K��D'������ �`F��&Z�uݖ]D�>�w(��@;�������{��n��@��ڍ�h��#�x�Y�2d ���aZc9��w�e�:���FtB�/sGA*�[?QXa�X.v��*��'�+�yn[�in�!1�%��C��п ������iT�H1��F �x �{������1=�jD�4-`�zk龺פ$m'��c!b~j�R� /ɻ9� ��e#9��Rb�f/M��f�p�w4��]&N�cud�ke�YRtG̀���ʄ��m�]�c�6���H�#�'�f���j �^�����ثS��)���L�G��uǬ�6�]hӫLV��[��O�qҟ���ș�ّ� ER ��2��UմR��Ps�U9#z�V���MIN&�}{�9h �al ,���0܊�� �)�݀�1��(b�'9��u���X�jv�"�R?�>5����e�Egs?j��U�*���d/�� ^5/�덭��/ȟc�����Sw�a�A4��?�;_Ϣ��r��nKN0x #�o�b���a��v`��(�6@�� 2�?�e*?���E�<������Gp��:��Бk$�F�d��uXS��ê��!�6����}�#,������d[�d�/�K�[��I�yq��k���6'��IF�Q}�9���d3���OL<1�K�:#�$:%�)�Q��:���R�D��5�^+����������Y�|R��&�oqQd�;a#��U�o*�B��I"��j+!�g|��7/��iVE�J�*�X�%��l�.X���<4>wk>� hbL��B�'�<c�l�!B�O�̛Ty;7~$���ߓ�M� ����_k �צ�PY�I�E�R�,4�\0Ҙ����x-���P{?���{@*nYt�y!b.��G�S�Y�PE�C�n���j�QQ2��M^���gL�=Q�Tp���k�g$�1ͧ>=��'j�׃Gc�+C�Cr<�&�F�)$ (��aM��]��z�zu�;��hx�#�3�a|�����=��X��/L���|����xBnT�T�`k��Ť6� ����Z0�(�Q�����YY�ϕ���ަu���H�a5.N֙�/�t��-K`���y0�Yg3>}�L�� O��Lb�R��� mզ�l j�K�ʳT���*�����;0���{�?���`�nW���Ȍ�z�Ёq��g�R���ƪ�E#D{��K��rP,O��K�4:Ja���(���' 8���A���;�y�v�/ǰ�fY#��\-�K�KQV|�(��K��b�t�;���id؞� J��e�M���C ���6������Lz�%Eכ�F�jz[t�n�������FY�������Z���k�:wL"��Õ�爴J-߰�%{#e��X�Ay�����+�6��ߪ3��h�wAKVr��$(��!?Zl���_��9��q�u�����k��u��X��5��/hr����>�������FH3{����LN>�<�`5�3:�AL�4�o7�#3�h�y���>���%�[(�x�_<V��W<�'�Ԭ�4��x�-y�,����6��F����O5� ��<��������/'��Ѐ9����-��2)_�-�I��/֙r���t�h�S�����T,> ��$Ḛ��>=��=ߋ֙k�^/s��H? I��pC[��|:+��Ap�Y"K�MoA����9tzc����&�1�7<2���P��{�F���3:��n��S�Ug�KE4� `W�@巣P�Y��ع%�h��p��]���A(<k�]H2�==[����]��iR�ǚ�:1cǼ k'����!����r=��[�^�M-��a�Q�1��Lj�|W�������>�W+D����\�U�����D�rN�haC��>�1�Zn���D��@�b��oxtC.����k��SO�/����Y!�HW�Sı���\�����hSҿ�z�6aڙ��5H����{0h� .�A.1�G�& ���/~h�. eUS��"����G�57I=<��M�U+����80:H��&��E�����[�g�"'"(�^ɔV���i�s�8�u�����c�?���'��k4�<��?��'�aFoxb Ҽ�Yt�̀��4kp�)� � 6���+�u���0��G�ֳ����<��;f��1��O-�J��'Z���_��Y 21��Y(Cŭ�����v0�IӴ^�ƭ���5��4��e����ꃛ��Y��,��*H��qSG�����\�-X�>V��ڼϩ��l�k!����da���;uF�Ҥ�����ոaG�yq��9"�P��~�Wnu9�?a�}�������QUq�v����C)�[�Nr��b� �E���\xɵ��X&O��,���D��X��U�>ǭZ�."禝��������|�������>��x^���W�VS�u�q��58���uu����.Cl�؉*�%�C�_j�~�qY\��Ы��� �ڴ�z�45'�\K�6p��*��6Gq���� ��H��e �Q� C�vGśo�N�IR���}Lg�hl7ڗ�1�RbFYH�BR+� ������6b��*H�R�R����Gğ�+����|`�,]S/6Ǎ�g^(�J�+ekM�Ny�+3t� _��V�W�Z�iY[Af�Ŷh����k�Z���������nAp� �L�Aܹ�\h���/�!'�K𧎨�n�J�6er*��)m}|� �m��;��(;��9��� ���`�h�Z�P`�L{�D3ڿ���NO���"� ���,�en�n�*4R�j��6�N�GFA>F���(�ͪ1�l�:i�Ϣ��M��n+8�J�'W.<�S ������R���lS�-j���R�s���J���Yuj,�t�K�������W�ya㬧�4c$�Y$j�d�vz(.k����Nj��U_+q�\-�R��&D��lA��<]����+ݩ���R���j ���N��C�\�H�J=��;��Sw�<Q�_��x�k�w(v�C�=c�A_���ǰκ�'dhwAd���m?�Ʉ$�>:�����y�4�.\�ɵ*Z����}���=,0�CE�-��a�nF�00
Static task
static1
Behavioral task
behavioral1
Sample
42e45e2ceaee91c5803610857de6b388.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
42e45e2ceaee91c5803610857de6b388.exe
Resource
win10v2004-20230220-en
General
-
Target
42e45e2ceaee91c5803610857de6b388.exe
-
Size
13.8MB
-
MD5
42e45e2ceaee91c5803610857de6b388
-
SHA1
b3f55e5c1e39270373cf0504b43f7c0b7f976314
-
SHA256
de806157402fbf33b8ef3e4f2959d06fae95d56ec043acc95932fc70522f41ab
-
SHA512
b5a9659b79dac963ed8126493f4c6676b143c533b0005fca1757e2a8d66b5f981b94f1156f9f1cec3f956e9290b55b77f834104ba2daeb36285f15aaef6d75a6
-
SSDEEP
393216:8BqRDz6AgFzSY8jwqRyW8/Uuxo1OSQvS/:8Bqlz6RFzSYCweyPBxo1lQq/
Malware Config
Signatures
Files
-
42e45e2ceaee91c5803610857de6b388.exe.exe windows x86
16cf5db3878b2dcf0f97ac9d337625cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c"5 Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.J`w Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.\(r Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 353KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ