{삄���h�F/�� ě�����Av����5�0���N^������w��m@���A�]�����0�������\�4����瘟�r�v��Pz����w���>r����jˡ��k��:GȄ���h���u���Gm��2E���Na���+2�d�^�wD6�6M&����f��O�{_�(�1����z��9���:4�ȁ��~ݪ�3T^ߗ�r��=k}���NT+�sYo�\H��Z���AЫ�̚��j���p��[5���臌z�8���h˾�CH�E4^� �q�1�R�J;WJ*Ξ71B�ï ?�`��%���z���ŭ7{W��!���Ni}��t��㥀k恵�8��4��%�����T��W��X�֒G����)����K��"���2����/�]É*,���v��}�c�Ҕ������0�e�{i�_��C1�ZLWО��o��x,�������q�����y �E�Yԅ�8���w� ~�+��k5>b(1��Z����/�����s(ں)���>��jjL1�/3{�� ��r�H�ֶ�����Z�q{f*0�����l��h���ݑ�L�csB��mo�/���pkk?�\**߁gUq`'?{1�Y��&R%*z�-�gĽ��?��b��ٸ�w�L*p�DMb��N���t �ݐ��)�ޓÑ��]��i/^Ԛ�duX�C�����Y��.�ϑ���.����{��;獆Y>x�WRBʊ��hN������i���0�1���}�aZ]v8'm��Jyhc#}w�n����j����[S%�,�w�����Eu�A_��W@�'��kSLo��0���[�-8L�#�0�\\��M�������Pp �ޫ !� �_c?��Z�KwKX�Xt�>�|u����!F�h�A�ǒؔ�!��l��搼����ec6�X�B ��W1�\�0#���T�~����li�4a�Fd���y(���?�6}����t�ϲi�/m �YV(م��}��WNe���wf�C?ף �͞_}�%m��/lC�D0���.�����.�|������Hd�O� �^m+$�p P��JJg;jvGfܜ]���ʆ����4�w?�j���0nx��5�*Y���g9Cn�f�z���-��"�]��7<h����7�Q���k�ѻ. +��B8v ��Q���Q�h�a��ƽ�17� ���T��p�Ù�;l��d�]��>����j1���w��Q�<F�k M�Xs pb��ܲ�<)�E�w�Z�]l�o�TT�6Lp'��7��hZ R��=����x��J����ɟ4�р~��8����%���(���3�x���]K�d6��[jgA���X�w[�L���6�;(�k����������vu�~F��T&�ep�7�$�.|��H#o[/�3��9u�z?~����iS���Vc�&���%�Ӎ�c!�+���,*����d�d��qp�G!�bh� �4!������t��ƂgY2�'¾�e(g�A�粿�8T����O��;�����P�E��(h�t2�U�CY@��&�F1N������öc��&(>Ŵ{ǘudkc�!S:.�`7���N����6��"t��5ͦ�Ԇ���#��w��r&\��%�@)��H6 `]{��R,�F� ��Z��$�=~�f7��m�uj3_ꃭ�� _�zS���q�����9˦!���ӻ���6���5Cn�2�;w�e�����{b��[�ma���@��������5�R�0�_~�$�V�����v�+��$>�h�ڎ�{|(@��9Q�C���;���B#��m�.��ՀI�F4�x����w�V���+p�A�/|6�����I0�I�;�!~0E��ʻ���ȶ8�:ٮ��z�ڍe8l���@4�0An�pQi]H���+?1�uz���@��4�Q#�.�6�Uͅ�M���pY�z:�9�H�T�}����вc�ZQ�ό�(*}2�զ���pȘoN�7�H�O�@a� Oeϣ�k��Z�4fn� �dyD���8Xᴁ�rl�������Ӗ��3�V/����XL��3�b]�^6���\�J2�쉊���� pS4��䤘+�=a�҉�E�w�"������������Mc�w�/W5z�4��w�0��a�vY�)���RW��{!����x����# ~MՉP.>� �O4_SȢ'#F��b�߳@�G��^}�C��4G��{���@����� 3>èZ#q���,��^[�4wzaP'���Ik���z��4V$h���mǝ�lK�}&�Z��[h�;��[t3�a�Z*�vB������%8�8",��^R6.�#����~��Rh�vT�$���w��� �(����;?�����!���B,�m��" U1]E�oB�������[�u�㡙FAp;bgmZ��r@,ogj��Mˊ��ĆԵݰ�۾�`������ Z������3$�ZѦO�����s����'��H���R�b~�1����I�i�� Q��HU}�5qÖZP�J՝��r��8�*,`M���Z%��f$�[� ʟ�u9��n�'�9c��.�1�"���[�������*1B y)�~�I���2�}�E�Qu����J�y���q]�h[��j ӱ��ƨ_���w��Ց滹��P��O#�O&/�����3�����u4���4��m��'�*$ԽϵZ�?F�i|�h�u6N���oh��G�.�9��:��*Yx���q���v@D��/��F#q�0 AΣ��e��9pX@� e~V �"�2y�S���X���A#��,`~��5]��0��&ˇ�$}�zy�����6 ;��{��sn�OL������7ҼT��6�YЪ�ݎ`i�n��Y�G�͢�F��%��}���a�&ԛ�����%��� n;�f�?�=��`Zy6�/*㝴m$t�UgS;�%�\R��aH���r�E�G4߬(��5]oJs�q�} �HTz� ��*�Z���kB4�H�w�"i�:�g;A��^���N�<P]�-�+�X��x�s��Nv�2���x5uғt���2ԹPsm�m�y��0����G�����a�"�
Static task
static1
Behavioral task
behavioral1
Sample
89854e207cd693f9d5fc47df31785a6d4f6f92893a83c00682364522635043eb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
89854e207cd693f9d5fc47df31785a6d4f6f92893a83c00682364522635043eb.exe
Resource
win10v2004-20220812-en
General
-
Target
89854e207cd693f9d5fc47df31785a6d4f6f92893a83c00682364522635043eb
-
Size
5.5MB
-
MD5
9454280dcb3cd52e48786cb86c91eae5
-
SHA1
cd7e9afe6b9beab752da3b2e87cab6adacee053f
-
SHA256
89854e207cd693f9d5fc47df31785a6d4f6f92893a83c00682364522635043eb
-
SHA512
a3f25888a7442bba7133400c2e222f2a54ab70f296c2da9f4468c607898ed6c0a2e340633f63dc4acbb6bd984ee93a85a8e98b5ff23192d418cd4aae35ed18af
-
SSDEEP
98304:/xIC8ae5o8vETbBPIJ6OZHzWnzr+HgchZ1KlGS4BqKFN1x1R9EZ9YJTCf7:/Oaf9TVAJNTWnMthZ1KWqKFHx1rguJA
Malware Config
Signatures
Files
-
89854e207cd693f9d5fc47df31785a6d4f6f92893a83c00682364522635043eb.exe windows x86
8d8bf390fd5e94ac01758e216f0eee92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
qt5core
_Z21qRegisterResourceDataiPKhS0_S0_
qt5gui
_ZN5QFont12setPointSizeEi
qt5network
_ZN10QTcpSocketC1EP7QObject
qt5widgets
_ZN10QBoxLayout10setSpacingEi
qt5xml
_ZN11QDomElement12setAttributeERK7QStringS2_
advapi32
RegCloseKey
libgcc_s_dw2-1
_Unwind_Resume
kernel32
CloseHandle
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__dllonexit
setupapi
SetupDiDestroyDeviceInfoList
shell32
CommandLineToArgvW
user32
BroadcastSystemMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
libstdc++-6
_ZNKSs13find_first_ofEPKcjj
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 981KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 262KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zvo0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Zvo1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE