�Y`oȀ�'��� �Ƅ��|��!f�ړ�@�HY��P��?.X�ɞf���qb!y��%²�U��3���Fi�X|IҒ%�4<��z��}�~^���j�"<����RѴ��b{4Sվ@�!u�A�t�L�C3�-|��PB�_o1�o��I�<��H_��0Vg��CZ�-� ���2�7���� �U)�=�iw �ߗ�$9���l��y6�h�U�Zr�cG�ɑ����]>=��80�a�S#�s �ț-Pȼ�g[G_�����dI���uJ�n�����n��XFu�����4�Buq��H*>���y/�?yv+�֗�H�mMR5T�Ό�q�H�" ��=72����c�T�q���gn�Ka��A"4�����s�P'_*lm�A�,tf=��� ��G�jR49}B]�,{�ڡѰ����o��H��ܛAM�#�)K4�/��#!�� ��tt�@����sqn������G�kt��mY4̰<q���d(�9�Gt�A�(�3aUM8��CX�Ȑ��F�4�~�=i��h�Wv�YeVO�����Dͽ�kD�g��Rn@���������������0�\�4�M |"��(b�3��yIAlw���vG�wMaM���G@��Kq�p�M���m�.��?�A�P�a��5m��b�U�a����\�~���wQ���π*��l�ЦPE��2|琌�mU'L���S}=���ߪl]�����{H��I��ĉ9���ȌI�.X�c�(f���kB����d���xE4X �$#$���o�M�N�Yӟ�#�*�@a�4}mh^-���x[�T�{�����@��SD�h��KvU�s�T!��2P�����d/��IbȪ}����2��:�'ެv%�]��W�8^�����4���,sg�1�鸮�YF����7~��1�_lQ&��F䠉�7�bÑ�~Mğ;Mx�@!�G����P���v���Cb��$�nQ��� �Ǔ �����f8ػ��)�[��)�Q�y14~`�Z����A�{}2�,;�>;��{�=��$4d�� �2M���6��;ۙ��0d�\��6�k�(^E~�]��� �p�N�䩠�;H@ۤ�������'���;H�'Â���6|�I�q����2&+��P�����Ÿ�>Ŭ�F��$�Cʄ��AZ`ۑHY)�c����U�gh#v�O%�~$&c�_Glr7���K�ϟ���P����]����l���q� ?���0� MK�LF��`�>��� ��X{��y\<�碻�����b�d��I/�W(��<�t���㻢#N���Y�0��u6���.�n��*���/"A��jt�f �h� �K�Pݨ�y�D���~���U���j�sy.�P4��U��\^������&x#���lQR�۲_)�.>i8�?�7��P�`oz����\zd"����P��E���\�/�W�i5cw�*���0B�<,*L�/\�;+|3*�p��qP#��!�^d�/%l��B�2�H� ���[,S̚)��7���*�C=�Z{�����X&O�f����`Jx��6 0��4R�_�i�H��ϒN���~D���U+O7�Zb����2�Q�9�c��R՝������@��ĩ��ڙ=B��X��L�i���q�����:=���P�p|o�k�gR84��昶^�L��x����oW����oNP»o�@�}��S��7K��F6d�����IPZ궇�Q�B�e��*�X��q��h��;��Vp������u�J���c���*��)�Ϊ/�VO�|��֠�L#8�:YМWjZw�+1�f�A/�26�|��M�I��yY�H۫�.,z����z�v�g٩/E;�S��G��_`!� ��W ��[�A ګM��{��jD%������ɂMyʥu9��;'��A��nϽR�7o�l�5�=������S���Q8 �n���X��<��VZ+�<�"���7ٟ[����P�vi�e�ѹҚE�?}ڨ��l0�Cp��lP*���Z�{����Q���/�w �U�L<켑�]-�hpU+Q�P��B�<ڧ��_^�$M)^���~y��@=L418�g��lm�=���qZ�9�,�;��mR��O�z��d%}o�^-�֕�O��_O�1������t� �&�"����� Xmc|�-�=����B��lx�r����VB��Lj����;a�B簕�ȥK��>ǽ��Bw7��[���K s� ��Ҭ������=�b(���W����53���Y���3���D�9�hk��d��Nn�vMN'`7��6��²'��=ٍ��x�g/���� �&����{��/���[C����Z�*g�$ڼr�+�pWݰ���Z���3����'7ՎضeX6$�� O�� �<�����Q��\�_Z�p��ؕG$�~=�!�5��m�@+����|v�ijW���3���/|>4�f��GFzp��� ���%=�W^*rd��>fL>��l����#kUM&�f���}��d.�����'d�/�J�^k� �ZS'�Z�L��o����h�lo`�Y^2)� ,p9t�G������� j�ɾ��#��F����~YK��6�n�� \���7,K9��b���X�*n2�Z׃deSO�*�I��Q��n!��_br2��eǧ�l��j���!���'* 1�ɡ���R�=�F6v�Pq�M��6��Oi� �:�# �%!�M&-�F$���FAv�fy�/15�:�� �M�!�ix�<� �PvH����u� TP>�nP0k��)穄 �� a����lŴUHe��_r�k���7#�,�&«`.�g���g$�x�J��� �t��H��þ(��^���h�Pl��}=Av;�o`���g��^�6p�+�1���� �=��i�?1=��7�g���:�G"J=�~>�^� ͞?���N�@��v�߲�*J�$����pS�=%ЅfRV� yeτۿ��2j�����J�z����`�#G2^�}��[;@�ж��N0iЭ�F\C{�oT�����H_,��O�������r�/� ܦ��ѥ��݆��%� ��c�2�IV%̏�{*� _������g� �
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
6.7MB
-
MD5
4879fc8291178ee785d807c19d7643cc
-
SHA1
87c3f5518881be2675f1d4dd8143b3e8927f09ba
-
SHA256
4093176e34c016f8ef9faba17c5673442ad526895f9f5678fccb1bdf6a8a5bcd
-
SHA512
6588d1eb3c32affd1e0567cf457adb1a3b7a2edeeea3b23011734912bf3ecad49a4f91bfa596b6f8474c48ab40f1cf4ae240e57f9cc0848f85211ec8d356a492
-
SSDEEP
98304:plIzK868T3rZ+UYbattr0vIA8OO0/O1Whcy6CORD7o2w0kU+FVm9QmYnASFTE4sE:p6t68bZkbwtoLfOWOUF6COOvm9bc
Malware Config
Signatures
Files
-
file.exe.exe windows x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qHx Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.E>g Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lGd Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 505KB - Virtual size: 505KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ