.����؉f�͈Sm7Go�W�����#6���e4��_��H�q�~���J���g���"Ng.5y�Lq�����l�3:Cl� ��vڎ���g�����b,:#�����;m0��e}�T�=�bK�W� �R� j����&�V���f���Y�����<k['1C�#��{�n=-��W�/��b��S�\y������S�נ�|�iʜ�)�t;��m��y���9%������Y�o��ݽ`��� c���\����ʅ����e�Vp�È~��<�{���1����|V-,�F�������o�;B�� �Rk|�*[�ef ���E+ C�s�� nԷw�p[�Y^6����(��]G�qu�����3�X������<���8�1���co�l\0������'F 8�E��vU+�IE�/}�5v ۻ��6F�+������i�$>���X���J@[mHm�7�Bt�dG�Fu��([~�7�z�)�Z��<2WBY������*�K�3���z)o�j�8̢�2x��F�>V��l�����V�Z�j32����WC]���;�W8>~�ڑ��igFG$�v��,�)�gk�9������e�e]��!RU�l�Ďg����>�Le-7@������닄pTs*� �& �������`��X�˓6R�D(U���P�[6D9���?� OU�}�z�%��.����6K�:G�FR��[k9���2K��h��c�Ly��Jt���-p��u3�����ܺ�Yڼ �곐;y,��1�E�m8�7G#Vf�Ź�miޅuC���Iݯ2J!��@Qo���Y`��%}�E{�� �o@Yϳ��;-6�XKl��k�,�8��gR�I��d"�2���v��k�˪bX���x�$(�Ц2�D��^�+����qD�,c�n/v���mSu�-�q�[�j݀�ߵ��+�K-�a=��~dkU\���QbB�%�v'��l�1����|U�L�1�I�`Fy�H�_.�7�f�_s'���R���B�*T#*NAs���g��ʢ04 �돋��zx���2��\�s�Ȗ ��+ N���T�[���D��m�F��D���l��chY덴�Y�Y�=~��*��0�3�"~����$q�S��Ro���Q�I��KS�f7�wc�������!�uM����%�O�(uR�ݎ� ����\`�-D�O:�̯��gϜ�zܮ����kK�EIu����Yc��Ǩ}��^��lZI"ڞ�Y�l��K���Ȋ�f�L���L�]��x����X��T� �ΑkJ;W��T��i�A_Jt�`�=j2��)��3[ $l�aןkl�F���T��Ӳ�6(�{3�"��`쮲� �,���2�/�v��\�π_@s&@�"��y̌� z����?��Ԃ�n�3u�us���� �<;Ü[q�w�UF<�RA=��S��3�>����[�B��a���%���0*Ƹ��Y獚���&���,�c�=Ba����{�0��s�,c/wb�þ]BÌg�Q3&�i��h����g>��{�ż�5�&��ؙ���=L�7M������(�<c#�����p��3�RE����X�q-��:��\��5*�>v���Ү��tTG��ÿ��-�ٹ� �Yrm5���ְ���oV����X�j�la�d�ʚ���DP�p�g�B�?.V��-��('_`En~"��� yE_L �*�w�g���������w��e��g�X̆R�4���-�>��_dϚ�-�aY_��ܡ�+���*��1�� &�|I9��hȭ?����������#9v1��Tn+yǜ�тw��B�,��k.�x����H��r�t���-�2&O[�:��e�&ӫ ��ێ�cm��M"f4r�s�s"5Ԇ-��M��dž��������P���3�H�)��� �k0�I���[h��Z��Ք-�f՜��pN�3�����y!����=ny��K��q��6Nh-z÷:}����(B�7�����{"X�$������~U7,��U[T�P���_8/쏀$X·2�^�� ��nX|�I�����E�Tb�eN{�e@�W����@6I�L�{Tpˉ����&���&RF`I�-v��f\��g� ��) c�ߊ�kD�3s�MV4y/�;��� \�\p�D��nQk=va������G��[;�:F;(<mc2 Y�%�ٯh�i�u� �7 a�3ذXꆴna#غo�0@W s��� ��I:}�J�؝pJma-Z����t����)E���|-ŋ�a�����q� z�dJ������$���Gq�Q�j���;���F6[����tVy�2��&�}���h��~a��RP�/ !e�Y��h� X\���bO��"J:�Й�i��N�XO] �zk�6]-��}A?!�'I�F�ChLo���s}����h\��|�r�#��_������ƻ@;SJ�&�g�K����9!�&w�#��HT�\�[�3"�/��j2tZ�����gj��L�|Vw�l7 �)�z�EY�S1l��n=罨VT�}�>4��� ��Z����>o�bt��uf�u��a�D_F�u n!��4W����ʚ|k��pt69�`� ��]��淿�ۤc;"L��4#�u}��K��(�_�lnE�S�!��B����b5d*־ş�F:X����}���ڈ:�pԹ����$n���l���m�t{� �!���I��i%��~�~3&��]v� ��?s��nP�o0�LI�!� ɛ���R��Q��z�Q�v/�^�����; [k�v�x�v=/𫂴�|������gtՠ�f��K1ϡ~!?�fŌ��z��'@j�*bW��)a��R�v[g)ղ�GG��XD��5��u�A�̭PK��е��/?��ȫ���# ���fΟK�51�`d�:��J��twg�9��Z�P����0�ڴ��*9 K��|V�Y�^h��rde�༻7��)C��O���fJ��s.ƹ!���m�\2?� JQ��=���#`ktÒ+LF¸'f�ߓ����Io�*r�Mt��Y��T��]sW�f6
Static task
static1
Behavioral task
behavioral1
Sample
services64.exe
Resource
win7-20220812-en
General
-
Target
services64.exe
-
Size
9.4MB
-
MD5
2f00e6c10cf77b008132b5544b12bcce
-
SHA1
64d0472a9d7b215b8989aefac7ff0dd9386c9d9c
-
SHA256
ebc656b1f0fcd3506f59c34b84601bfd20de1fa0d697b34265ad3121fffe99a7
-
SHA512
8fa0c7c1d622c3c8558b56f18647b4c52c592a68bea8a2f92e75f439a2d36168ec75b263e1a46cc1b4a34a5c86c795ed1887238c3b7c909a8c73bb2dbedaf2d4
-
SSDEEP
196608:waLlLjEjnVK7IGteXHlU1E+SyOcBO9nMnaiiGkB4vhGNPPsEy8:/VjEjnVKsPl2Cuk9CilBIY/y
Malware Config
Signatures
Files
-
services64.exe.exe windows x64
1b2324c097913513bef0f7e95aeec8b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateSemaphoreW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0^P Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.VNJ Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.-X& Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE