{r�v��#�"NZx�Y���s�$Bz�/�������+�3�{6L��(&����/�f�1\O�J���& �6Ϸ��*��rIvCő�ʉ�}fr)�]����c)��������k�,B3fvy��}��� _MUCJJE��zP2�9I!�X~E-:f�qL����9Ӹ���$���W��� ��uc�sU),yXm.T5���� A������/�]�C��;�H��� ��z��=��Ѹ5��*c��"����t�Nmm_�ͤd�\��tQv�b@������+�f`w�`!Z�J1�}���c����W������5���RH+1��h\�<��M�s��9���LYqc�8�������`gU�L�A���k�x�|����� z �ܵ�-j�(���w���e ��}E�t��@��JI%�A����G�ps���BoF�.�AX��61{%}]`��9�Y���w�D&w�?k���.̣��,��؈�ں�-,�Ո�k��+z�3��Ui����-�Tv2�t`!�����;Ip�ˌ�ߑ������Ҝ����xk�B� � �T��}�Uo��DI���?�(���R�?H��a��� ��e��1�n�)\�y�)ע_��F�Y�s�W�.*�ݗ�*G�y��rb���C���ߦ0��+[B�}Q�\^tmu(�m�^�c�#��,~ӫ,LW-� ̭�ۗ��Mu����H������m��7�v^���2�=��zS��@�E�A��i�Z⡦�1|�Ƹ�9�u!������k��W,��ᛓy��G��Ǝ���|���/���ф� �ա=L����eV��E��6�-u����Z��,�/$�~oi@k������8Թ� d=���\�ߐ6 �u��;���־�,�2nV�,��z�n%�����=��>Y$Qv5P^^�㉈�sm�5�$ĉT_�N������2AzAi����'�EҠ�Z��i�<��VH�,t�Q&?�vG�B+k�|��*�8kJ��H��� ���/hjW��)���cT�_w��Ҝ��?�~���g��9���G�603H�`b���GE�F��%���}�j2�d��� �,��mM�ܿ[�t�2v:��C��$���J3�E�]�`�c�S������'���Kq5|@���Ə"�4�`?�&[�YA�+������H�IО���l���ҩM���ȥ�����]�Ȑ��!����S����F���a8���%zӇ|`�"���ڱ�X*�Npt�Ms|���B� �q�ô�r ��1��}9jL8���֩�E�S|�sз�9�%�;=uL�Ы��<��Z�Fa��{���T{���$K G����2�뫩�m����*E�ۄ��W;x!ڌ�=(��ZU�"q�}�}7��W�����>�a��}��m._ݍٴA\6y����cZ��]�Վ0x��Em ��Y��|D�q��#c!b�p�xeG�������O�پ���ނ&A�}mJ�ɂ��^\nB�1a��8��9"i��L\�ywA�Bc �� (5=�]P»�M�L�)��T֥�Zį����k��O'����G�Z���q�P������v~�\�q~t�9^Ŗ�}��ёXd���� @��J�7�c��d�m��2U��aa�)�S@�^�Ed/M-]?W�1��j՝����ʖmƗ琸_̮�W��`�{YO�c�*���d%0B������3t��S�(��(����w�:�s@i���?bR� ��%[`ɕ�d��-�F������������L�Δlp�Yuto[mT(�Z�~��'ScQY'Xx�:���#�� Q�R�)k�r������� ��B����[�B�b�g�b�6�d<� E�k��0�dXp�.E_lT�d����M�n=�<�P�������Q��Yd�֦��R�0z��I"�ߒ-�!�W=�?���y���d}; �<��̖E�EkH~���Q�r��Q���J=����@ы��Es����"��{�Yٓ�T��d��&=�9��7�=QK��\L����a�fb r�]Z��Dd�GΪ9����J���Q7�Z�!AY˃�x�vZ���]�?@�v,�v���6S@�Pv��o����� �Xy>�@<�j}Rר��>�Luuy��˓F�a��n��܃!æH�`2`z��X����� �����o��{��`Dj��T��8�J�L�`�����=VT�E��/�5���>��E��\OYՊB)��Ч�[����"`2��mΧǜ;�T�sveec�8R�8nt��������=�E���O�� �$��]$H-����eC!�wka�*���W��hS� �cK���g�b�h�O7� ~@~�o; uԚt��� 6�(�������=X�[���-m �ے�4�4R2� ��+A��v&*�*'QX�W)Q'��P��M/12`*9�$�.�ͽ����Y�I�*ufv>�a�]���PM�$;�)��0v����y�����c�ͧ"3�i�Z�x��!m������峍�衱�Qci���1Ԇ[H�.��珬R�����H��}�ި��.��?7=���h�����?�B�GHX����+E�Q����ˍُ��xj1�0T���+�Ѧ��=Q�5]n��!RRV� k �a�Q��S�Ŋɷ!0���ݱ�lޟN跉c�ȹ����w� �ڸ/$|��&�G�6�����`�)�!������� @���� ��L@%|�q�ѯ4н�$�!���C��u���Kh&9�7U�?�I-.���x?l�.��� ��$͆��i}M�����Ѭ��rدm���s(�<�[U������cN�,��N���[f�Z���ڔ�iFf�pe �I��,���EW�� :X���enq���mn;Д�`Lo���?�]R�����f�����2� ��Y� $��tW�]6���r�!!l�����(98Z��8a����a��� ?���e���mva��+%������K���5K�8M��=���v�%<�k�������%>f�K�J$�?�`dֵ��{�T(J]��E��c�P�t���Fd'���p+����=�ٚf�#D:P�Î��͌�|��y�9�����{���f]��bB\�e�F�6k4��z�9�H�3} &w�X���F|���L��D��Қ�������1��*�̉K���`-���t�]FB��ČWT1R!�y��a�ҙ�w7��ȗA ���0}��T!���9,B�CJ�ȗA������$���
Static task
static1
Behavioral task
behavioral1
Sample
8281d7f0027874f409fdb853f259cba66b0047561b7b377a1e958a6a7ecad1be.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8281d7f0027874f409fdb853f259cba66b0047561b7b377a1e958a6a7ecad1be.exe
Resource
win10v2004-20230220-en
General
-
Target
8281d7f0027874f409fdb853f259cba66b0047561b7b377a1e958a6a7ecad1be
-
Size
4.7MB
-
MD5
187d4850e6f77042b41e3fd1ece4b4b2
-
SHA1
f6b1cc56b108fd89fe10f763d6d3ee90b94ee6c1
-
SHA256
8281d7f0027874f409fdb853f259cba66b0047561b7b377a1e958a6a7ecad1be
-
SHA512
12d7174cab4a9f4ed5a34d6de39cd0d072dd6d22cd7adcb78672dc23b23c044059ab0722a6f26e512b9341071e9ffbb4513f8ef44d1f351664caeae303628eab
-
SSDEEP
98304:h4twBOWci7xNoCZYvW0fuuo5+89g8DQkzFBpU/P5TLTZNkJvM:vBOWcjv+uoJ9TvRBpU/RfWvM
Malware Config
Signatures
Files
-
8281d7f0027874f409fdb853f259cba66b0047561b7b377a1e958a6a7ecad1be.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 639KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 74KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 97KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 51KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Jinens Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE