Gfy\ZA'��k���ޔWmivo�a�����3'y��"z��@ȧ�� ������e<��p_��ù�9U)���C7�M��V`gϖ�Q溾ѯ��Qlu� �L�խW��V��b8L�xCc�Y}���m�Av�Y��rzӛֈ-���qp �S: �:�������\*�t����e����A�aG ��W�ЫuC[=Z�sK͢�Z� !��v`���,�ƌ(@Xԫ@�.��:�pw�n��E��,1 }��\�1Dj��y$�A�Z�#U|qe��w����ߘx�ix���֦6�]{��d����^ ������:�qFA����QF�R`a}�H��>�ur�.C��ر�!���j���n���E���L�J���~���s�>y?�m��9�x;q&A�Ku1��ü�9�����x�O_�Y���C�B��mdk#>��;+�"�u�ϰk���5�^1��qr�2���c���!E�M��~"��j��Y�&� G�'�L%V<�ؖ*Gk�u%�X���MST��H�Z�vz������|�L}��5�ו�`�A'�y��N�.��PK��4�D�{G�]U���� d�wG�?֕, ��b�uٶ �����H%Mɗ=��e��������X\�9q��i*�jYX��c��6ƣ%��A�!��]�:�y¶j� S-&ۂ��o5�W�{�TMM<ᝢ��J�e.v K��|�T��^J�RC���bSIl'%�|��n���d2]�*��di��X�6Vd<o�h�n:#4Ine���au�˖O�!�z�*�3�cX��ڃ�^u@Zl� 7W�2��ilh ʰ��g/�E�k y �ћ 7�EE��o֪��s�����el���s���ƙ��%�H�{#u�"w�kH[��[���=���j�t`R2����%h��@�g4�LrA�wy�� c�箅��>Kz����5���Vӯ��i���NT>*њ�oN�z3S�s�n�0�qG�K�_�9 �ö;��)������9���f���Q�Yx������FKy�Nu��Q5b�Cܥ���� �N�Y�8�<������!�iA8����d��ŀ��;����O'^C۲�~#{��>z�>j-L�N���wB����-@f���/����s"^�N# ��� �|�M �%O� �� �;y ���������|��a2*"Lš[�iO��6B#��L�f��['Ϩ��g� ��z4E��bPP���Hį&T�m�y�h8�h#��;�88"�e�>�o\����L��sdQ ��pu"�e4��r���A ��^O�m?Ɵ����Z��Q�����zŀz[�g���ly ����sv�(�5x�z�7��#R�{t��2�M(���c�h~��pd����F���3%��p+�3�i�����.�(/��-M� ^{>�$�k|-�I���Sጱ���29e�a��GC�5���B2��Ԉ�̩i���B��@p��~���2�/Yn�`�a��m��/�o��={E�3U��X��)Y��\���do�n8�T7�� -����G+��2t.&���Π�N[a��C�Wԇ�Бъ�P�}�r)��5�BՂk����B!�v�3��၇P�q��E������G9�Ĺ���0�6�R��#� �L�5��L������e���K�*��m�'L�|\4T��h�QfX��)aK��L�J̠����-Ҭ���*oc}�l��D{4d���b\���RA�!�A#�bQn=��c�$��p�K��y�i��/>�I�u��#��RO��Xn�d�z� �t��T�ۄ����L��M�� s̟Տٜ�4<����q2oy"t���X��qb�6x\�=�}8���~��2�q�-0�J�U.�� e� 5x�<���+�9��"�=�`U7���A|Ɓ!P��g��,��K��X�H��Z�|K��|�[l����~L9dt�ȸ-�CǏ�w�|� fxZ�rz����s-tB���KP�E�e��-E�*���`��IK��8�L�D��� ZƜ�^a�f�ueػL���f��l������S��Z�=`{K,��e�h����e�/�qm? �Cۯ����l�O�ΫW0n��la,*>�R=�ˢ6�W�k��F��0�S�,��&K��$H�+Ɣ�1b��=��=OS��Z��~��e��)�7�Rb5�5f�糢e����ݞ1��,c�U#��{���" fx3�����'��D��^�`{^=8 ��w�ѭ��jQ��_6����� 4�%�B�g.3��_��ˢ �BQ����n ҕq��u����G�%�M�ü3E� �����J�'��1��=>�i�5gުҘ��U г��������i���]�Z��%���Qa�9�A<%;�b�j#��,��0k���@*h����h2�Kp�v� �d@. �#��}�k��+ǿ� i��_m|}�%Z��j��Q���mJ�����rďd�=��� C��Zհ=�V��������T5ۛ�*���DJ<�鵉�?� ��Z�����j��*�wr��xgS�n���EqN��^��8-LJ�nmcZ���`�ׄ%-/�a�9%|ET��b@b�c_/#B��0��F�Eh�j�n�S�2�1��;á�D���=N�ƙ�Z����x���aLz��gNd҆\� ��W�f7�X�^����̾��%�4_���&T���kD��hxMl�E�<��1��d2�'�$V5���͒�]-ǰ�[%XΌ!|Ebޑ۟$E��j�������2X���r,:|�m����t��E�<��G6����1�lmy7�����C ���E6a䄼�<���!�2�;�_�X"����!���?��|�X�����������[��+�?����(���������`E��2&v��<4pvv:�gF%�N���w6?�[���������r�̯g�y?��*^Qq�4��/F�I��8��������/7�}�K /��P��z;(��Cz ����(�\j���=b(�ן˵B(|�Ѝ�7���ɘ���,��P<�ֲ��O�:�(�������A�e'G��=*B�0����fEu�]
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp
-
Size
9.4MB
-
MD5
5807efef92e20ffe074bbdc141cfbdad
-
SHA1
b6c4a743c2fa8ed7fca8257d26134806b64ef9e0
-
SHA256
af421881786af65cf89b28d2a88d37658625f21f9644cf298c438267c7c92572
-
SHA512
656947c03a721b8340e96f0da317a7537a44a291a2a436783d8961de63daca33434b24fcc2f6e22a28fb3c0a7c59acd07e87b505960785438156308916696646
-
SSDEEP
196608:EpU9d+xVQbxm+Y6pdA5yCAXHQ93klXFIfO+I3JSIJV1Fav1:Eq9d8sxm+Yad5ZQ90lFIfO++DJ7
Malware Config
Signatures
Files
-
tmp.exe windows x64
1b2324c097913513bef0f7e95aeec8b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateSemaphoreW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.%,R Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.-dx Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Q4 Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE