�ܒ�M���w�P�������x�4a�r���s ;*X>o)w=D<���u%w��$䝹����+A�2`��P����*�����w�P!WYx� ��,�9��.'�yA��#S��1X�6���ަ���a��s�G�W��������|���x��Lbʤ�9��o7r_�;��`J����)��G|M�w�E�"���#f�]?��D���(w�d�J�T2\����B��1�p�iͻ�S�$��翵$����$�:mM��>&l��6�{e�;�D������AB�W��P�D1��-���]I�&�Fb���z����Tm�{�������y߅b�m��6�-��c����nv3�T�o&,pˊ�_���_��s�x ���]�Ր�������Ȳ��D+JlQ7h���K�(���J�F���x�E$��v8O���.���R�wۣ��$7�����L)��}&;a֧�}�"��?<��D���� +M����p���۶F����+ψ��G7,��)��(z�}�>w����ے�o0���/��iL� .< 3X�đ�]���yYք�5�:��|{a��G?��_^��� A�:�E�d�����"�!������/V��,!�'�bpm1_#���2���m��R�k��u�컡Ŏ��1Iĭ�J�Ii ���Z��m�D:^Z}��8��eQf�-��%�K.�%���fr�FQU��^=fE��N���R�9�:�����?��gZ�Ҁ�}:��8f�P�?`d�8�u��w�3������ٷ�S���§@cQ"�vdX�n�-���,n�� ޙl����������������U7��2���YѦM@>��p�d���fa�[�<}$�3ŬܫK �U�����P�;�cHB�3��L`�(IV$:��aEC4���X����� ����#�����K���ܱ���f�i�Z��IT@�W�Z�E�lj��1;��Lt�� �80Ѥ5"#��C����Œ:[�S�<$���A�s�ip�UzTt(��ә�tV�פ5y�U�zp)�|���v�'͉'w��g��}K&�g%�m�:~:���|�5�"��{HtFWF�1I�"�|@9X����'�1�g1%��3 S�2������CDO�%ʢ���D�Z�ȸ��&y�0� ��e��f,�D��WO&��j��$�:K0�����������淖�������+d���l�P�,�%I�O��y�W�ɇ��{+s�w]C��E��[�V��Z��<NA��L`y�:�,��R� ���_�R �dM37z�X�ɹg8�j#q�_-��z��S#e��_z�+)Ld�;�� l=w9Ei h�c����Yvz�����k|0Մ�DG��-��mW��'�|\D��a��y�!�.�=֝�Y�ޠk<S]Q�S���|�W��p̅�H>^>Ƴ�#�6��g �"������"���4W��r��9�#��,ޙ"�q��AK�ٷ�4���+�m����Ώ���y���E�Hq��)m��G3~.�l�U�v�тcJ��B8;9V�qNq}Vy�z�<WG,��ĥ{ �e���!R`�Qo�ݛ@�8���Щ(����oz������1���H#���a��{-+�x���(�uϳ�-7=�b�1�7;!I�<ஂE���7d�xB ��{xR����7Byr�����A<��t]�v6��^�iJl�ԃ�S9�U;�^a�U8�Q"WR���=����lP�qt�f�J6�7�,f�d�V�I�����9�\��B �!$J#�F��C��t3�\"k��kr�R��C蜤��[�l���9��hj����ܥ%5<^�q������.�I��2a*(T+d�6� g�'0^�'z����K������t~vo��6���dz>�B����"���-�dy1�_�%���(��٠���=��#�jU'a),�ެCuХ�ą#��pv���Y#�^������iķ�[#��U�����UuǍ�{Pu��^��"��I~�X�0���~��<��j���������&6�-���a�r��\G�J`h��`�-��d G��"!�l���C��4�;�9���\�R�8'G^©E��� �Z��r��q���z%~y�t�� ���6��[�Ka�Q�l�5琊�2�.4-٫��w�Sa��{ ��!�p^\�l��=�P�� �@ـƮh���Wt�K�Q�]nӒ��`P�+�H����`N�_��b�+8a m������m!�>��k8���g����5s�V��7ܡ��Z6���9���(�[}v���$�D>P<�m+�gh�G�� w A1��|6�e�5�w�b+Y)���sK��&��,QaЏ9궗�^+� �p$��[j�\pm���#4� {�+b������Hz���*�r��SG���D^�B�a[�fP�b/�KI(��]�� � ��w�@^W�&T��-u��<��p��}z��s�0��^G���)/8�Q!��90���U�m!�\���J��CjP�gI�x���t�ߜ�|I�?��Q�3!�[��f���`�N�刍[��#a�4Pҡ����6O�o���:x��3� �$vm�9Ѻz㳻� ��T�:�k,��K�%��oۺ6�+�8���E8{q�>Ʊ�LF��bD��{.��w����uW�r��%����ҙ�#D?eh��hAEc��"+���`^IQ������'m4��T�?A�Q��O�%M�����{�R��נ�x�f�c۳|9��$W=�"����͘k��T�=�<I?~/7؟�2��$�$��c�`�Ox��&i����r��E6��+5b�ʲ�1m�<n�����O�>y��̟�e�y�f�����3Ǔ��ܪ��v}��R�'�Z�9��� �ɂU�R��&�%�oG\��D�������!� "�T���KH��'{��Y>��%A�$wgNV�9�����;�h�� C��f�h7�Ea0����/�ڼ!�I"���s��� }�N�e����\wd��� �Iؽ==dξ��P��I��b]����r��^� �y������]
Static task
static1
General
-
Target
Tom_English.exe
-
Size
40.6MB
-
MD5
ee7eec17908c066120732dab387a7f0c
-
SHA1
6bc75057f365cb7e1527f06d6bab505bf45077f1
-
SHA256
97ace3861b05b846d1ede1070ad54911e4618d6c48e126f2b5daf37752ee1d66
-
SHA512
a6374e7ddc28ded085f980a96e0e05b4260173338fb4dd75b99e3aadbb8214c24f62233154f5e99f588e1029ed4f15710c5f3ef4477db03eb55a602b198a7489
-
SSDEEP
786432:0NceEMOVeq9na6lqJFf2KRT2HbUcJhtSNWkT0Jobh:gceE3VZ9na6lnKRTcUYhtSNx8ob
Malware Config
Signatures
Files
-
Tom_English.exe.exe windows x64
6dba6e793e5693852784dc1e75da3c5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FileTimeToSystemTime
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
CharUpperBuffW
advapi32
RegCreateKeyExW
wtsapi32
WTSFreeMemory
uxtheme
GetCurrentThemeName
dwmapi
DwmIsCompositionEnabled
imm32
ImmGetContext
iphlpapi
ConvertInterfaceLuidToIndex
userenv
GetUserProfileDirectoryW
version
GetFileVersionInfoW
netapi32
NetShareEnum
ws2_32
inet_addr
winmm
timeGetTime
ntdll
RtlPcToFileHeader
gdi32
GetDeviceCaps
shell32
SHGetPathFromIDListW
ole32
CoTaskMemFree
oleaut32
SafeArrayCreateVector
Exports
Exports
Sections
.text Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 507KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 511KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qtmetad Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Beg Size: - Virtual size: 31.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9/" Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LM2 Size: 40.5MB - Virtual size: 40.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ