BA:�_N�fPc�5&��"�Z{Cr�?�H��a>ň �f���jl�qb �zqe�O�MF�/$(��F뙕�Y{M���+�"A�i,� �hɪ���Mw�O_Ǥ�;�>:��T�@�g}����|G^ZP֑����M�jWK�����~�H��eFˢiE��p�h�D���c:�����)'-.��>8�����Q����㰇F�$�[��'uR@��%�-�.UZ��f��^E::�LQP���C����1���э����#��<�8�NR�"жF���㲙�Tϐ�H1�Jql]+m����fQ�:zS�Y�������K���Z�����>�r�l-�ZDi�x}Y�ڭ7����^YF^���O����4VZx�2Pv7��% Ok&Ӫ6CHq� p�p��13_k�bS���Zq.S������耊=X��S�!3�sv9�`���a�Y9);4�++�rJS�0�R�բ`���"��R�� K�M5g��tl�ε�kW����������1����e�I��<�p>&��"��)����4����\��6�Y�����lXq; P���y�3;VC�,��EAy�{�uk��L����0�;Nh-\��6�+�;�Kq۱��䟪"�Z��������a���XQ�lt��UK!Zg:o�q6� pӁ�O�r�Ϻ�m7C�z�$KF�J`���(R#_gbf�f�u(C�o��p���t�P�>���?nEUT��'����Ԃ���R���}w���S�/�����e !%�.�3��I���e&Ǧ��kʹw^�;�����܌�I/ؽlS�V���C֪��:Z�-�ﹴ��tö�Y���l-�pQC:C����쑱s����3X�gئ��!����uY��"�,�/ޱ��+���l�����B�;_AEH`��er���ڥ����k�q�D�`ӯ=H�i����.f���x .�B �~������_�Yx���w��;"m'�F�DF@)��\�*�W�?�P�����r�s�T`T������U���"�L�qi�҉����5ç���9�hS��\0iWl�V=��b���$D�p���!�Mb��QR����/&���,@6�:`��y�|�?0�Na}��U"����V��?�W~��>�3bͽ�R��vqrli�������c�lf��4����5����!*/�M��@�������T��E��eݘ��^HK��� ��ؔi��R�n�%�$q}.� vFj9�-�:徳�$2�#��e2���k��h�y����F.�҄�n�Ѳ���?�C��A?�H�j��%���@*�+���>j ���#u�3 55��}���G� B�S=1 �pО1d։�����y������jwj��_�*$9S��(*�$��%i�� ��;���~r�W��,�%d���\%~�Q�5^��Ⓡ &���� #���: z=�z���Ӫ��S���>�j�te����0\��XJ hSȖ�BFP�* <A8�2���l�긱?�7�S�K�ӹ|C�{�OU� �Sf��H� �;ҧ.?��+�?��D��!Y_c ��dz~n@�M�c]����;��[����H��X�0�<����4w ���7��د�-3���$� ����r�P���{�(4c mK��Mn��"��t�$l\�����)�9z��؈YKK����ʑ��9�%�d�-���ʬ�l�O���5�0:M�_,�n�V�K3���)�2�/�f���_N{^Wڢ��ly�����_��Oٿ��cvs�g�@�\3h ~�a��e`�h����Gp���ع ��i��H�:�� c Vf��@3�QثI�d��3%'�#�K��0!5k�A>������dι�bY$]���)�;V)��v�mv�o\ǩ�+� �7��ꠥ���<(��gԡR����?�oW�5�;H|Q�����Mf�(\�k�>����ʶ/r�:F)��(��p�÷'\�>"k���E*w�i���������3�Ͼ����z� D�q�X1��{�)�)��D��2Hf�]S'&A�17��+��,f�%*R`� ���K%u|�Z���*��u�A��B���Cyx�����!��DD��i��:0����N�`ɺ���l��Z�F��J�r_5 Ͼ G0��g6��L� �������P�R���rd�F�}pO�n�z��dzjK��!Ͷ���%i�/U�"dT�1���u^��0t�ܲ�-�__Q_�]���o��&�J�߽~�u`��O�2�!y�ݻ`�ȣx�P-�ޘ�Ƞ8-�н�\��4P���SHrB�B{��H�M�ދȫf�k{P�J�jm�ȯz�ʟ�G���`�� �p;5��cn�I'g;w�b!ܣ�|g�@�#�Q��[��{�3i���K��Q�c&s�Y�5}�&��8�}�B� f��g��"��ǁ ~� >�~�x�����b���Y!�}I6�X ��k�|���5���T���'���,1O��~�>w��@7g�a�����3V�������C�N����l�-VI�H�͛ ��ٹD��t�F~n��>th$�-�n`!,�gq�Q�=R�h���L*r �B |�-�~|�R�H9�1��=x,�Y�U�ԉ�y�h���AP�;eɎ W �-'����P/!"kt��`�h�N�����;�y���:�A�/����<���#�A���eCX[��`@���d.�B�#��L֜�O0!��$�~|G��#�D���4x�X�_��d������l�X�b�������h([ڗ���6b���>m��aS����d������"���(����dȐ�A}qӍ�ǂ\�i����G���B}^�[Djĵy���(�7zH�{'WE��}�C˂}��M�n�,�%������5��������.���7�NE��㑶�gm�=|�M��U��*3� ����XY�m�Bxq�`3��S� ��)$i<����2c����%0氆j���Tqx�"}")@�#T�s0���[���/lS'��y<���m��Ca�U�1r���`�$��Wyi�G'롗[i7k�M���y�D�dhh�H�ۿų���s���u&`�2 ��a*9� y�c�[��KҶ��Zi�g������H���b0)_����-�:���+� �V�����q=}ث�d��t�'��#�Qbd�/���+X}v���X��)3(����g��<�3�8�șl��e,O�1��|����x��% �^��3P4�k�4�4�S������?����)�C��]���x��4�V��q�ag�����OG��m�2l��q�e�x�0�Љ�{�%Ԋ��9��0/-�_�p���s�E���)3R�� �SxS$d.1a�����w��2���u,�%ٺ���DD;&]�3@aZ��fH�u2�=���Z�>2s����]�B����CJ �q��m�_lE/r���aK��^��L3��!x9�:]_���fX�s�T�ŋ����G7/�h�R�8�Rf<�����=t�̏j^ޟKa��Q�<[��&��@*>M�Ҏ|8qG�� �ߜ\j�� �tY�)�.����p� �!��Z
Static task
static1
Behavioral task
behavioral1
Sample
51b0bf053bbbd2c82580948ad20db582c0625cf647846e7200a1499f13845064.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
51b0bf053bbbd2c82580948ad20db582c0625cf647846e7200a1499f13845064.exe
Resource
win10v2004-20221111-en
General
-
Target
51b0bf053bbbd2c82580948ad20db582c0625cf647846e7200a1499f13845064
-
Size
2.7MB
-
MD5
6531f6e083225cc3371fbb1a1d494741
-
SHA1
666406a3530fd54ef014d17ad552b5002b458bbb
-
SHA256
51b0bf053bbbd2c82580948ad20db582c0625cf647846e7200a1499f13845064
-
SHA512
9a4f0f4ceb29faf71fb04d35d9b3a0d38b3b04f4d0c5e45dc131780cf6d35f0fe3516af7fb67f9f073816af3a26bc60677acbab7d3af6c11b3db8e93c0525170
-
SSDEEP
49152:mMYp+RBp82yqQzqY6KaRO35d0gPR7dYFHVUwJkYI6H8Cvriqa3OvOPpa3F0Q9:HY0RBp82yFqnfRId0gZ7CFVUOIU2HevB
Malware Config
Signatures
Files
-
51b0bf053bbbd2c82580948ad20db582c0625cf647846e7200a1499f13845064.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 25KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 495KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE