�$ g-���!R+ ����`F܌�so�%`�,K�����$��bx�a2@*l�s`)����-�� ���R����[t��kyJ��d{�S��3�t/`1����Mk����ʉ%�oۥH�p(�F��S�[�Ⲷ��~�A��/u�Fx���{�<v�*ɭ������̓�?i:��S��� ?]�'�>2�M��1r�s0�,�<��<9w���9%QY�Z�aY�F������W!U�ֳ��e&V���-5�����U��_��Y�J��W^1����Q7�Q�����S�Ȇ��[|D����w! ��濞m��68:��wv�'Цڱg��EiAmd�{3�����_aw,4������y0f,^����N_������#^f������o� r�`5���cO���Td���p+�-�$��y��7Y�������:l�|� ;��M�*��ƶ����K�E6�b�TX+�~�{�ܹ�+G���l��i)]�1�P���e*��z�;�����O�Dvg���'v��qoo8���˃Ӊ�/:!? ���2d�?�p6��l�<X�����!`=���z�m���5T��OC ��C��*Q��B��+r 5� M*�f�_h�fS������ fH�0y\�$�W�?jh ,��b�������]w���X�5��[w"�����4q ��Iu#0�{vѺ�V����*�I�#�I�~����O#�Kj�f��H-9���-QU"����|�C�;4�;�`ts!L���Tz��~|>�Og�����\�����>JP)���#jR_��S�>�[ ��9�N_��;�k<1ɞOQ�o\�".��P�}p6�썛�_����1��xB@�,�J���G��A�� ��^,��sx������:w��xa=����P`O!��7�.��0�����|x�E��?�+i�d�ٺz���I�W�S�Ms����23l��͐��2��6��DBV��)�e�&g�j������IN�~g�}C�{G���������+�'�>�!:?�5;��h�8�X`kY�Ya��Y��x�a���]�.����XDG�g�T��E�!����']���,� ��W�)�vU�H�r/{Y�cח�8��Bo�y�?�҉v.���V��Q+��!����V��m貽+����0���*i0����D����L|KO�~T�s�`^i�ͅ�}��5Xչ�s��d��Rf��dE�˜N�jS�"Ei�7�˨:}�h�*.`Lj�s��N[.�� `� I6I���n��g!KSrдnY~uZ�|-e�3�����RWԶ�iM�v���Q�{Z5�Z����b���_��U�?ͳ��"�7ž�h�$@�YG��b2�?f�\��{�;�i�t��^9*EV]*�j˦�QG=�^jiw�8�Ǒ>BV�J�ˆyYq��@S���փc��.!܈�nЮA��"ΐ�Q��o���u$ ΞMVx�<����~@϶�����)]b�,Ӯa�LSF*���[!��z��Q���m�*��P7� {MX�/�4�/��Z�Lh1�I�I���X�p>R tp&��F��QH�M _&�uiz$����������3�K���|R�~���lC 1�k������q��#m|���t7���Kp�+8�VX<ʖ.Gc���!��tH?Qb� ����=R�pnv�"-?��V����m� et_8�(�ng������H�e��#��˯�%eLQVk��W%�Ʒ��_ �s�q�KDq%y�Ku��noj�|����u�L҉�W��\F2%&����������[�\g�T�T�(����� 'ˬ$��{��}��aܝI����O�&�U��m��u�D���Y�~���۬/� yj��nT�7w'��}��)W ��UK���� *���AA{)LB�.�Ļ)�y���J{�Joc�U��ۧ3��ün�l@���z���D7�N����1h�[��Fu��xi����?��L��{��ݪ�<֖8W��1�~������E�����[!����2�T@�}v�t�'q�.]<�D���@,�4������X����.��El��>zW���[Ф.��2������(���g+E� u�����Z����/���a�I�����Koѿuv ����@{�~7|���X݅Q���ē��̫/t&�Z�ɍ��.�*ۯ�ڑ}H39ѣ���Qͣ��i�<������ˑ\����h��������2S��B��Oݵݣ=�X>�/�#� G�K���kC�E�4d�/T���!���0�Ԓ#�1�����3���_���/��ƞ��s�r�l��NG���˽BQ}�bo[:�{���q��,}�M��X���P�e��c.�zP��@�9�┒64i^}Zn�S9�[���V�3r6�Ȗ �R��6��@ӣ��7�vРA�����q=�����!9~�N������%v�dڇ�Zy f��^sۙ;�j�PH�� �#/����o���V� ��͠�7%�䂘��c�� M�l���Sū�eev���vD���J���͓��4b���g"�̺���������kB"~/ly��+����h��'0k/]�9���{��u��,�.��#W��>�H�1�[�Ӟ���+B�E�����z�J�X�4`B�'�������E=.����Y]'��[#>����Io���X67b�qlAR���B�S��YbU!2�p\K.j���#�P��l�~�Db���I�8f ���6�qע����P����T ZY��s�� L ��{���^�8ޅĄϕ�?���q��.���j|�E���e��*+����P�5 �3��PD���vl ��'��[f�Xe���GCX�4���-O'xiq�k n�}ѲG���o!O?��\�2Ŝ��/��͋y���eH�.w�W���)�9J�H�;����"�,\�]�EI��Bu� pKd?j������+z.��7 o=���Gw4�x+�䜁���a��pϭ�뇪�Yd��!>*�Bͬ�}��R�\��Do:��c��@'J�i<eLC~k� �}�}k�?��U���P�(��b���U����(-�P
Static task
static1
Behavioral task
behavioral1
Sample
Keygen.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Keygen.exe
Resource
win10v2004-20220812-en
General
-
Target
Keygen.exe
-
Size
2.6MB
-
MD5
15780f08163c1ca15ff7ab3b7768ad84
-
SHA1
feae3a5baffa5bc8386cf346269eb86c0b700aa6
-
SHA256
33fd35f4c21e6253ed547ce1bc37e28d3173a542eb7be2ab5cff660b77e0389b
-
SHA512
26c5b8d42a6e0c948db86c09a3b31081d8b993c68f3fea7d9dbda20da23d919f4661149635ee8a9f828e729b159d134f03338c365d96d48328a46fc3f4082a1a
-
SSDEEP
49152:rR/lWhuBhlQdcPqTw8OUk2Uq6NpUqCkaGxhOertABQvfwDCG2J:JlWs7lsFTwnUk2WCqyertABQHyo
Malware Config
Signatures
Files
-
Keygen.exe.exe windows x86
290340e4829f190b503143f17aa30d91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegCloseKey
user32
LoadStringA
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
LineTo
version
GetFileVersionInfoSizeA
comctl32
ImageList_DragLeave
shell32
SHGetPathFromIDListA
ole32
CreateStreamOnHGlobal
olepro32
OleLoadPicture
shlwapi
SHGetValueA
msvcrt
free
setupapi
SetupDiEnumDeviceInterfaces
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 550KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 29KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ