`iv��0��R������7�[��{�w%�H�b~�9������kN�q�%X�œ�aF�f�������q�&��ȉ?߰d�Aē� ��Ӽ�Q��+-��.���S�B�<z���U�d�-���A���Ӓ(= ���=-3?��1����O�`��I��U�@ڋv2l��w��G�_�"Q�Ve��^\͙$=D$z���K;5�88Z��E�%��_b�f�5T<h�&F�i���WN_ �]��US�Hc|d����H��m���/07c�ۖ�MqU��g�C��'5��,%c[!1��"�/� V��+.������YM��%���k\j�1@��P�'����R{+����H{q�*~k��f�q��[G��}����:�@�=~�?|������(T"[O�@�R�鵕�5��(嫌V=���+�h���ӟuu�<b�� �s���X"ص�'u3�}���"���I�A3�c���x�bIV�0�<�!�yɪ�K�Qs�i�h��`�9ӛ�r�ۃ�^m�+��q�I�ȡ�[��!�����O-C%{`���|�Yг��|�繦�L)G�B��U#p6���ىD�1zIJ�Aښ�����ʺ���k` +0c�ɔ%2��O �?-�b͡Qi9�S{�>B}s�.�N�D ��1�����N��";� ;Q�A9����@F���!nD0B2��~�:��v8����vµ[[O��q|���\�c�RH�j�2oz?V�<�' B���W������B�CA!���L>�R����T�^��M�5�ߝ�p�A`�Mێ���@�Io�2�M�c`pӣ��,�T�"��� �+�W�+���HN��D�6��S�6Mf?x���c5��ZΖ�s�9��Z�T�>6@'���"�Ѧ-���1�hl���n��<X�O%���>3�y���ۣ�{;W�'%<���㵣�4W�N��o�FD%H!J�æ��rTTW���iBi#y��X������)ݠ!�m-��no�^r�+_��TsDwP��ӢУ���ݤ�Ofd�n��u'٘v/�4���*/%��^�_���U���5����,W�@z ���gO60���oP`�K��p�7��XZ���k��O��k� ������/9�N��Y(V�/^��n~�#>��u��:^l�|{�<�Mc���Tb.Cx����� �Z��� ��X�0M�I.S���V���>_��5�C0Ϝ��pa��zDK��y�7~�D4���������8-��j�8D|�J9�r� �֔�L����1�+���1����!F-V)��q]@/x�V=bxߡ�0=8�@��IXi�|�`��;r��:��i$�ٔx����P�a�CƿD�ɥ7�-Ii��n."��zآ/��۱b�6���Ö�7'?�]��y۶� ����U 6�;�!��]�w���y���Э�� X�M}^ ���V�:�4�����`�C�v9 ��1���aZ"�i2_�w�����q0{T;yQ�Ź��j�+�_�շI.���ʕ��Ta@��V4�ט���;I@$G�gr�7m\��L�~c�� ���^XL:��m�WG����W���-����}U�\�5v�ǘR� 8����r��b����h=X:���p-��\A/��nȉ �!�.ɚ�A�Vz&+ ����� ,R����LNOޗ��pYtI�� P�������tO~�ܜ��������ҡ��$w�N��\�q�_p�R�^x�8B�C�e��k�sU��L�5B�a��`@�����k����iר��;F�Z+"��laI��������x$T��h����a�9ET+z��Mo���N�t�b�=�/�QG�>�������~?$�����V���>��y V��H�Z�c>%Ⱥ Ĕ�k�a�|���� ^&��.�E�0�`9�37�L�Qt�ok�����%�+��0�6���.�w'�A��A&��K-\ L�H�������ix;o�;!�l���i嘶c-9<7_����4c�Ȱ���3���8����9�^�����v��"����d�V)1*�.H��,ʹs�������֘)��UH�\\���`y,�c��̇ v�\��c>�I��ϧ�(D�O��}���1^l�r�� пͥ~�,ٰc;�S$���`�<~�����g[+�y38dr֔����h��nI/ yV�uݕ��*TH�*�;lF��� �\�t�� :x�_��f�s�N0�W�u.Xźe�F�T2�^G�&),)j���\�r=��h��X��{97�H����_otS��ǯJa_���Б�Y�R`�e��Mp��`�:ļ�����50��1�#Uolo{��S��p"pO��{r �'k>b9'�E�% ��O���3��['�4��u ��&��B��p�A��.��S�_���V�Qx�# ::ǡ*� ��<�&�>�@��-E�kȞ3�l�WxlȂ<wb�B����a����]pȴ�?Q���?��x����=��ض����U"����ϧ�l�`EI�G �2��jMĈ��)��tAw���r�f�� ���á���~��&�s�*�����ѥ����b�B �[��RF&��po��U���4��Bޟ���I��{�mJ��Uk��`ٺ[v"=:EX����:�<�Lw�Їcu���(���2���!������^��C�Z{�m��n�,`��On'/a�XF��cc��Ű��5q��(��|1�nAQs-pf��A�=��f�uΨ���G$��J���k���e�� �"O��I��|�p�? tυ�4��c�!N����F�G��=QX���A�/N���8@��PS���{�+�Xp�p�����^O��UH= NkZa��|ႎ��;A����07&���x��j���T{7�+�/��~�!�} Q� ��?����p��0�%#�]g�s�B" ���`�P�/�1�k+�v",�yE�Ek�e��NLJ��Е5��[�(0H�<-�0�]�H����$�a���3��Q�7�#-�;4�e���'t>�E�@����ŪhAE:���qb0@ ���g~mb��vm�����,�!��2����>�7���Mc. �s�]b�}��[T��H������2�0'N̨@���םϠ=�r�ҥ��; ��Q<��i�V�tt����VwPjtj��A��D�+J�?P����b��T3~���=dB�m�=�C!M���C�!�2iM��# ��+�6��Zb2�&���$�-�T�/7BgFc�-�|/9���<��g�������5��K䟩m��X��m���0-)� Ю1�`��!h���æd�6����xߺQs��A�{���}ڨ���ߘ�F5:�ߨji�ܡ��o����fM�wdZ+C&Bk�rIl�w���s�Ke^�h���a�o��Ș���ɱ�����^4����p�º#���ݲ�yj���EjFCf���n��� ���@�)ۋC�tҧS�[EW��`�%�!,��l�5�-�_@av���#&��c�I������ U�w�5C������L�^�rg�AE�&�i���0����2��te�-��Cp�����r��{J*�R7�I ��d��mP/K(\��=�}2"�$��!8�oؼ��!Zn͓�۷4��/@�b�$sX=H���F�� �?�� �=�3m���U"<l����C�o��T���G��$�)�jA-�o�w�w�-�>۷�;A���$�;DL9�������Jg-g���O�A��}?�n6p�����s�
Static task
static1
Behavioral task
behavioral1
Sample
d9a86a29368e9d67755de1180c76b080bfae49f045ec800f9f409e06738c2681.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d9a86a29368e9d67755de1180c76b080bfae49f045ec800f9f409e06738c2681.exe
Resource
win10v2004-20230220-en
General
-
Target
d9a86a29368e9d67755de1180c76b080bfae49f045ec800f9f409e06738c2681
-
Size
5.6MB
-
MD5
d969e5838e22b2faaebca1cdf6d51c1b
-
SHA1
8c127ae48b2522c8e44437067f72b1c1a2f93527
-
SHA256
d9a86a29368e9d67755de1180c76b080bfae49f045ec800f9f409e06738c2681
-
SHA512
bc9d208110d26c1103c7014fd56ec1608822f1520f68cc4e296148364a95da784ef1f58c0db3af8de4b15c311b3460ad12b5046db17144d19257f73235939e35
-
SSDEEP
98304:wdurkptE1X7aEclIH5iizmATHIndg5zMIDx/dlaBBIEs8PdVPSLjCirDSLaZj:Trkpq1X7aEclIZiiaTd0JDldlaBBId8U
Malware Config
Signatures
Files
-
d9a86a29368e9d67755de1180c76b080bfae49f045ec800f9f409e06738c2681.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 135KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 106KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 323KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.giaata Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE