.]:��K���~]����.�=�1�w��X�2�@u�Lg��|��Z��@y�Q�ܵl�(B����������y O��US x�EH�Or=t��S���:zPo*��qNu���U��K�����J���R��WA4��0bo��#oN$>�l�:��ى�e�!�,��z$A[��F��?���[���>%Y���U��en<����ݷ�z�!��G�n�D��oU�u���W�s�����&����;�^c�n��`�BS���}q�L��s�����~�Z3�|]lZ��B�)�.8Ku�����a�� ��/�9�5��y����{��7��������K�v����WX�chu��W����+]!���rD�-\���V�� O����B�*��93��� �C�$@T�۬�<d]��e��l2t�O�����[<���i�J�)��Eң��-�^�}M}��۰� 7�C�����D���S��%����T `qȟ1 �FR����G�w���D�>/��r=�>ui�U��+�J�m��O���զv�X���}�)^�6�=�)��#0�/, �T�����儥��cE�4�dCFp��-BP nH�O���ǐ??N���;O ��'� �_��-��?<9W7'��&˫Q�VX���-v��?Vϑ-Q����ؤ�2�~Qp9��"��b���%{��1�X�bx�ۤ?��H��y)r�����*����h�� �ż��( ���l�_V�[��m�5��e�˽��Ӥ�L}��J=mBB���Y�c�~r���]~6������l6!G����*���+�Au�|0�:���9���UH��x�Fnc���M���tT|IF��Fۣ���[~fq�q""�g~�Ԥp���J�!0I&�'�D��&n���h���4]-X�����G�r�m��QAG?N��cRc��/ q��̞C_w;�@O��RuK�}ǚ�zdk��mZ���W��,����ݣs�>�xK�1 b%9w��Z�Y"�Q5�ϱ�V�6��3� X�>���E�\�T��+��^��n�x� ,�Ih_ޓo�楕���qc�L�Y�b�gYW�jͦ㺷S��@d��I(&ɯ�fd҇gb 'ٞOk�P��C>H��3ƽ��cx?��� `yVQ�Ou���?Umo�](���[�n�6�R����:�]����.�RͿ5��r5g��Gk��C�S�«|��bwH���$T��u�~�n0,:�3��4���Э�֩9�_���c8 �=�^�b����XR���4R���{o����)<�������!r�D�W�ܖY���B���ȃh��̭S��;�+���ͥ?��"���,i t��ߛF�ʂ��"�`�F�$�T?Q��4�g|:;�����D�aT6�u�ֽ�\ql��i����GN��4kz)���7�a�N]��OeK,��1�5� ;� ?����D�W��A��/�8S��8*tk��JR�ʶCg��tO�ƈ��eZ�?ʆ����"8�e(A��3���.4�P���o�>�W1��.-��H�!�N��( �<�U�[o���f�]��� -a���a�K�c��r��쌵+sW�rrҋ����ý�{��\.t�ѵ�\6��۪� im+�R��������b��Z���7$k瀈�����3S?���%]M���F��\�z�J��I�dRI�1KiH����@�Vע�M:V�)� �Z�~������*���\}`��h����8`X`������D]��C�ι��~)V*%�v3EV*�h ��aZ�L�~5�?;�@��U�����H+c�N�c�}�h D�N���M�|(,�L�� Q�C>p]%6�=l�T�F3� P�<�fIH��З}S�zl3*�����@�w<��щx���橘�6���d'��F�{�L�=����=Ջ��`Ӈ:<��E*��3⽞=���"1y��@n�؝g|�{�����V ��������F͌�'��%�g���∌�ds" =��aWex�3�0��E������X ���P��J]����pM.�8]]��M��`��%P�[�Ä�Vqx�oO^���Cb>`�ʐ���a�q�>�u�T� 6��^�G�0�(��XX��l)--�>"�D����/�/�#���Fo����K@¦�{V�'�X�H���ֳU5�4GCï��bp8v3/M�����,����=��!��P��c���Xw��;x�#��%l�ϖ�iq����#�_Z5"���7� `�>^0�<�K�61*��xo.Gy/�uL '�h~� X�k�����M�|� 88)6���d�e��m�ߛZ��h�ڏbY�;�������k��~o��ԛ��v�� p]f�k��8�]^V������MTkvFv-Օ�i��Z��!�j��&�b���"��Gt=�m�)&�{]N��nkE3�P%^�P�xm/.�h�r����`���c��t�.�+�dx恺��}W"2'Hm����jB�Gð�~��O��!�t���G6#b�>��b�*ЅV�|�������l�O�K>:��tHi�-������B�#E� �f4�V�7�i���B���w���Lh�D�:O7m.�������Jse�jb\?��hAo����?a�ry�ډz����)#bW<� #���T<�m-��̘xvꥡ.��������q���Vh���I'b�XV��9�KK�N����Tjɶo��}E|�����@N18}�$��3�C��\�;�����N�O1��'����8�s��rs�T+��86�v����p��\���~v�ŷd�l��*ˍ�]�t��QP�'x�y�߮7��8�+fT=�,���L�����F���B�e���)T��y}e2�YXڴо�����nN|+��.�|�ǥ3A�D���������&��-��w��w{{�Bd-{P�� D"��8?�4��uΛ����=��RNM�v9#:.�oR�6tL�y�����x$w�1?L�*���0��t���:��fN�>������ �V��[E���[��P�쯃�ҖP��g�Cy��MK4dI��I��� P v�j��8��@B��\�<���1��� ���:x{8�s��eQ��1a���.xa�rE���v9�@.G�,Fڒ��Oɽ{��Ka�F<T�<#������U��~�^�@�X#������A3ވz���!ا*���;5|P�P��XU\���Ds�۪ F�E1zԪ1uM?��/^-l�l�^���f�dQ��>$i������§n� �VO?6dV��^��t{-p��������A���*���Gs���v��"��xk�U&wG98ݚ�wm�}z��`8Si�G�V���ٰ�E�� ��S0���Z'˯e��`S��)�n��̕�z_���D>�
Static task
static1
Behavioral task
behavioral1
Sample
Emblink.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Emblink.exe
Resource
win10v2004-20220901-en
General
-
Target
Emblink.exe.7z
-
Size
2.1MB
-
MD5
a6aa466a2aee88049b031735186f27ca
-
SHA1
5c2ffe96d6c3ae46585c81a6b0db38354c229ad4
-
SHA256
2341fcaa3d74889e415bdd1a212014296b0fa2e71eb64809e88c2d166d25efb0
-
SHA512
2659083df4819ca0b12d7144f9201ed3eae4ec78553f8929d5d9bedf6a37307415d6bcfa83e6e4e76ec214d07021653ddd2d1b7b8e28247c24abab2d92ad1a38
-
SSDEEP
49152:Xtr0qncqeKHk4xsqRQTmOtFeRDtjhOoqE9zUKpVB:dBncqvkix2T7crjMC9z
Malware Config
Signatures
Files
-
Emblink.exe.7z.7z
Password: infected
-
Emblink.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 77KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE