�M*X/��De�(l:�UI!|w�s�*X(�)3�� ��r_ͼ���p�rw��y-�ƹ(�!Ihj��z�?�^�6�E��� �+.(o�,U9�+�B@)�h���-����VX�{e6 -�U�0E�)���R�� ���M!���Y�e!2�t�B$�Յ�'u�nn�vn�����"�Ivi�@��+ p�mx�-��>�Ĉ*��,��9;�A�E����E*�+�<��W����ݣts�����ԕ=��� "v�Y�Y�<����|^�)��"pZ �1����x�1{2���09�n���i"jی�3?��t�77�0/�ޯ&F�ݹ�": � �ypP�4l��������:?�t����f�r��fP�_}*�+����EW��Ȉ�P��T��s�ɫ��v��\�$�������l�ͧ����o�f�)�5�����q�!�i P 73����DR�n9��{C��kgD���q��z������a.��-�dA���;?"��r^rpF��* B#���,������4�,�A`2�n9�����&���oc�,a�|�n�d{l���[rj|���|&ʌ��hT�f"�1��ճ��)ux�]�C_�h8Eئ�����(��v:DHe�@����q��e;���g�E'�SgB��I����� �Q ����&A/��U��X��~�����7�F!�ㅉ����L��G���/��?kV(�����ͦ�_��lH���J�q�jF}�Cb�t78��U��W[��7�g�6}p�'G��S��%k�Yo�U��X��rvVD�1��L��aޒ��hI�&õt�{����c@�`*KݸS�I��op��B������EDХ?O�8|�Co�$g�r��,;��g9��7j���;��f��99y� $9�O���B 劽�T�q�G����6��w�/������o�J,d��`w����F��/[�4��G��t=�4K���!��Ƽ�c���Pu��$��O�f1m+u��҄H�F���`,���X1�)l���m�����-<�}wӆӺ�1��� L������ǧ**�8� 2Si������?i�v�?�8.4 ��0�i���P&�Q� �:"�{��B�:��ߌ��@��6)�("�����(��w���9uU��)��E�*C�*J T��V�w�箌��@�:�����G��<.�im�wY����O��`Ħ�i�埌��fp�<�J�D�Dan��<*˵��l����\!v��fE1�H��k�,[�K���`�C�_iN^��.y4A`�M���E�#6�����z�D�^��zvš@d�*)N���~���������#�q����ֆ��dN��6�q��-�k���]�C3����ˤG=Ҫ�����M"i�N������g^}��Ir(���3�8|QG9}��_�ɶ��q��)[��ø�%1��:��ߜD�yN�x�"JH�0���U k�"�b-��V%�,����.��w/Z/��\.eG������W�B��%��r��#Ҁ�y^Q#���>A�;2���6X��@��V&=4ج�u��o�OU�&-��9��1�{�i9����es�\�o�==��rb�d�+��NKHO�z�L��֦�a���2lm���b;{~������/z(� �iO�ĜRA.<��p����ֿ�:7��*�-�r����z�͘�{���'� s�w{?�1B�6ۜ�� Gv�k��{4�z����G��\ �Ƣ`6mKi����(-���-��UV�ǩ�љ �GA@�So*�\���h���)����vN5� ���o��3Q뱂K"�4�6���h!���5V������O0L�d&���d �̞._�)�4S֯��HH���\�T/��X�ȃ=Ï�r�:�c��d+��|��ڰ�[�vc��GF�##���h���lC����۹�S2_�GW%�.�ܘZ��+�Ex�������W��B�&�O|P~u]���ȿqx� ��5�-DM;�糆����:��(A �A�U1r��z7+M���i(���*;��a�Yp� dC{A����܄¬��"Y[ꡫ��cz��t�K���g\90��\��ۆ����c��Z`��d�|%�ez�����ȓ��õ=���j�DV>w� hoC�$�`����Fi�!�_HҺ��;��,F>��͡�M���N���8��ϦE����k�L.J�{�O�>��GR~�ˆ+#�L�E�=c�Zs��EA���`�a�Ҏ0��'����6�G��9F1�����7�ɇ�٦¡��28<v W���e�{���6�f�K�f���J���Qx����"��&����q��L�Xz��S�NN�B邿(����_��OA�o��#ɌU��˗I�eZ��ig��6��#�`��ԅ�[8�[�/y#�OG#��g�lAg8;���7���Rl��x.Φ7�q����g����]A>[�3���P5u��'���m���GA�-@���`�������d��ay<[u���* �Ni��$l'P�,�S��x��T�:��LY�`����&�Dd����mj|]�D�%�vy#t��Y��{���WL�s�;��Cr���ET�r���0��[Y���ie�T o�����0��8�[���=x �H��N �����x�%ȂLC��yk�P�1Čb����k����������h#J`���D6��S���|��~�#�~!���`=g~��,ۉ�(�ZP�h�� }ƬƗ�Հ3�0�]�t�0!(����r�`���r�e�@�1�ZXBk)��XA��v�j�A�k�g�����~��DTn���.��-[~�$�������U=�n�8.��jm��ޭj�bCh��ck�5����,��T�?��mO�H��d�w���[���d���d��I����g���xx_�Ɲ�=^'I#��=z`d�ٙ54WGn��Fǘ�}�r����_S���j��#%{��6%�{L�;�Cu�>ɲj����Ld���b�D��RmU�����z+����:��f ��;éiPn{4�Z��l��a����
Static task
static1
Behavioral task
behavioral1
Sample
22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916.100-200.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916.100-200.exe
Resource
win10v2004-20230221-en
General
-
Target
22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916.100-200.exe.zip
-
Size
13.1MB
-
MD5
9edb49b9f9bfe07dc8660c5a56dd753e
-
SHA1
b3f3c6e6162d6e8a740477686b16fed62053fa60
-
SHA256
2b7d3e9109bac3f1952fa9012c7dd035a0595938e6fce76b43a4cd89428420b0
-
SHA512
fd6afa4575f03ee668802eb6469f574b285ccd213b5e29fe08d09a32d18789645252634ba7df95509c00ed408277436394358f7202cf0c3e8e56de53ee80d4c2
-
SSDEEP
196608:ROhr3Ahbpr4Ax18sXBJ7zlYbBbEMnpead37ESsVaWl2bIPhJtg97yH2LWHQEpXhU:RYr3SFhLf7RAbEA5LESfbP+2LMh9QNRh
Malware Config
Signatures
Files
-
22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916.100-200.exe.zip.zip
Password: infected
-
22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916.100-200.exe.exe windows x86
16cf5db3878b2dcf0f97ac9d337625cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.;Xq Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Pp1 Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.J9- Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 341KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oflhk Size: 124.0MB - Virtual size: 124.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ