i�v���s���,`o0�����#d'A��k�V=��k�Fk*�b�| Doqࣽ�Q����m]��8���'|*-�H��Ό?��,� |����-Յ�=(��T`���N�P?��A���k뙚?��𘧔�^L�\{��?Y}Cv4m,���XcY��9�.�r����[�i�g�60�O1����%l�g�/��x'P�}g�E'$C��\>����vsl�)}�6t�HZ���м��>��x*��V��+JB��:����G�4�J'��cafs=�5i��b��ظ:`���zc�����<|L����Nn0۱!Ho�N�;"p|S�X���D�.Ճ��=\L����ƺ�a�KX��8�������E��T �2 G�S��c~S���)j�B���u��w�ƣ*ryS��Gt�*d�f'@����0�l�O��ͬ8�2�qS��� sl��ov�T�����(-�w��!�R[f.��,6*r +h�ᒶ %������x5H�S��`݁��eH�`ʎ�Y�=ve�����ם���EI�c�J�'^�$aE|��c�g'*P*�f��z}���x����?�#���/�~le�Y�+�Y�)��$�qqTJ6�$�s��� ����0sX��r��R�����@h�b����n��.�JbY�'ͯ�F��δ�gd�)4��d�K �֦{2|f���m$!h>J��kh�4eWЪ0/3�4"Иl�)0}�㓇�8����N`Y�r��x7XK��d x����6Ƭ�^�f��= Ш]�k��13݉�L9h�TU-�b�ň�W�%A3O�h]Y~��>�.Uƅ8�a��֬ы��_��_0S��C������\tj�*�ñ����GN��}6yVӷ�og��;I���tHa�ɖ�c� �E?�RG���~0v'ꆫ3��*�$�ɦ���,r��Q1�$o�@lb�9x� #djvޮfI�}z⨞"�1b������@ w�C\�̫&�yw�^r�s_�ǣ�&�z�K�8�k�Q}�h�':�Y47�/ �Yv��3���(�V|��?�?�j$q5��h��f�嗝2��֏C9Q�Z��}��t��ʔ�m>%�09��#2�c�$�R*�v0E�>����:s�cZR�2��vK�0�e�y H�o�>pr�8eG���Ѩ�2����&�$^V�"A ���w��E�C������[�I�����1����7V�[N��Yc��ܷw�@oY��ł:����7�U}[�X*o�٧4mR��{�� �h�/��9 �:�cc&8Q�x�`#��u�u�}A��iX7I�ԉ'�%Ѓ^����W~/G�l{#f�lJ�҃�]Tʺ쌼�sȹ~aX��+�̛�R{�k���.�Z�ݢ�d��5ӥ���6�˦�uJ}�GIY&����Jg7�7��x���Y��D�K���L�@fET�w~�fy}��f����?���6� �����ʝ=q;��$i[C$�1�)k�К:I����\6S_���t��;����j�ϱ�]�H5L��;p1c����x4�i��p���I>����OS���4qF�F��>(ґ �I�@o^�ٝp�ec���б��v��a�6̬cz��ڝ�̱����ș|��vC��xq*��������� �" ��yi�q+���E(���/ָ�bn��n0d;�cQ�-�ɇMU#�W�H��vԵ���ajn��p�=�����=FS���k� ��Y{ʹ��dP2�z��#��P�$V�P����EK9�sp�W���tox=Ģn�V$���O�K��X��F�H@�ɟ���P�1%ަ' �TBY'i�)����\��/0�w��gX[�6�� �R�S=�P�ə:�rs[��L^�7'�iwP�V�"��M�eX�J����f���6B�\+�X #�%M)`u1��c^'y��P+��؍+��s�8��j�jw�J�-�N�Xw���D���p)c��M�N���kn>�����9��y9�����y-��T!��yr>����D�y!�*�N^���.ek86D�� ���s�mt�B��8�c��.7O%8�̴,-z�ږ����k䓿 _4�}(�'�#e��H��0��3kU���!����$�����Ss����%uui9���*b.ʜ���ε U�uWԜ@;�@?,F�tIl��5u܄�2�� ���̵]O�0#G��������V����=~�ީY�����F����u>�r����Oa����=����'�v�g`B�����h7�"��(� �Zb��{ߊ�Z�tUf�"M��jr`V���l�����u�>DTԩ��r��xI�i4Ư鿕u6F�������_�ctoze�S]�@�n�u�N(��^���8�,}��N#��ΟS���:��F]�2k��[��&�_pȃ}^4��y+ DJ��fԼ� ڙ��y�G���"����#|ۙ�'�')F^�Ԑ-��|���cn���"�/v#D��>.:�&��)(��� c*�ur� �m@(��F0�ϙH!�����&01�8uC�3Kͥ䁫G��m~9���X /�Z����k�����V���S!r'hzJ�k{�%/g�Is�&S!�v�_M��P�~!,dD�VK,>�P�B��ú��"1N���Ο�s�D=,!Xߎ?ہ'Iix���0��rz^+g1Cf�z��FX̠��TX(m_]���Z��̷y�X�$j�^�Ͽ�� �/��LUؑ�z���+���%�u���c�Б�7�k��]n�%-�-h��h�3!��x�WذƔ�@�w��]~{ �$�O��*S=K^�[gC�JvLt۽{Y-����ELᢌ9���}�{H�v r�/��#�SL�[�4 1!"�K`Qi�6�|76�r�;&�rH�˶n&At�Zj*�1�m�6;r�~uOh~9�c�^���"Vm�����a�/�)Ƚ�c��,_3{�C���9r6��X�f�>�ؽ$���q nj�^=X��-{bm�ZƇ�����C��UhS?i��������˚,����o/1��&����* �;���������Q���.�ŗ���z�me�mK &P�ʼn��WN�TZ�3�Ӊ�o��u��Vw-ひo`X���ƣ$��.���IG��A�:Yh�F�T?�mK�]��h=�(�u�bD������?�C�$�j����<�T�A�l��Ox���Y�M��?ϢY�J�8����:�%8Ybz�� ��\�h���b籴A����@,.�����k�⚱���3��%�;��1�����8�WQ����lɺ��$ Tˡ)��g�C7�j��tW�Vˆ���D����R�Ś�!�{�KB/� k� �&�?2�+�Fׂap0n�̥n� ��D̡�+藏��f��s��55h��a���;~q���Lv�j����������/Odep����`0��:�(ٍ�q�[���&�Y�Ó�+a��B�7&�kا�eD�"�r��\e�����l��QW�_���X�Z�PD��6����n�3�2��BA�����9�����6�<1Jn�醌i�Xl�F��%t��Q����NS��
Static task
static1
Behavioral task
behavioral1
Sample
be1154de2fc947ef3f4bd479baa590032f4a8cc0d53c6ebd1e2ca41e1f635b60.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
be1154de2fc947ef3f4bd479baa590032f4a8cc0d53c6ebd1e2ca41e1f635b60.exe
Resource
win10v2004-20230220-en
General
-
Target
be1154de2fc947ef3f4bd479baa590032f4a8cc0d53c6ebd1e2ca41e1f635b60
-
Size
5.4MB
-
MD5
af51c7ff80626c8ebb31c59d378c0f1e
-
SHA1
50e95e73d4193f1884edde0aa4fca686d841456e
-
SHA256
be1154de2fc947ef3f4bd479baa590032f4a8cc0d53c6ebd1e2ca41e1f635b60
-
SHA512
d0f7d2b169cfe70c4884bf3a31c2e0c9efc3b532d25dd3d2f3fda91f05af8a707c4bb7518560218592f5a4439ea0600c95ffa1ac5228e60bae9ff07ff89be823
-
SSDEEP
98304:hUU+o/jMiLoSiWKYW1qRsMrC+Z1drE5SC1aTwx/MoxodNBQIqJtz:pp/AiLiERsiRZ1ds1aTwx/hodrvqJtz
Malware Config
Signatures
Files
-
be1154de2fc947ef3f4bd479baa590032f4a8cc0d53c6ebd1e2ca41e1f635b60.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 138KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 13.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.swta Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE