J�:$ο��&���0�t���xiݣ ��y�r��є� �t_�d�w$�f�]+��uF5�cńR7��ی�`~g�<Q�a��;��������'�����jpJ.N�h�~��;���9F�����eV��ÒF194f�at����FBh�X���C�L$�cx�3���'+@؟T�܉@�o�t���,�♏Z�qR���;~���ޫ7F7Ӓ]2�}��0�ߦ���_w�S��gb�muQ[�2� �Y�C�`�.���$J� ��:�6?Ш-��#n���c*aź�J�G��s������������5�*[qm�����(,%nd���+��i���U�� ��ҹ�:�`����pW��8�У��)PǸ��8�Φ�?V4y�����$㊰d��_��L�X��FnM����/�@ Ȗ4�?!��d8N��hE�$`S����kf��>�^P����L���l�������x����3�L�C���m ^��� aϠ�)�\�r��ʶ'@O8ܺ��=�+L� ��YLV�\DK��tM����'��N��i���Γe��~�ж����hgG+9��q:��,�ش]����7_�t�@�s��ն8V�x��T��Kي��p:�[5�#7F�ZŻa�h�] _탭�ք��!��@k���!d�����N���}��)n�l���l�i��5c��&�G��D��cz:�xt�o]"� ���"@�n)n��k��27 ��wFG}����]p�hC 3��zM�*�@Y�}NdH�]7� ��d�WS#����U����u���b�V^-G_� ��,vZSq�E��ozp7=��O�}���1��]�]E&Y%��HTk��Q��}���P�;s�a���Mz!q[�����14���$���Bj�E��J��R.�@����C���?��f���շ ѱ'@�O%��@#��3,��?�<�mX7 Y�5J~��ڱ���'B�?|I�zОޟ|�aX� usE@��s��*�Eov�� ������*Nf����pr�G�B�ٻK���̻�g�d��r�)�S;��8��Ky<������+~n�V�ׇL���'�.ks��<�j�x�tG;o8�t6o=Q���|l]�2qN��]I�TBe��u�X]��������;B��Y�E;��S��?���)�W�"u�}Woܠ(����4V�漣��֖*M��X�y�}m���DP�z��*��i���j>��䐊w-g�l{��&�A=�QH��O��� �3Z��ϊ;j�@�ҁV��>��Z�[U%|Y\<x ��PNLt.���S���2"?�E{]$��OKe6�t���@|^�CJݑ��&b��Tgf@�q�*�Gr�Qo�,Q���\��/�/�T|ϧz��^X��|W3�"�,��q�dhf*$�Z�,jLt)x)Ζ@�i���=L��*����M��Ƈ��7")�%W+]��lK���- *�W��AV/��m7�eS3�cuRoag>8���3{HCy������z3eJ��D��f�ΫP����/���)D��W���N�D�J���ϼ�sb�G?�&��Bւ�\�:��9�� M��iv��c���f�P��:!�0q�7j�<��7�}� ��f��Y�¼���o��ƫ��+�A�^`-�=��n ˆ*n�3�$q�.���$ȹ��.٬�XXr����\����WUč � ��Fl ���:)&��B��UQ��Y���"���n W�7 #S���G�i�ØGA�1�9���v���%ڭlf�qrk�G�sdf��*B���V���'���XF��o��a�lwӕLsL�]�4��M�@pw[W��{��/���>�ZĢ8�ڎR�^[�ܰ����Չ�6&Ө�Y�c��J�e�kB+q9dc�k�J�.ъWnҁ�!{�.U�s��Xa��"E#��~%C�b��Ҁ@�<��L�V���G^����0����_�q.4�NU�1?P渷�C%��ȭ�\�.���/�-DM쾈ҵ�(�B�.�*=��AXGPp�mg(�j�&��v�h$qzrF�+���#e���{��U�f������ɠ`���� �g#4�،�[��N�4�fn9��^J�͇�����c�4b~~)]��a?��1���Lv�g�τ>�$��1�N.�X�%�vWd>�Uġrl��?Q5؆�rc%����.��N�V�Z^���=I�Z` N��"����P�34# �\��H�3Jw(��٭����q���#���x~*y&� ��%1�5�����bhE*�iU����GCӉ���=�M��t���~w�An,�l�IbO����g���)FۈY! �g�R�~|p����s�ǣ�`����N���9�A�Zq��KؘX ��w>h�ܹ,�Ѣ*��|Ds�$:�١�nS�;{�b�tہ�st��=Qd1���f$r @jK�Py��H��P��ތ|/�''+�x癳�S��쇛��W~JR,wn@���P�����GV��/����E��`� ��|$,������D��w��c&{G�ev�,e A��?ί�� ���I���b �������(�V�*tQ��~U��f����O���fg��3��ї "��#�zg��^�6`�� �k���}#�~�����@�-�{�#~���4.�e��K�I0��+�)�<��NÔ��y:��&(dC~�a!���*�Y'�fGƭSo�)4$ �"c�������ҙ]5�0�ka��J�q�����&��l�u����wP�x>cX�j��5��Q~�)�t�>ƒ0���%�N�%'!L��Y�TRwG�;x���a��ȟ�1pc�^4 @�D�CH}�O���XW�_m�a��25�e����'� 6π��M��,CZΐ ��J�c� ����G������R�<�8�B�/�=�*;Y�� >�zYA�;�3���a7M?�C��{����.v-9�P��Az�r�xkF�� �5+;3ph~��*�[��� ,��-������q�rG�Q�%Is��7w�����4Ņ�QgM��@T�1B�?ӟ�&�ʷ�u��UU���a�P�T6;�=s�`I����] %��C�k�xH�$p��}�RW^�L b;�0����q�Q�6L�Eȱl�����.�y� 'l���!v�m�$�\��t� JE�k^�("�YN4R��SS����8��v�](���M�bpE�����#�=��|�h�e�Hb�<Q�5�i�Z��.��k��5�N ��<�v0�V8l�_k��X���w�l�( �!w��Ce2!�,�m��d(ei�Y���$��QJe�?��z ޔƝ�� ͜OB$)Ţ9���`0�\���xuuӚO�lv������Ԍl.�PL�lJp)���מ� �'d�4�FZ�{1� P��TyI�D28"7o�7����c��妯la���$9ĵ���&*������z�s�J#��g��ku������ 9�ܒ�b9�sL��^�q1��?�,��
Static task
static1
Behavioral task
behavioral1
Sample
5ff58a9d4a78191aef07e304e02b39f7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5ff58a9d4a78191aef07e304e02b39f7.exe
Resource
win10v2004-20230220-en
General
-
Target
5ff58a9d4a78191aef07e304e02b39f7.exe
-
Size
5.6MB
-
MD5
5ff58a9d4a78191aef07e304e02b39f7
-
SHA1
a0dc536ae4f20832dac8e204536041ff751c44e7
-
SHA256
cfdcb4c8b822dc83b953a42173a217c77747f6f071406a4833284732ec2a3447
-
SHA512
77b4e693edf97d42637aea4b297116582f1222bb084b1112e2c248c4d8ee7d54e0edb309f8f8845d26dd8551a808da4e618701b59b10a2607f2e5ac14aff5466
-
SSDEEP
98304:hSUgB5+TVh4+QqMbia5GC8eHEAP9wtlNTHCQyRGrvkEeJ0pzsTXcMdYKE:htDJQSa5GC8eHEAPOlNTHzY90iTXcM2
Malware Config
Signatures
Files
-
5ff58a9d4a78191aef07e304e02b39f7.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 39KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 96KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE