co�-�\�(�K��3X�)���'ւ��U�Q�ᣧ��e���>)��j�s�ʥ�8��M�w�\��h������X���id���q�2�E��쇊�i�Ӫox#��xGY V�c��&�����������,kE��*1x�c� ��lpF��Md���! �ۏJ���)�b���*.��Qlm��k�E����u.œz!%-Q�}�Ê��LA�9����������I�Wd�l��������� �y�r�1�����!����]�{@;���S钉�Z툹Å ɾ���I�� �*.ɼ��Z_�T+��}b=w�U1�e�i�څB�Νl�"�R��t� �N�%�t I���h�q��yĒ�&��u�^9�R#����Y����@��/U� M��۾��SV��A7�(N*(vׄN[�,��T��Tt� 0e�D`Z�����kH��ip��L�rP��mb.E��(��>ZU�@t�������SY?o�{���43��\��B�Ӆ�W`��u8����Y�s�_���uI5˲6�����#���(�ph��F����-���No>�L��*$b�� ��Ƞq�p�,���xZ���D�xG�y4uS�zR��I>vn��q���U������T+��-����J����|��Bܴ�o��]�|���aN_6�u���7&o�}��'x���n��,D�10 7�������p�B�A*O ��0�}�l��7�<M�C\��K��'����ªk�Z<7�'yQS����==�t���Β������T�x�7�#cC3���A�x��,+/�_���;I��HhF�Q8G�.�qU�#f���4�%���)(v~e���Z�]�"�V�8*�6���G3%������m�j0��=U�pz����k�Z �����H�i>��0a1��s|a��_��t�D�i�Q��Z�|�H�g�F� Br ?p�g6�"�D#�V��᧓�����pN�r��=���vFېaj�Rw)B�<�E�h�J_P�o�d�#��PT����n5d� w�>ܸ5ԛ���\�&�?�0ͿfAZ���Ը��W~S�膑8?@��/s�%r鱓�6316����a2?g��1�ɡ�$*�n��{��23��I*�j�S��`�����:<����S��g�j��k�T$��^x�^l:��"� )ji5kp ��|���)oх_������qytA��D�~D���,����+��^Kx�<��dK��],�/�8�w�}�c�d�/4�� ������Qci\�4��̻�)�������ϲE b(�w���v�vj��ȸ(�ha�>U�Ҕ����1`~٬��A}I�M�^=h�^���jb̙�)r�>��g\q��f���';H h0E�����*����Ð6�L��agB9_3u��� |���]�����"F-"���r��ȟe��s�uz&���X�E�Owsҳ�O� �Fs��"ΉVcR�DJ�&��O3e��3��캊2@\�Y����X�orF��uP��Z�J z�]o����튛�L��~PzʏÙ�����k�C\T��8�7ZW���4�>���y[�(�=�-q�����X:�yiS�[��D��-�jϮM�mk�fZk���s�y����߀*) �]�oE����<�&���m4���Nx���'ծ$�1��b�/�A(�`ɝW��W�*�@�^J��N/�,�j���k2�����YS�*� �ih����"J�RQC�ۗ������R�(A;�v7�+�r���4T)���D�V\�X�%��S��ѯ�|��U��)�ʍG[FTDg�Qz�w���?⛡�q=��&�6�\/ds)������4��M�d��L�ǝ�����EF�G�O2�|]C���}�A&�F�^g _�����:u 5X��/��m��.�E��<������������=W*pM�(��C��]pF@A�M$�d��MR/�Dc#���@N��G�0���c��Bh����ܒ屇�%r��n:Hz��9�g���c˶�����o���Rx�u�(�}�x=��0��/����,.ݸ��I���)x+��@)Na2"DnL�P?Z �ȟn&N�U<�)q�F��MN$M�)o�u��V�&��V���(��~��C:�f�:2�6���p���P�h8tȒZ�����Ý�ڼ��+x�2�ČY�iCl��e���X�t&��E�<�~tS ܳ�[�� ju�=X����V��>� ����e�+e �c����u�q0�6�17n�"b* �USOԧ���Hm͎#�z�^�bP��9���f~���j��/��V����h��6^S@�+f���"�H�Yo��G�6�(T;z|�v�i��r�fz}��ec����_�$�엎��7�BO�{8��Ҿ�����A��UOM�1�������������+�Igd䤹M�!,A������U'l��0/X����_v��L��q �b�/�]�Y�� L��t{q�^��x6�:�81����~�b�8�^1*��zᗃ;� ɊJ7�o�(f-&صs�� �\���<��\��s�� ��5��d�Qb�k����e �Q.)�[پ2Wj�td�<��_�H�^;V%����4���'�R��o!ɕ�D���K�q=c���S�E����9��@h��T�O���J��k����A) �[�9��YA2˂��� �t�j�����G��x��c�-h�^z�cƿ�p��B�p��k�����$[�]: \��]B��L�Rf䒋�7F��5X���9�A���]��1e��0�D�y��Jc2����.�^]���s��s�W�uudPBa� l���]9�!y�`5?^NV�O�"�!AO��%oM���s���frqE0� �#�ii��/��*Ii9L����Q�ISb<ۿ��FM�1�fnF��t�V��L;�tş����(\��X�3�Q��8����oF���&�H�$5��dd|�����g|$�Ʉ��ƉZr2xx�^�mڵ$��X����A[�����F8&og>�x#h֊�R�^��7�Sa�ypE����͵u����B�GZ:�"��8��nRx�����,K+�����aW_|5���酷�A�Y$�:DZ������C.TSD�`���*��ֆ��� ���9��K&��n:Fݲ�gQ;ۼ�ީ����:�O{��[��7"/�6&Un��2�w����ϵ�2z�*���?� <��uIB�p%zv!�+�,��2g&��=��4`;;�\�?�s��}��N,#2K+���e�xHEՎe�ki����_�����\jZO\��.eb'K�[Op���6�S�;���Y�Á.�uQ1��>J�ˤ5�9��מ&�����^[j�P�vc~�^r��r�>��6l0�u�F�")�SL'�/�g�W;�������^P��1N��\ƍ�f���W�N2�i��(>�p�����(�{�'`@����>mKp��o���6���8�J��3��u��R�����_�9�"G��f@h���\�;5����wmV��U��#_8#���Ý����'���2�����r��!�+�MvUmճBDi�M�� ���?�`�y'c����V_U�>��"�v~���bI����[�
Static task
static1
Behavioral task
behavioral1
Sample
3.1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3.1.exe
Resource
win10v2004-20230221-en
General
-
Target
3.1.exe
-
Size
5.4MB
-
MD5
ab6b2550e47b2adf7529bb859b471b24
-
SHA1
87ecc7cec705b918db03de662d6162ceb1323a7c
-
SHA256
e2f9f0655c5ac6d7d9ce41575f573a68d78ea054219f4e967ad11e3be20cbcf4
-
SHA512
e843d6b401844d1be96956793412d31efcebf02e97663764fc53dd4a687ceef846f006bc965a0292e65268a0d893b896444bc6562d5019946b15cb302e74251a
-
SSDEEP
98304:I4/BpzsmYgiIrGKCeoGMNIUHRjbNWUTu4jSlOjh2f:I4ZpnJGKC9VTu6SEha
Malware Config
Signatures
Files
-
3.1.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 135KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 106KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dfengst Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE