4PN��Y-��������,P.Ď��I�aTy��;�ϴ>�KCgT֡w���p>u��nH�8��������k9�)��VN��2�9|���/���c.�Iό�f�:K�nT����6�=�*<B�y���̋�)���p�9��cw��k�Y@�)�w~1�7c�5���Q9�ri����Ϝ{5�1AW�x���b(�Ml��>���4�il��&���5������D_����;Kq%̫�C�#^u��_:�3����s��*�Y�� h���[TM�s ��|%��c�Um^�C�������R>!��Ԁr�r�2����d85���y��nTI����d��$)*�oD��U���+�8g�NbD49��h/����C&��WH��?�J=��n��̪h|�ظ.bvTy����G����'MP����,9��%|> �9k�<��� P3)3��� ��b>g�(V-MmNۄ�#ai_�l�I��)u]�!f�-�y�*vNN?�?��P��BU5�N�������H�w�¤❦4T~e��ǎf.���rG!E9$��TMɨ�g�d^���o���3d�3W���D��"(tU��u����q���G�;B���2���:����pnM��ߴ�'\��mM��Q26P�P�o+�]��Ga�/*Z��d��z����1�C��~��s���`�l�sA)~��au���M^���#7�q�Bd�Z^������.y�y�XqQf �'D�萚X�K�/�z���|��$���.儒<��7��,k�,dăuxxj�J wb�Y@ϴx�����ǎ-M;�9q{+C Gẗ���O���̙�&��6����SQ��ybT(扇ߕ�t����2���*]�ĩpXm%mP����{�ŗLz���~ kY��<a��9��x$0�jfyrfX��#ʮhbr���]��m^����\���V_���u��[����뽐#��8��uȺ�p��M����=u�ޯ|�6��Z��l��t�5�c57|x̦R�⟇7b�i�a����Rd��i�����~I��L�C��<�7!Je�C��5�I�"�9�dc ��l'��ₓ� g':���.���zwՉ_'���϶��^��bu7�w��B8��)�#��zc�h������ST���t*��H����~�)���ja�0�|b���v8ȁ�`���?`�y�fru|�7cXL����S�Ż�)]0!/ -2�Y �]��4��^�M��eΤ�u�+%w�ޡ*�E#Gs(Y�))T�B��ZnR�_b�`?y.��ɰ���X9�����g��3E���P�5N �hZ����?2Z_�C�0���Αwr��UKNQ��~�m��]G�r�ݑ�5H��F+¹,�q��|����|\���>c��C�|�fx�x���������9x4�:[;!��6M��ڒ3w����Aw$��H&3��~!A���{�<XH'�n�n>N��%��!nNU�?��%��'A�lސ�ʩq���m��v4��ie;��۾���}����/ ��.�z�$�r4jV�Y�����ۂI��1�q��9�F����-Z��P!i�jOb�Q� E>M���'�J$��+����哲5,��U�9�79������;���[;K(��ůF+��u5Մr��S��}u�i�4G�X�XR>�v0�� g^��e��H�L�;l���tx����-"fv����b8�RG/xµfx�'�w�cs�MiC��K�����Hq��ST��h��Pn�JԈ�x-�(��V���dqd@t��˜2D���-�=h���\��1\UaH� P=*7�2�ss�����766�***b���9��s>G�3�����I�{���(�ib���eB��g��#y���l�ʎ���5i(� !3�R��dM[�nk�� �7KR�6�ӝ��E��s,'��^��1��h��6�U�`=i��`e��Ы�P8r4�$��}����-Kw"j؈���-��_����y3U���])��q"��@4�$9��!��������{��Ǩ>��pW��f��m�d3�j�� ��X��K,֔�ϴ���'(O��/�ώ:N��rt,R�]�^U`�]�� �Pd���*{����\\�i:C�|����Ҧ�a2su)v�+ఄ���[53H�;�� )l��[w����>(��{���_��8S����fQ������u�����OQ7���K�_��3k�_Y��1�f;��&C�aWTCC�Ş7�6W��{Q�e�&�I#�L�u�D!�pGo�zg0Ĝh����d����YL ȃ�7���Ю=ad?7Ot�߽S��"����(r ;�9�~l���"=U� 2{N@�wjɆ�+��I �l�K�;5bwi)a]2�A� c��z�����_,�ܔ�m��&�j(�j@-B,h�.�+,�)*8���Avܦ��P���)�#>2�na+�TClf"t<"��m�>�B=��:h��#����D���F�"jx�y�?��$�LP� �_3�sMo�q��@nOO�7��f�켖��U�7����?�L�EL�Y�QI;�Wm3����\���"���بa���+QÈ�r����Eb����� �Ʊ����^�?��=|a���p����]-�$���b��e�HI���V�ڜ]s,J)�� �8��Z�oy�-���f��v�{҇Ɓ��H�;�b����M���G $�!�c��8�3F�<��]{Ҷ�\���7ee����;ǜ0sa��~6����6�d��U�3�}�;C+z�ϑe#��*<b�{6�l��͍d�J�U�3��Z�6j�ˈN��;�Oq^�x��28F^Z���b1�|�4|m��WT��<1�J�v�Q��r�x(�M�&��Zc�7x�����\� $����Ƶ����O� ��I�'��S ��c�Ӟg��*zDPȅj�2-��f����%BͼAh"1L��ӕ�E�����@��ob�o�iA�]lVe�*�Y�H��G�;��]�e�h�W�h��{������$W�Dz�|�{�.��U�d����]�[�d�zl̨
Static task
static1
Behavioral task
behavioral1
Sample
914961521ae1a181b030e00a57a408a0.exe
Resource
win7-20230220-en
General
-
Target
914961521ae1a181b030e00a57a408a0.exe
-
Size
13.3MB
-
MD5
914961521ae1a181b030e00a57a408a0
-
SHA1
039a2895eafb1f2c533db9533902368e17afec0a
-
SHA256
9d0089332a81e9627912712ccd55aab929e09ea27bba04f7f73cd25a706d8f03
-
SHA512
e9da6c906ccb5880d09b094e657c2f092bf1e87a2d67d004b5c2fb7d867eb755e45ae546c16f3a8057f29a3c7b7f644f6a21de85de4f8395f40ec2f267e17aed
-
SSDEEP
196608:38XlSUIFN7Iclak+ySx+Rf5Ab1m0qGkg0NShRgViCB1828AxAtEUo3MPk/sFFvOH:owN7Ia+yW+1HIkmRQdMbAxAHo8LFv6
Malware Config
Signatures
Files
-
914961521ae1a181b030e00a57a408a0.exe.exe windows x86
16cf5db3878b2dcf0f97ac9d337625cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qpl Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yv, Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gf& Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 336KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ