< �kc�M|���6F��;9��r�һ"u���P���RU�� H6�r[��0MG)��{Y��D��H��XX4����i�E��[ˇ6xi-�v��_G�<ui��0jGJ�V��a|�9�z$����j�!��e�oA*��vWm#�]=e��r����b^�E�4{ub�2/���L��1,��'N}��9��Cy)�i=I0���s0����3�ۺ#��,~l��fB�q��+z�?h1t�#� /]�A����w �=G�l�OV�E���������zw�����=ڒ ��B����7����npg���:0�Lv�Q�DXn��0k]J�"G�T"&�Z�D��L���qOfDj��`�+xI]$�����Q�u���B���_��כ$�x�O`f�i<�)�^l�Z�z|���N��7n���+2�%�� =m�w����V87�3�t���@:[�.���oR�� <���Q�,�6� ��P(k�x@P���f5(58p^�J�7���18��-�� �%��(��q�!�R��@M� h>���N�Q]�~;�R /s�m=V�gf�b4avm�ɼ������<d>��m���2"� !�9{�nB�=.�n+C��V����v �(� �=���*�rj[[�GA��fAL����I]������G��� �4��VX����|7�:gdv�CB�"�ff3�nu8�du]K~OQ�3/$FY�ɘ������7n �Q�ٶ��9��o�qH��l�6�sӰ,�����{�Le��>��h�$^��S�F>�D�:X� ?�<c����:w�8h�=�Xq�+z�w:\��R�*�2�*w�`SUL!'(��{h'ߖ�yͣ ���L~S���d8��D��xS��CPi&����N�͑��)]���>t �XdG�ha��S/*l�8 �!dZJ-/� �5�_����le[PC���}� %^��n��0t�$^bE���?:B��Ɛh��p�>b9����7'���K?d�.��F�?�J/"B C�e�e��P�vپ�{��Z�JN,I��Z�K�N�.qѠE�P��=U�Po.ᘇČ�I�������:+;�����"p��|���4�qu�y5E�w�7E����_�П\��~�bR��rH���;m���ynu�۩���U�k=�� �������P�R��ZS��ĥS���:M�w�g��R2�`�gt2�6�`� �8�����ρ��d��n��v�I�)bYȊ�C����O�����6��������a�_��^e�� ���~�COL�{NN ���|�~�'�녋����8qЫ���u�����,c�5�j��VC������*�dT�*��G)�$���v.�D�?��>���Pח>��;Y`d�>Ln�P��9��~��p� �0_�Ӥ�~B�i4�;WL�C���0VL:Y�f��Le�����/�jn�I^B�'���f�'��9�;䑆�#�!`���U2|��ę �� U��%��2O��e���9�*!� ������$*��X�c0XW4� ���G��ט >]�h�v�eZ�[{�ӣ����=��-*=����E��WqYE\�@в���='�C��ay����Rm=5�u��UkʧZ��,��"8����0�Ǔ���x�*�{���F���v �%6�7-��� V �EC<��3��p���I)�;��-T�]�8Ah3-z���&b`���t�V�����DU��_�>�� 3�W�n��#⇔�c���A+H��J���Ҥ�.a�iI���餱��m��r\<�p#���� ��7�MC���z�駙���/��n�+bu3���,��/������B��V�AR%� ���M�UZp�m(/T�'0����k4�H8�iY�q�eA�@����Kǀ��Q肰8�;��,!�>��ל��>��ލ9�A��z��c�^W�J�$�k�I�g�&?� Y#b1kZ~�+�_��ţ �Pִ>_k�E���n���@ o���Rʤp��)ݚ�n�>�`�a&��խ����Ga(.m��#YpLݱ1�OJ�ր�'�a�ޟ����B�A��j�����&��[����b�~eg�I���O�:�� 7���S�}��f��`������/�`Ie +�i+������!���/�.j���Z�@��0B�֥}�A{d��� ���Dt嫣X�|Y�/V�gx㛮�Uô� �q%�v��1�&Y��l����j[�s�#�J$Ԛ����U�O���v��g�Mga�=�v��+�f��:��#i�Y�(��g>r�D��=Y�&)Y���e��$S-����)-I9{0WEsf%��E�Ì$CWGw��p_5����+��}M�*��[X��_�D�-����T<ì�5c�T��������J�y�U�r����0����#{�$%Po�%�<m�8;��[M��);���6�wB�$lkφ7I� ]���SG�Xr�T�KZ����b�(zMkׂ|"8vE�����9�ۅ�s��8%E�GV���Ng1���;�'a�p��^�z�By�f� + ���������4���m���[�|X���T�R�u�˻<���\ͤ�����$>c��秝g�:��A�Kj\Ӟ|Q��̠%r�*� H|������D���w$grÕ��%5�")��3>K�Kv��qRx��E�}N��A����vw;��_�;��V&[��_R�e�3���69v��^h���{��剏Ӓ*"O��� 9f��v9��%d� %%�DU@�h�.j�~+����� ר"z�z_h�o]|��g:,��[��K����2J~� ���,��R$ ��op:����f���'���7_X�.�^:�7�b�+T�3��TS����Т�@�(r�!��j��Yc����&E���,�����e3�Y���"��Tr_���. �w��m3� �|�@##�SQ�����^!��ۖ$[�m�����K���������T��kd2q����_ ���� �Wy�,`hWfM?El���I�^d�7�����V�"�6)Mu��K�9�yS�J�����������VДB���Ԡ�nO.�����g�oB]6M�y]�$���[wV��D`��鎥!����14T ���5Y��9��(���_p�g��A�|��E��\���l�cz���A����8[�'x�{�+c2>N��ּ7� �����*�k>#��Ls�C��\c�f���Ii�l�8�1����Ӗ�м�Ge�O�%�]|��G�sJ��n<(��z���!��H��T�q]ҒW0�`����s�����I՛�qZ#�]%��e�ll���"����cUu\�ᒢ���d�_��ө��(��}��L�v��G�fVl݃��ޝ�:D��|m"�6}�͍�[�L��r3����ڿ �%�G�j?6�i���Ӷ�0�,��7��ʨ��`������@[(۬��S�g���;���7���k�T�I�e�Fr��Yh܆'Йg��M�z��]=��8���L4�`cJ��e0�1v��:vgU��cD�5c�f�$'=�$���ژ���P�Գ]
Static task
static1
Behavioral task
behavioral1
Sample
c6382f4bd02d50bd54a4c644a6db71a3cea3c6aabb6534384bb033cf8dc50e13.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c6382f4bd02d50bd54a4c644a6db71a3cea3c6aabb6534384bb033cf8dc50e13.exe
Resource
win10v2004-20221111-en
General
-
Target
c6382f4bd02d50bd54a4c644a6db71a3cea3c6aabb6534384bb033cf8dc50e13
-
Size
4.0MB
-
MD5
7756969fcaf00c50e21f7ad61bec9a41
-
SHA1
9bd884be14efcc478f190f62473280127b57adfc
-
SHA256
c6382f4bd02d50bd54a4c644a6db71a3cea3c6aabb6534384bb033cf8dc50e13
-
SHA512
e6699394db788bd51416edd87e519df87de4455e11326e992b9e1e5ba73c0f0100cbd95f62881194038b2ec732dfe1ad18077b2a50e427437637856ed9ec43ab
-
SSDEEP
98304:uy6a4tqlFKCQUO5xSLqU0deN+SNPEjZ5:uDtqlFKDrY+QPEj
Malware Config
Signatures
Files
-
c6382f4bd02d50bd54a4c644a6db71a3cea3c6aabb6534384bb033cf8dc50e13.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 68KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.1MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 537KB - Virtual size: 540KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE