�S3%X��0��L��ߗQ�A�m��< ~}@����\w�$`V =Qqj�A?�澷 g�57�݃�l��'A��ȯ�$�0� �����4n�_�O��҅Ut?��3XO�Bd\t7<Q�'���j!�E�g��/z �K�5MPjm��j4�������O�C��~vV��z���at�Z>o� ���wV���IJ�|N��i5�$�ܨ��X�����u��H�Z��)�#����ɿ�K�����\�E�Ӡd��Q��VQuF`R;��*8�c����{p�A�*c�N�~���� �<��8��N ��u��FToNJMW�:6+��C;��>�N�>��l�*�at�p��8�/<z�Wf�2^���cy5=fLU*33��h�"w��JF�c�N��7����<�Sf���?����Sf�S��W�i7��3�[�{ӡBSNt�RAE�w�á�a��'-�I�^NlM��=�q�[*�m�i%0���V���i^�������}%�.���3�&B�_����[��QZ�1�뎥���E�rB�j�� t�6���������[GC� �fvBb��I���4�U��MNp3�f����������b%�����:Â`�Z�#x��� ��BLc� ����; �����������*�I"��J����I��vn�4V���1����vr�A*`�]F��X��we�Qv�wׄ�O�� 6VG�V<P:�!��?��;z��^��������w�|�=qkpP�� <{$�d��L��r_s�Zp�>��YZ��P��K��ӎ��1�$��Xn3H5y��n��s�C�Y�~(vv����=l6� �#�s�)�R��Z�ؑHgǬsd]it���!�d�}'��P�/�����Yj��L9���O)5���N�'#�g}��sO�i��csD��O�@'K�J�m�G30���c��j�a�.*ހ���}κk��c�<nx����`o�n������A���)&;���Le�i�����m NԵ��y���X�!�j�L7d�Q�k��z,¢��<�|{����'t �UQ��"$Ǩ�o��2�hL����O eN`&]�|�_����KS�ӬZQ���c{�a���+Cw/n���A� R#<�����tKjS����sa �Dlv5~rƦ��3�Ks�Gg<G>��O�3�%6������XL/r�����͏�i(4~�5�=�����顊r ��%��)T��CX,8?�����H�����`���lR�XW|���C�Lr��cr tz9�ι��O��CK����uכׁ����`!��x�b�����1MI����oyp��הE����Np�a��n�t����� 2��T?UkL�6<���(-]��zr���a��G�Q��^ �1��L�Xt�O�o����M �C�ߪS�l@�,�ֽ�J/ʋi4��n�+|�c<~���-{"�Bh�إY5<%XP@���e�Ҕ���*3ؐ��+-T����� ����� G(����zj��8�\� ������DI�ܠ{��{�w�R�h�^a���ʅ<���!%�q~�=�e?&G�k��E˗��7�e��x�<5�k� Gw~��B�U�h}��]!T��p)���7��{����+�x)�H�nT�`��M/<�U?��Z��Z���k��,��`��a�Ɋ��Fˈ��!�8��� u�^gHT�l̐�/�X�'>���=W���V���V|2�K�I�Ju@�*�Ѡm�b�NLH� IN�����!%�� ,n"�V��Qh�y/���>/�e��"��!�ځ�\-��2�K �ԥq�M���)ԃq=C�e�[�o��,@o�p�W��k�-�@�0,�����&~��SM��o,Q�k���m�) [t�؇�[�����Sbwh�u/t�O���}���9hE˔��.v��4�揄�����zE�hd�R�����K�j�OT����GH^�Hcx��=����~���<������\W �۽�v��>��t��3�p����la��)��j���-��ıA��z��9>�Y%X���_-eoVb(f�*���4������iL�G�"R�}(Xn�4Q����*ze[6����xA5\Ω}����f��Ü��|R�O�:�[Pn���C�2)|LJ�ۇ��`��P& 9���6H��;I�Y9���*΄�B.*6u}oe��2Wd~��� oii����fԏ ��OH����h�m1�tS�ck ��6�麲"?'9�b���/��2A_�����������G��gR���Y���" ���Ѽ���,g=�̜gr�E�s�Js��:�%(���倀�ݫ�>s��}�c�؞�H"jQ�������uJ��ԙ�������M�_�@�yRu�^dbqL�����7��R-���(��&���_�J�$�����F>$O���ȍrҌ>���V:9����=Xm���7G0��d�2!P����Үl@^>$��r�K�g���X�[8�s�0P@v~�Z�gA���@IYb)�A��_�����FeS����6� ��M�\p.�$7jrsWc�!k�`�£�������"�3?Z�ܙc��-���%C�p�8u�ȼ)| X��q��0Π����F`�n<����Ώ�˪;��w�j�����?����1��/g� d��'��F��Edg��,�����{GEq� X��x@�T��L������Ď�����b��>���<B��h(���jGFM�XML��D ��i���7��A��~�v�۪3���~��n�0N�M�cAn�Φ�==M};�LP j�=k�ߙ�Z��Z���"��y�dc���S�w�V)rC�5�"z����{���0S����c��������#O�n��X�%��H���nY���죄�m����/ӍqA�h�kZ��!֪�5�v)�Ӡ:����VS^Q���أ�L����?�N: � ���q���0���9���|�RS���a�APg@�&i�/��&�/%���L����g����@v��/����!1�{-\;��F��/E��9v爿8�����*m*K�D��� ع����K#�F��d�h�C��ٺ/4U���>���`�d
Static task
static1
Behavioral task
behavioral1
Sample
val_EU_a4c955dBa8kbJ2j14a.exe
Resource
win10v2004-20220901-en
General
-
Target
val_EU_a4c955dBa8kbJ2j14a.exe
-
Size
75.7MB
-
MD5
7fa5b4bbbd09fe60b17143825ba953d6
-
SHA1
161f351241ab4837e30d8238a3041e1d731fe555
-
SHA256
815189709dd978ade57c017d6d62669edb809637a96cb444b6df84c30b5cb289
-
SHA512
fa0ad987a75ebfcd15e86c3a726d128c66349715ea42271ade87e9ff16ee094064435533621924c8824d15f9cd68f229e7083adc20cafcac1a3ced07586ff42e
-
SSDEEP
1572864:h2Ws5DmYM+Y4ghkB9zdqNB7FlgntfE9r3WUANqnzeHsRWew6WQHOcF29xh:hZs5tM7xmbz0LFlgkr3WUxziXIWrcSv
Malware Config
Signatures
Files
-
val_EU_a4c955dBa8kbJ2j14a.exe.exe windows x64
7853183c978e8b718f6022e5195f633e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
??1_Lockit@std@@QEAA@XZ
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertFindCertificateInStore
ws2_32
bind
shlwapi
StrStrW
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageA
imm32
ImmSetCompositionWindow
xinput1_3
ord2
ntdll
RtlCaptureContext
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-string-l1-1-0
towlower
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 919KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 71.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 75.7MB - Virtual size: 75.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ