=+&&B�����6(aej�(X�g1�ǃ6 ��b����#����Y��)b��Bij,�ȧd�y&S�9�7:j�����?�)�h*l7u��>ZC��{��uHҌ�Z��Q�Ɇ�=��e_+��^�dfw5@F�=k�?/KA[Ev��7���Q�T")d�2��ЌJ��|�� ��߂�n�*O�-�{��I�L��v��韛�R'�6̞\z�'+=5�@��g���d;��BxX�;)��q�/e9��{ �X|��vO�Hz��@ �c���ԗ���RԈ0O= r�#y�k�âE̖H��ʪY z<�(�Y�t��%O�Q0�P�"}UrT� ��oX������*6I�X}j�B����u�,S:�g��Z�^� �,_��ӰN ���3L��|�3�:��rϋ["!�N�o���9���ͼ�";$���㭂�fe$2��}�@�f���*�X��֬��os7����'L���wˑ.T��J�uO���ژ^����H� ȧ�K���\����3�+�l�L9��3ů����ݒ�_�~T@�|dI���{�,�e���S3��y)*k�&�����Iv��N��,���ڵ�V�'\�x��l7C�ʯMJ�g�B�~:WQ���sp�P�@�����*�0��a5���!�Z��R�}"�Zf#i�'�����zQ�Ұif�9���+�'�m�V�#Lo�(93�aΐ��?>Ea`�T��)���'�@��;ǯ�+�CL4�����)V�^��o��xݽd�K��
Static task
static1
Behavioral task
behavioral1
Sample
vape.exe
Resource
win10-20220901-en
General
-
Target
vape.exe
-
Size
6.2MB
-
MD5
5a37613c5eb0dc5d168018cde98c31a2
-
SHA1
a224c7a8673acb2a1d4754d17d323b4c6deec398
-
SHA256
f018fe07c9e417630c88183d5c25828fdaba6a3c0b4711102eb6549a0b831052
-
SHA512
ad6a542dbb3ec5635e545e2e432647cca73934308e5874bdd03204ad6a11130000d1658946982d2f971f7c0725525977130251b78f597287cb3eda3e884035b2
-
SSDEEP
98304:qGlwW3VF38HxDbHHsjbCIK+n91A676hs1pjgXyq1SAqZ01WOU5AXIm8skzgn:5QRAbZK61T6hs1Za1HqyoAXIpu
Malware Config
Signatures
Files
-
vape.exe.exe windows x86
e071ba7fd5c7afabf5143260faf89f01
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyboardLayoutList
CharUpperBuffW
gdi32
SelectObject
advapi32
RegGetValueA
shell32
SHGetFolderPathA
ws2_32
htonl
Exports
Exports
Sections
.text Size: - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0vw Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1_` Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.%D8 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ