�X�_���9�'6�O�ͧ�yH"R��Z��ɣg����^�/m���Ue�(���!�����7�� �����r~���'}���!��~˖0���w� �(�K�G_����w��d��M_L�Cg\�ÒY��%�4j7�"�ޜ� �z��S&jM�_��E�v�����v��$�5��G?�9��^f�CrlG��{\���\|�ʖck^,����Xg��=E��;������a(��Amns1(>+.�� ��Ն�H�u����*��Vr=����ċ����� G��v-�_?�\�����`������7¼�;(���J�\5d�����WI�~*��`a~ &�l˾u��og��ViF*�)�/�?I��2s����;�1�C�p��nA�UD:q�Ϸ�_���dž�I��\N�z'6:���3�R?��Õ��z�����KCz�eG=Y�E���c9���XL���Ĕ.k�E@���"2lē覽Q����w�����^��J����{��W�:%�O����Qt���C��18c�ƛR���;_��xߓx�}�i�x�Kb��H��&�ᙡ���G�+¦@��IH���^�)��*91���V��D���'���L\X��E�r�VI�����h-�պ��*`��Y�w�|@����!�M�V�9aA�n}�B����>U��UW\��s��(�E��r�;�#�ܰ�'<�(��[�+��?N�l��{�2<�$��2I��j�`n���c��D�(�F�������8û���a�EA�I�@�B�bM^(BO��->�ǝb����N�2�nq�c���M>"�0'M���H���6�^���]rP ����c� 3 � �w%��OY�����@|x`��1�QL�����+�ʚ͕�g�=�ڃ�b]�u1Ty������n;ށ���cJh���#�5E#b��Ŭ� �r�t�I��)�K��STҤ���#��_(��W ������dڙ=� ���� ���9@�#��vR�� FM��L#��/�g>�1U���HC��hD*�<�o��<�:��5�" ���,Q1�������"X���� iȧ{2F�vW_vb� #V�i���N�T I絉��GdK��}Y �S⡘��ͩfG.�s�Ā�����5�ˎ�uV�ߩ��I�n���F'�����[���Jú�Kε��1��9^�M��ri$O�jA E�,�=�G�â�)��a�Hy� ⾅@�s66q�"R/J%_g#S�m3E|o�dV��{�UFx4���}AAK 9t���V����`�r� ns���h_�CM��tN�d�n��%���_,f�@��:UU���v�ͣ!"�Y�ȀA�;����K�O�}TКo�һK�f��O����f�/���i�dYm]�M���ws�TB`z�%XW�EޘK���'���b���F�|�F����m�����_g֓���ITK7��P{9kk�x洤"��4:lO\p3���5�i�Փ��QM.�Q��C0���'��ɉ*>�eYX�G#�.���ai#(�'��@ E'�ot=f.cR���'s��XR��`�CU�P `,�+�]��5CQ�"�F�)����.��~���f�7l�y�S��! 7w�lϣY�;u�aë�l(���=����jͨiM{��\�d\�L Pj�ҝ����3-g7,���Һi%�)��N�߲)��M+�b��Z������ԗ�V&Y�3ę#��r4S������N:ٰG<J��'�`���>}q��K�ӣ:x/�+$������߈K��P5́C(�<��B�3�����/zü��������{�����߂��_5�������r6>pp���D�K����qB��8-JV���ͤ8�*�8�������)"��'��g� uF�!]�Kן���Mݒ /B��ƎP�7��Z�B�(~z}gy2 �8R鿫���&�UGzi�h~ʪvH�r �E���j��#3���e["}&���/JB�ڷ� a^<H�x<�d�f����ӻ����c�T��Y����u#ߔAp��J�'�8�cҚPe��w�Y_rܵ��u��d,d�Q�)�Cy��#�8s\lK H��f����]>��h����m�dž| �0�QS+���Aj���&C�m�;��q�xŚ<��*R�����Icc��#�᭙��m؈N����TGkV-�������`��.���o� ��}캈� �q+\t�rk.,q#M����_Z\3M>�]OH/���j����&��n�2�G��S2j��`��'�\��D���GB�Mx���YZ�<���xڠ(�-`����Ep��9@d��x�� �)�L���������S�ƙ� .� ��m��)3�K�/�=�qA&s��W|�jQJ�bā\�����/^��<4Ho�S���ⱘ��ˢ�� H�Y��I�ZŨ|ys � t�I�*X��7UC��z�����Q�G�Q]��=��t3瀶b��G�0��3�ro0�#�w��� �l^�T��T��7���-8�@��5$����6>�p�V�:��Y氬��|ҝ^Q�BJW�{W�R�@2s;�%�v��q�^�s��a�c�����⮤\��4ᚹ�;ED�*��ޘ8�Q���<|�bK�P����*;�(���L���x��,��(�c#��e����}�>�~����9u����S�%~_òJ��f�f���C`�ó�9���.���.C���U����18t�1�S���I���^� ߀��4"ى����v����(�WbM�x["��E.|�f<B�M�e|e�G�ˇ<��7]�����v�$�q� ���^���ŵ�r���J��6�Ws,ż�wO�)����i�~��a�ZY��s�l��Ҽ��ш�V�)���X�>���������3�f ��-�� �.��_i��H��O�1ѐO[��x����a�5�?C���=�|�GӶ�=V��|<��4��������C����4,�)#��^}L�):���������w�"AeA-������<�(+�p�脜}f-�S7p̴�4����|&6Eי�L ��AA�,k
Static task
static1
Behavioral task
behavioral1
Sample
5352edfcfc3a9777717b92c82a4ee0bd63be0f8e5614135eb8db3746d34d92cd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5352edfcfc3a9777717b92c82a4ee0bd63be0f8e5614135eb8db3746d34d92cd.exe
Resource
win10v2004-20230220-en
General
-
Target
c3b975941fbb27386657f9cdec4dd02b.bin
-
Size
12.5MB
-
MD5
0b0694c32b41b90e634f4d8b1a61264d
-
SHA1
ae7cea7228e8a415974f43b4b7a45c65d0753523
-
SHA256
acda4cabcd3da562cf21bc3988ac94cd292d732144b473af87c064c357376fd0
-
SHA512
2bb0b857eda9bb389e424a012c62de4fe43899eb05fe145f83fcd2f9b1f81c673e0d37bd18fc8eccb3628f62e1a1e61e7868aea3fe1d19e2c805ff23a32a206a
-
SSDEEP
196608:a9az+DMxbiuDHlZXxC/k1J40G3T7t5UvK5hBVg5QW5ZfCmHvpJ9nQxeTfrfqAGxY:MazbfHvkKi3FJ5lXMVJHvp01AGxYSab
Malware Config
Signatures
Files
-
c3b975941fbb27386657f9cdec4dd02b.bin.zip
Password: infected
-
5352edfcfc3a9777717b92c82a4ee0bd63be0f8e5614135eb8db3746d34d92cd.exe.exe windows x86
Password: infected
68126a27c1574bca5a50909c5527308a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$h( Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
..zC Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aFi Size: 12.6MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 313KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ