_���J�>�:r����l^6��_Y�=�q��7��L$7Dď���ƀ���K{V?���P}B�M�6!�(�Nm�v�_z=d\3�黥�1�# ��$C��+��\~��`�S"O�v}x��ƽq���<���:��_�^ p2�X�`4�e��|.���O[��=���ϡN� E랆$��-q��p��R%.�������G,��� �Dz��p������l��'��05 ���r�����O�RW�xm�Ysŷ ��@���v��P��� ���?�SuO�a�i�|A��ia�Hl��Õu��6,���& �:���aJ�8jEg��k��W�o8��S�*�"�������Y���5Ʀ�T"�n����k�aZ�0��us뮦�} � ��^RewC�WXߐ��P������K=k����f��ª>���Q����W%�=O�� 0��z�I�\���U�W��tօւ8_w��Zs"a�a?/yod;�x��M_z�ŮM�n?��Z�������3��� ��G��K���9�W=6]?��r��� b�Z�����z����B���u��|��i��GSD��^���~���L��{ʯD��2X��n�f�6w�R�H�㦯��a�5��<�j ��Ԍ1�m"2�a}��H��ِ�S�ei���q٢kp��k=�%ɵ �6�y�7�7q!�:jt� ���H35t��%��w������~*��B=��gEȩ�������m�NKaK[ ��.��҉��� � 8�����?I��N�����ڏy��2L9�g�z��kr\����f2e>�q��@e��w�w��r�{V�X�#��-`��E3l˕�af���"K���b�ѻ��7�(>1=����1(t�bO�Y給@���f��vK����������H�u�M_((c�k��Fg�-�����a�:���7=I��ֺ��d��t������������T���@��ru��� �L�xs� ^��c�(Ua�A�����D���x���"�m�����Y�i�?�X�?O��z�1[�[!�{��v��Y�����ҿ,\�f��օE�KY Qu���Q'�l�����kf���1*S�g-�t/�`��Q��Y 4���E|;�ԏ��P�i@t�4�]�Ks�4�H儼��ū�R�~O��˸ �(D���%r�DfVI��������"��� K~ՠ��� ���G�h�"�.���B{�Î�W��Gj�6��gKʊ�5fi8+�)����ɶ��9���K�5H.����KF���![E)"p#F'ٓD�Dō<���ŧ4�8���� �Qլ��4I��aU���,v�_ESQ�|�\�Fp��sτ�0�,�����J'�ɑ���yЄ���{�O��G� 99U� �`0�l���$Cҽ�$��E\�{U&���Vpi 7++���>�:xj�f)SÞ�6(��.yN��Z%٢��3D�S��D��� d41o��1lSU�r����wf��_xL���Қ����#�w�����,�����0,�H����;�47��^�f�/倂��'�:����nU�y��n�r�s��`3ܺCH�Dm�3�T��#�e;��Ej�+��~NN��]�&�t�lPk]��춑�^H3�}D2�`��'�ě'��n�[R����TaM�^j���Pc[�JHe��as���=hp��q<�E��3��s�����G��F��b��g�5��`z� ���5co{��R�p�v�qQ��&���e��Ql��y��zDD~k����Ы�v\B���f�*�K���t�J�t�G�uP���|�HS9���e\O��ه�m���~X.��y�j���;F��� �\)m��,�WoA:��9����=:�@�*A���f'1�F���a��˸秿o0�чD����ψ��A�����K(����G��>���?a7�u�r;�]�D�ZC�W_Q���< ��&�����C�<$�8A�r�n��K��1����/Q��O�H{���b��\�/Yf���s���(��cx�bSv������E�>лJ��x+i=�x���%E�~1�(��?E��y�����Ry"���~#�_�km��|K��t9�g�u[.���9�T�~.��<�zvFt����d�5��y-&�p��H�kcB����:�&t�m��Ð�\�=~6�5q8��HX��r�̙k �|6Hq>��s:g�n�C��X&9*D��� ��}�K#��:�9d.�7e߲1�O�b�*yTG���� CI�,����m�Q�ЅHLES��� �]�J�A~�T�9��˨������)�I,���meP?#Y��6l�cS����������=h�\)�R��Ĵ�Iq�`�<ܵ��>�#֥4<�x���C��.�u�g{j�͇�_SQi1��9F�Pu_*��rW�Z�GD�] n�Ԭc1#����<��>Ŀ57<�AH3���=�$��\�=?��?T`���O�S��*4,`%w�L(�BᄨF��ϱ^�r��R��I�� ���^E�.~�xE�9a��:����3l;�{���c��V&#���IdDź��Ң�`��O��3��5���;SR��5�{����6֢��ݣ��+A�@� ��6o�9u��<m0��¢��t`��립.WXS\�}��4�7��)����n*��S-yt��`ve�R�<���a>5t3��N2G��~'�,՛;��RPb�Ϊ?��}^�p���D�{��7C�Ru[鶀�Me7G�,���Q?{/. z�]���ݝ��I?�9�ܑڣ~(����w|�W5���(���p�(�;F?�\����Ԭ�/��6�o�'Y�3�=G���EF������Yg���_ ^O�"�P�Irk�ӍDZ�e�������_�fe�!���[N� U���5b�;H�����0F���e�ng�`�c;s�rx�� *���+:�]����C��u��w�PK���9��������ֳ�&G���� }����:&GOoCO��Tጙ�ӛ���;����ٜ�T9�B�� �vU�������\#�o�·�|nWda�����g�
Static task
static1
Behavioral task
behavioral1
Sample
d7eh4zQ01VMimnB34BJB.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d7eh4zQ01VMimnB34BJB.exe
Resource
win10v2004-20221111-en
General
-
Target
d7eh4zQ01VMimnB34BJB.exe
-
Size
4.8MB
-
MD5
07b79a91bad1618cdf1828997ee09df3
-
SHA1
d3ac31c9540edbbbbb9b815287808f47bbbd0692
-
SHA256
5a108eb10751551eaf2fdafee5c9f05033d6d83c524dd20060a464d158cf1bfd
-
SHA512
d8ba6f8d1f2b6baadcf7eda5c0cf59db418ae8371ec37cb11266ef9d59b0bda152775b4f416ace72de7ab2c94bf311378efbda0ae30aa2f6caf58775a057e953
-
SSDEEP
98304:qr5z4M9qNOtHF33FJ6pO/FUSrAcD53U08RRI:eyM6OtH5FM42SsX0C
Malware Config
Signatures
Files
-
d7eh4zQ01VMimnB34BJB.exe.exe windows x64
fe519c6639c5d2cc49d3e64522c60dc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTitleA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ