76�`����B�C���dn���%^�"�[8-��s>r�W�3��>A ��[b ��@r+�B�M���?q�����Oʟ�r��.e�����ng�Tu1���P �������k`9I��텿��K�����xbߗ������ �rB x,cfE�5�E��n8�p�%p� �b��M�S����d��A��@w��P������ykh�X��7��'���~$g��;���Т�D�VQ� EhmV�0j>�m ���0����Z�a����t�?-����p-�uOGP;x^�%����n�� ȪCt��)L����z3���Pm�g��Y,�UΨ�}\�ƧT��,Tl���s{��2��UD� e���%������<"�[��.���1��&�M��W|�ޒ�PT����iE D����$N%�����j?j)?�w�e�H{�� ��:��č˷�3�y!�F��C�@���!��2�{��U3�ȸI�/��X%�I�b" �ai2����DQ��-{Tw[~�~��T+ j=���q�&$�:w�,.c �)�/�U��|��7Un?ךf��y��ÄuG�vK�n�m9j���tJ�\�2�$����f˭į��(��*)He��H�6��oT�p�$t`�I�\TJ���� �9Ha�XVer���w�U�Vt���F0$�kB J>~|��wu���d��iaG�e������hޖ�m��t�յ�B8,�-�H��F;�S��0cՒO����5�����گ�z�yQ����2�)[O���e���v6?��t��/w��� �类'�x �طD�s�xY��w��W� ��<4"�E-Ʈ#������&�%K��g�����9�����Ɍ��~OqQ���JE��W�j3��<� WgRR����ז:h&�6LZā��c?�OK�'`�Yhp�|T��Ŋ��������e�c4�?-m���VL���VO��� 6���q���|��*��D�>��W�������h��%�(T)1�W�MJ�Ea4d�d��%�9�����P�>����m�r���_<��8@�r�g�|ļ�'��D��&*_#�����1�ٮ���"*Zښ~x2��m`� � -~��h�f�3������@��"��-Y}a��!� !I>��-tZt��@�%��ָ70k���W�G�\�#��F��j��o�H/r�}�c��#Xj�p�jH?4�2��#�1�����Ɛ�K+��� L��M��>זy綝�K�����iHQ���U>�C������&�4P+�..#�e�lKL�7ƾ���C��tM��PtF�2��S���q$]Fc��^ 2]>(�Tۧ�Fi�J\�닃ŵ� 8���������Qm�eKwJ���&��?M`��4>r��K֫�l]�H ?,���k�N��]=��o�@���YJ�!��ɚ��ՋˤP\�b�!���|DIP�Þ�������2;S]<� f�p��D �a�U���������iR��RƤ[s��Xה@�n� ��j9����>!�4חÙ�d����cqέAl�E{���"K9�RX�X���ʗx�{�E����n��ڗ�F���*��o�yy0��E7I=� D�Av��O)���_m�2Jvh��ckc�]߯��>ꠎ��W, eZ�/���Ɇ\��=M�(�){C�q�g!h���pidu��硙Z@���(�4哽~�nڄ������{U�O:s�����"���&(��)mX�4TB���Wl� `� ރAd��q�%��5�o�?��q��E�܍$ٴ7��0��DxvkȬ7�B���f'�y��N��N�i7ZhP>��b�7cv��Z���` �k�.I*U��/z�;������_�4����g�����������<�>��n�mZ.&�6�qf��8T1�2��D�X���+�r�ì<su�F��}҈7����K�S���/����P��5�(� ,�$�WJ���>$�,����2'���-e��D9�<�ŚV������0��ܨ���@�k?��7M�d�N1����(=����aQ"�e�p�wVV�����fɘ��gI"թ~��= ~�J/�t�ĕ�P�=)-��%_����1�� L؏��?�S�ă�zT�Y{x�#�����Y�}X������=HT��癬yK��ڽ��a�j ���gt�W�%�ǐ��b+E� �C��An �tE�I��� @P̠s�Lj�t,r�$�Hk�ܖ���痩�qhf�Ҙ;P?KI�o`"U^�J�46.�Þ�R�T!���������� ��j������@ ��BUj�e<��f&��ݻL5�liB3H�I��k�H����&�4�낥 �os�G��>k:^�8�[��6SS(�&�ʎ)&����d����"���1�����*����]72����/l���w�:7]�И���¢H�aw���`wO·��e��i������v�F�t������3\Bܚ���S��d�ZB�Lm��Y%;�<`(�1f�}�����>���y����^U_�d�;<���#��x�^a-�pusɴ;����bEyZ�2�d��2`Z����O�d���2�-�H���=p;2`��>�eg� |B���Lz�2�\*,�ZM��[�F��U�EqQ���T�B$e-��s�Xްn3�>�L�������ʉbc3%S������E�C7�y�t�YWs̫���!x�V���(��<b�����\r�P@��3$m�w�e{a_���|��֝�|l(�W��5Eu�S�\R��IS�T2����J�#���`b"g;�vT�������H�?�"����E)wU��əl����ƈ_�o���r�m�O�~;P�Ue���Nj&Xo�Y�YY���y��ڇ8-q�B�����§�U=�0�2�J��%'P=��ģ%��3��w�`<���S��ѿ���}W�ӯt���Yܚ�� �����}����b�U��W��u��tɀ&N�z]j����K��-gON���AX?� ��T��!ā�ud~�Hɺ�������{��@�A�B�LF��űh���K["�
Static task
static1
Behavioral task
behavioral1
Sample
efa2fc94a573658b861fb3173e77327778141c273da6bc52a1dea7e102f33b76.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efa2fc94a573658b861fb3173e77327778141c273da6bc52a1dea7e102f33b76.exe
Resource
win10-20220812-en
General
-
Target
efa2fc94a573658b861fb3173e77327778141c273da6bc52a1dea7e102f33b76
-
Size
6.7MB
-
MD5
4f8d900b2b895223a814f654f56ce140
-
SHA1
2c3c7ec92707b7e5b60b075ba68f2952bd499c3d
-
SHA256
efa2fc94a573658b861fb3173e77327778141c273da6bc52a1dea7e102f33b76
-
SHA512
35bd60231331712ece6689c210dd65fa6e75e9ed63ba9423b798a4d293f949961344d61b47b830f99f7848d887f0bf750d94b49714d71953727e9fc0e0d3f52d
-
SSDEEP
196608:GVO35TLpYZFuZu9BwlrQPB7Hh2gjwHOya4yYt1amSuPDmAD6z:GU5Tyq6B+rQPB12gbsy01XrhD6z
Malware Config
Signatures
Files
-
efa2fc94a573658b861fb3173e77327778141c273da6bc52a1dea7e102f33b76.exe windows x86
560f5833a24923f2c6cd395059c32581
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
GetUserNameA
shell32
SHGetFolderPathA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`|$ Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gti Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LmZ Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 569KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ