$PD�\�z2h*z��R�u��е�<�����c|��>$}�иn��k$�ap�V]��-&�4�xyQ��b�HU}�q+��k�@��cJ\t%�|�ot�So��u|c��P��$�se�}����%�v�)PSa�2^499�C�62��M`���F��A|�����5g��bZ��E��;k����Vv��y���h�����G��M�[T��hN�1�u�CI�6X�~aD�/�k����c��{�2�c��a��ԋu2Sq�t)/�J=��Ll�k���fA/�HI�4/Q�ѧ���,��@}R/�%\�:�bBqyR?דZ!��Y�^bmB�OU*>k~zž�SL�FY�ET𬢑\�,���\�f8Pɴ�DNT���^��J�����O�o�A6�|~����j������y��;̳�o�,��A���)�h�Qo�����ӿ�=����y�ج,[��I�n��g�k&pK����2F�2Lf1w]��9�B�Y��K���(�� �:���_��z�(��t'�=�x5������|�h�o x��镊K ��Lg4va�4� ��T6iFr��A([X��9%F�c6zMo 3��)�5��|�@��a��̏�s"�\/�������4�b86}�;���I����U��������oqZQ�r�D��B���斀q��#��(�($5�c��aQ���x���`+�NWBg_n2� �afn�5�EoO��&�T��#.���cW��C�^������]����)P�yd���k�CǢqC�H��NkS܅��/�`�W���q��-(~�c9AXuK�!&����?��2�u�U� ���f�����?�j�h��i��Tor��H|��u-�E`Ξ�m���ޏ��w'�uЎ�Z�)��'I�G 3F�Wn�f�ˉ7��7sJ���ߡ�l�E�&M���1�D��F]�}��k&(or��鷣C����3"2�2���*���<������%ͺI^��_�����(�T��E8IC}Ax���q*J��ms �/�Kv����#�v�hd0-��-f#�:*��#A���O�����vYbVv���,m�����17����O�6�k��^Ƙ�������4m,����o\�t��~%�t��SK���2.��Y�%��fH�X1F��S�?�]�9m���6���4r"����SK����� ���a5�Q���70������>���eAv�1���T���Z�x '�̛%7�Tz���f��r��/��*v�����2!�f�2R���6��ߍ��2r����h��O~��O�V������A�zg���@�>��:��NI>�TQJ$�"�8��s���q0/ ̚�����o�r?�:�{Bp��/c�M����1��������@�{���%�^Ф)?�M�{䅋V�GD"�`V��y���=����j\i�E����H�MX>Ok��b!���Qɋq����9�$����I9-[v0q��o} 4�!ɜ+g]���,_�|��������m�*( eQ��l��O[�&*��S�n���wC��� M��C���_K��wUBb�:��t -#�lj��W�Yu$(��uN ��(���%NͳH� �Uu,�1�S� ��b��2 O����3��U���gR��k49�E$�o� ������[j�P����9�.+7�D8Q�g�l�s�P��n��Z�'l)f�d:��VE�qj ��?dDQ�Ћ3E��R؟#�+!�'?ٯ���$�����O�R�SG�]��P��T���:@�M�J}Z�z7��/���]sH|�0���`A���������"�X����x&�Iaȧh�K�V�7����(��K'�}��[Ɓ*����EQ�~�<�����h�H�5�D�;G�s�����o����vJ@Y��niou�CZ��P��m��ܡ'*P,P���9����N��#/�K��ht�5+�Xu����x��B�}өMx�t� c����G�>hQ����G{(7�8e�VWQ���v�ϙ�~}����}߿yd\�R�L��T���CW�%���w�����㴿[��y����cV����U��Gŕ���b�r�F"#BMCH�<���89 [�ə�����rl�����〖����#���V�1$��( A#`͠ S�qkL�O� pg�DY�Qk�������X���=j~d�y �FP+G��c^Cs!w��:���:��:�&��j��'ZL����˭������g�<ޗ�4�lF��1�(u뇗@���"��J��4w�L�ϴ�ac�g��n�sp���Ttg!�Z��0��*��Í��]Ƕ�Χ�X�T�$ 7]Z��o��6<�.�4��}��g�1��YI�[3)�V躡\�3����\� v��=�L �E^���W���hP�9� u�p�t&R��:]�#�@@����m�����l��Z��k�� ����2,���0����9Dz]��� ����L��ͫh�*̌���A�� z���w�������#Օ�^�ͧb4��gڗ̄��)��V ������2(��p��e��S-z��q/ST�N��Ϡ*4�D���E�B�t;.|��7.�x8� �R��#u�7�cxn%%��A�=.`�y�}q~K�T�1 ����m�3{ސ=d�Hb����z:D0[3g���s8��/�5z�k_�/����u� D���*��xQfW��������3=��JY����P��n#cRZ�� nW��6VT������`$!�6���o�q8��dԮڻ�Ίn%ċ�`���x��$l�K �cX�D��D�����^���dSߴ$�0�e4�� ����D�Db�*�+ ����)����ox��8�Ù������[9��wsc=ƨ��5N�V����lJ��F[[Yrןk>�Qɧa 2Y%�Vپ1+��:���=��p�y[&>��KŲp!��W���5B��Q��u�����/��ӈ����:��wZ�Vz{x�q���E��+��աj���T&W��S#��qK|��<�������F�2���m�ӧ�0m1́�`^vi���Ԍ7�I�#[=D_�TV�B��(0(J������;2���3Z�o�A��p��(Ty�wi�� P�p�A��z�$e��%����R֍�NH�2�J���ً�csV���y�d�OH�A���~�(W�q`? |��/p�����!ؘ3;d�ݪ~gCW'!�}V���O.03|QN`�r{�G�q�����R�t�t>4����L�������TV��%�t����v*����]��I�v��m�+"cX�cvo_ķS+JĞ���
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file
-
Size
3.5MB
-
MD5
02754c35d35c296c45bae5581558a14b
-
SHA1
fb122d44ca1a1d804812132a4f828204eb42f9af
-
SHA256
e39439307ffdb1b1d78c7d136022246fe6e7520b54b594c3512597f8373f7ec1
-
SHA512
68226ad742b4ca78c615996020a7505cedc689c1eb48467f2957d2a4eb736263915c38af097ddea7f5a2b07edfbadae7d61faf0bc60e24eb2289487e8b53013e
-
SSDEEP
49152:uY8pk/kpNc005Dfu4y9o7sMvEoLcQy5UQ2DLzK9wYK1Fo6ujkiLkfG2c/Z51IZr9:Id4DG4y995onF3DLe2LuzAfGP/Zb5j0
Malware Config
Signatures
Files
-
file.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 857KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 954KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 92KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE