+���{����k���H�i��d�i�(d�� )~�J�x��A�F�M���V����J��|��\�S_����n_&Ų(����K�De��[`rz&�s:�G8�%UA=I�c�Ns9�if�e[�ݤ ͥ_�w)7�S/7 �f �^Z7���B�/cO�g�F�L�j^�H���~��i*��s(X%���DK8��_BB��q7��n�����<��܋��G���|�����x qg�3B_�%�������{OyB�@|Z���0B|�;�����s�v���oA�ctf|�;d�6�1B�Q�Л+�/iw0�@����"njT�ot��̎��ːz�>��Y)¬�����~�} l˛ÄH�� n�s����0ÉQ}xd�hX�cU�݅G-)��/ڀ��|j��&��м�i�ZO'?�f���:�l�XiХ���;�C.��9o�7d��jU���mIH�P�5���B%|3.���4��5���������`֪��߆�*��_��xu:-�-*)�u��B�� ���͊{k�Ç�����U���v�P�xß'ˍ_O�i�ǜ���RA8�����V����,xճ�w����ܒ��w� � ÅY�}-E�.xؠ����X$*��莘e�0�8�O�ZF¶UP�P8K���zn�;���N�k��U촔�&zmu��Ȱ����8�xW�\l�O���#�����KTCh&�%��!�:�f����g>r^ 6�'���L�����u�eCꭱ�J�%��E�DDn�ɜ�&��m'�ܼ)?Z����b��p�L��=�@D�vڮ̽�J~���J�D8�_էD��?ʠ�%�U�,���Fb c�1�h�l�����_��{���^��YV��_� � 2~o�]��� �Ѓ���xk�}����E�KT5�<-YMO��t�����osV⮎�y�xӠ|{T���E���3��:�Q��5"�'��k���w�H��Iq8���%�'X�C3w1�����_v���cT�\ :Xs �;]nة�3���Xj����~s+ǖ��Q<��u�j*�5!���+����A����r�XIhy. �3��X��SP�����4Ke�s]~���ke`T��CIMk+�Ӎ�@�����ڧA7���H�Z6�E��?[�<��G�ɚ�l��t�\#)�����G���0E��,��W�(�d���<n�1��z�٪2]��zڧ;$�^y����@�D�W�M绺m��Y�<u�W��M��������x)9/�wX�m���\��B�<����#t�~83;�+��>N;,���l��"��V݆�`[N��ZQy ���#�K<י�1ެ��6�����z�����d����<̳�Z;�����;�䨻�a���S����d���m��ܘ�/��!���TP4�q�9Lί�"���Y��?��!D��B�m����g2堄�L��"�ZnR����Z?�@����ǛIQ���í#��7��@ƹ}�����18��)r�F�/ڴ^y���(�����<�R��m+65����]Հ� �����bx���2~�i�Yڻ���^/-��CHS�vs�2�]Ī]c����!���g�p���.�����)[�<.��E{�V�.����a�Y�W� !˜?��h>�j�G@�^�V�1��_�� r�L�{GJ3o6��<��֘6�|A6�$Pk�����=�&�&���Tm�[�:1���V:k��{�//�*�auo� Ԩ�|�a�r��X�0x!㙂��/C/�h�J;5%���E�JW�~)��mq���[�1Sz�R�5���T�q��FK�\��Gy�� �(��3��f����!�s����7�<���W�6��?����M��\*�v�![��L�秸�2�˿�կ|���C��9-��<uc*��`�m���t���Dr�W��e�r����`-r���?5k�1,��5����ՂYIJ�����%e������I�) z��$3~�/�d��=Bs���ڷ�ȷʹi�l���Ʒ߁�����&�IWS9PfTR����2�Y��0sN�LJC�<-A�,����j�p&�]���f����h�B�������sb+�L��*J�E&m5���������AK����v�x�Ff�N�8������Vʷ4����bvn�p��x$ ��?��\�f�����Ե�t$�݇=-�:�~c��쓂0س������mcM�k�k�v�ëE����Lt�i��#�c�*ճ�vry�ߜ1pΫJ�Qp+l�.�3�2�tK���.-|�ά=��P��-^q�~���γ����$Y3�M`��wֲ�-��4wqp�%�^���YE���c~ �Y��7!'�ɣK���d$ �f���+%�f) �X�0�2�♐���v�;R�'J�6P�{`瀥v��l��"�BD �:9\Z�$��[m�%���ʗ�i��uʊ=��`���e���ߩ*r֗�9�>I����L��.�2�GvJ���+��x㘦�R��K3�� }��]J�,) W�4�&^\�� ���p��K�Ns��XXK7k�*QH��4���KW���}�+�X�xaX%���>��vt.F��W�0s�L��f���p�v����潛��͎V�E�{�Q��%~3�4�� `�N�1���Rz��q���>Ob�!'MV�S����c�8Y�ғu����j����(C���#���}n�J��Hi�29����p�zk���g�cH��Ƀ��z�����zT�ɯ�U�9�I�.��C��|���^R�4��7 �}~�U�?n�-U�P�r邎72�.���f�X���Z�[=f�^>��,>���S0 �{jŹօ� ���=����K)f���G ��o�w�~����-Un��o��v�X%��^�����oh�-��>Q5��ĺʾ�8:�=]�X��[_����E����ƥ�5��U����l��`���5Z ⢂(C��jV�����H5��C��!��R)�哦�eX���;$��}i��h�2��ļ Ht�˼sQ5_4��}�����7ko!'؏+�����of G�W�V+o���sd:��!�Q����Kr�@hRN� fw}����N����<[SS�����a������0)W��W��b�{EG�ZsZ���,G�*(rc�s{��`��������f��^��V��'����8��'�<8?ܣWS>������e1A�h�i� p [�J�BY� �"��h�]�'*AT"��p�.���y]�ڱ�6ę�tYt��e ��Q��^ce�h��K+��'%T3O-�>���N}�Y��$�-#����=������E�H�Ή����c�������K�+�%U�]��>2��}�.����<,%![T(�'q;yP�}��7���#9 �1�#��' �S�� �l4��T���W�����H֧d2 5�8�O�����b9>�������?c�ی�n�S5>��qe���L&� ��P���?D�`x��7���6� �1X則ғ��L-u�z+g�q>�{$��n�������L$!y���g�����X@�oA�ɬ� �$4�d\KN��ne�@01>���r$7$xY���"���@O ���s]:�� ׃�֨ZX?G2��`.0���]��1��jceP�Z�͗�o4�q� �E�~�#m��ߓ�<H�y2�{�z����fk`���y§"�+�9���L��į��j����\J�AÝCʮ����煢�:���� "��Vr��
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp
-
Size
3.2MB
-
MD5
ddf23b96abbd11c3f87ce52c6d4d4028
-
SHA1
d642d1e9588c2114f82ef5d67ccff7e98866b15c
-
SHA256
6f1ca0e9c7c5def911cb5854b0745acbb91acbb514eb7d0a2822375b8930ca75
-
SHA512
db56d1eb24ac6fbc6494cb86207343facfb9ebe52e7eda5e3077f5cdcbbb975c2b9bf20dd068eddb2dfa481470e196f734f4a8cbbdbea0f993e6b861547033cf
-
SSDEEP
98304:rj4WoeqNsXZY8OardaV2orj00XfJ0Bra:jPXafEdavnLiB
Malware Config
Signatures
Files
-
tmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 125KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 39KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE