���*3l�bSlZ =`\� ���Qo~9)�ᧀC =���r��E�����H�#��1��\a�l8���/����\����ﲳ�(�� �N<N�ӉB��p�*0�fk3(3\�M�wy�I�Ȝ�@�Me�0k3I}��-5&�>B>�1y�ij[ſ��d�����W`V�(Y�,gZ���b����^�y*�z�G���r}&q�Ph� `���6q�w�m's�x�f�&�S��nA��R�s��ѰTUBǿ2.���m�Hu���E���Ж����B�((u�$'8�S�EnFhdf�*-@��ܺx��B%�5�"�^�u�`k����i��+ZgR�Ω$Roc���o��n�&�#P�|�2�#���ǂD>��S�LD���h�Mt;}�:��U��@�W�r��C~OD�=����Ə],=ѳ�]\���,���W���];t���ϓˊ���h!:���M�T�:��%3G>/��_��"�h����_�Ty����K+��� z���s�~C|�8�t�4�~C���7���T��Z? ~���,e�[�0k��3��D}�z����5_Cp-���ۊO[ �1б��.#�m������7���m'o�Aԥ�|��7�Π� ��)(�{]ބ�I���"C^������6[|�;���xSO���Y�~��˙AOo�y����`����-n�D���`�Y�u��]g�6 �}�H���ϟT��kKEB-#�.��D0k�$���� ��T ��!��y�WK�n����@���UQ�,Y�Á�h�Ι�b��s������pC��JT�y�Uݜ^G���#����-E��_�7?u�7ut-������ѥ?��P/E]�������a��2���7O`�ldzo��q%$�eP�v���]�\y�I����z��z��GF�JEN�)�➛�r(�E�2���oV��������xs0�:��7x���<F~E�ˣ,��J0Ȩp� p^Ak%~�&$?����ཋ��/{���7�i@����:K4�оMe�TN�� ��VO��E2A�����O��g�1nϡ��yhk���Xu?ߦ�o�$��Q���O�W��)�S��I@*B�����z�9����乪{��(|��ַ|R�������n3�[��f�pj�S�UZ��rZV0���4$ ���\=��62Lc~�nNXB���^���ԃ�Is�u �`�b�L��@��wwj���eid^�����j4����@��c�v_����i�9��6Q?d�;&���"��sx/d�1�������Q��v�e��Bq�7AF�*A��^�Ѧ��ү�ĵ��ꧦ&�k��Y�ɐ���#tT�� U�CF�#K�k�����Q��j��q �Wn�k���=H�Ɲ�C��2V����?���(��������~�A����o^�]��(�J�n]�u���ó�P8M �WcQ�"y�Z�F��� Z� \Q ���˯��N �����*{�0�)LV���,�M��ǫZh#�'&77�Af��)�L-��sԸ�G�f�� Tx{��l�����P�t�8���F��ϋ; .�Y��KƒHe)�s11�����`��ǭ����d[,��^����1|V�@Z����4� �[k{o>�� ���2����}s�Cް �������$?i4\��Æh�[o�;tE-E?7Q�$�%���[�4�gd�#��K]7���$]zM}����pYo�[�V�BŴ�J�g�pq5��{��[��7��UP"�g]oI��߶7�-,��ɸ-��O~��Z�]��ù��m�Di6T�80�̕W�~��IJ��,9M�.+��o���n�n1 k��5~�і��^�{۩ ЕLUF��$�����b��w�?0�>~ A�f��4�#���Љ� 83O$� �FXn���Ţ�ҡ�������YޟH(��z_q^������Q�uJ�wZa6�M^ >;z'�/���We�����Bpy���^�#���7ބ��X�6������� 4��݃Q�|��Aì�c���� ڷ�"��dl5(�v��ڔc2Sֻ�Ͻuw��6�O�Yw�k��BFw�-����"Í�-f\DᮙU�*��YM���=㇂" Y���� #zS�Kp�&=1���钖 AXP�"��~��2�4-h�fV�5Wg�����u�b;Q5đ k�)j�}O��z+r����^�>jv��ӈ3^�\,W�=�/��Q��g�^�h��������#W�#��R�y=MKǛ~�7�}?�-� T�ƻA�����{꾽ѩa�v����g������� �DT&x�(Jכu�h����ϒh���$#ޤ��� ���g��w����B�:�M�ڄ���u��DV܊G���W2�7�U� (%>�Eh#ݳ#�@��2�|'�1Xlh��-u��OX�͊"L�Q�s* �Sa@�ma��`�@����i�r0����s��~�������{/3�]��L�u���5�3!������~������*�������P��N���o���:���b����V�&�������C��?��%����vc�JG3��t�����脷��<���~W`���=J���7j����J�0��*� BO(@ݤTO0�3���'p�Hv�[�����a~���v�XJ̺J ����U�g��=ۛ^_��z��к�W/Cp;o,V�n�?d[�a`~���JQ�wK�ɥX�v� ���]���j��+U8w�0�Vk�a��(&�M���f01��^;?��u~ָ@#F�(w��ǯ����Θš,�g@� \���7�à�b�2�n�0wG��դ����}�֍��F���}�ae��l���� �WMB���n�`ӄ�� -�nj����'���o����F�|7��L������P�,L�[p�&�����k��O�˝�~�P~�:�� �!C�Y�TM�4|K����{@�}#��6z���+p;6��L+Zyj����(�қ:�mD�ymw���6n>�ik������C�$��ln 9�z(���C��)�d�6�B�t#��9\���E���&z9��cgx�������i9+_����vT!-g��/��v9M䷀���V^��%�
Static task
static1
Behavioral task
behavioral1
Sample
Cracked/install.exe
Resource
win7-20221111-en
General
-
Target
cracked.rar
-
Size
6.3MB
-
MD5
41ac684ba02f0db67804b5c64cfb0af1
-
SHA1
8c7cf9b27e90d7f5cd5ca23e49dc3de2bddfc545
-
SHA256
6b38afe5de1681c8055bb40b7cef3e0b5e98b0bca01cdd6d881ac173fd14d2da
-
SHA512
155ee246925f65a4e1ad7b0b54dd10cd320a716ec8e7d1e2e4bd4328ee3581ca2fed76b31b950dd8f9507ed18f34c50fe1a05921f871b2d881b6d9ba6d947413
-
SSDEEP
196608:QZP+DctBqR89lNNPE2dJmfy8DJ+zz/B1+8OMb7g8gR:+P+NGdGyoAzz/T+1MKR
Malware Config
Signatures
Files
-
cracked.rar.rar
Password: 2022
-
Cracked/dataa/Data/16.0.15128.20264/stream.x86.x-none.dat.cat
-
Cracked/dataa/Data/branch.txt
-
Cracked/dataa/Data/v32.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v32.hash
-
Cracked/dataa/Data/v32_16.0.15128.20264.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v32.hash
-
Cracked/dataa/Data/v64.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v64.hash
-
Cracked/install.exe.exe windows x86
Password: 2022
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Gy3 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.-Jy Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SdY Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ