2�c%���8[����p���J���|]ɜ�^z��E�T�a���d�D����66��[���8+� 1���m8O<ƾ2,Q/N$4�����S�b�*�T��N8�\==5��)�v��ԑ.�U2���c$sa��3ӾW����L}}8�Vbؤ���q&$G�k�`������g|���P+w@��W�RH�x��AXcM2���N��UӒ?t|(hkCS\_�fb~e�O�)��틗a���__�GG�F�}��K0[>�N�\��x�T�N�֝��Y���,����?����Z�:7��J8���-puu#�o��-�i���qX�n1;?^�������{�N�X�`P�C��Z�wO�ĩa@���U� *9����T~�A��=��T�se۴^��CU����3mZ�#�U����$�NvVa�K��b�/5��G�2�A�GwQ�h9��п��/�$�F'<�C�=�����\@�b�vw#��X@ @۱R�6�=�|�����OWW����T�[��q� �ʻ��_o`�ߚĦ?U���wt�b�#8�m� _!����r����JbX��Az{@�{����fY��j���,�G6b]�?`n*["s��F����R3ː��Z�9�bz��!6�]���,�G����#�f M1��|��I����R��/e��vb�D�;����QX7+���$-�O. ��^���p�c0��B�jl]���Z^R`�4h���R��Z/[�V3�^�p)`� �z�W2�������إ� ��/c�.*6�Q�o��y.`��_e�êP|�{'������[�����Z┠ɝD��7^(Z��@���N�N��@QHO��G�XY�#8p:�fa�^�v}��2�:�Z�^V���b(��&'/���9�"D�F�Y�i��|d��"����r�&%�[s�J����2;���Z���9���5���as�!���K�oP蕵��)���}��0o͛|�@���s�6A� �+E����:s� ���/b��sǨ���3�CyCOf��mw�Y0�@�=�@��k��oW��]V�S��4�q������6M�+$L����5�r:Y9���x�=MC�S��_-�C�/"��o�tHk*���C�y������HQ�J��;U&����+�[���4�qQ5��@eъ��6���� �ըߓn#~�갔�;����o��;f����izYgY�#�*g�������������N���3�_n�s�Y����$e/ej�?%g��L����9 訡�MOؖ�^gH�E%Cjda�F�F�s�F�R���2w�;Odտ���o�x8U"]�*S^N�����#�����D|�Goc�K��u,G���o��J�I�1 8���s��wں4��~NqsķS�6hcF3��?��K1?$ ��e�U��Z-8&�� ^�n�M�4��=L�w1����h���5�0 ~"X�}e�N�s�21��'���`_ ^+`8���g��č���H3 ����Fa�[��.���P�חLG�<Q�7���8H�\�+�i�]]d�t�����d�W���-0�n��G�����bԱ�袃YR2əԊ@�y�ca����p���!�\��~\�P%$!��<��w.�t�1�ɵ��9٬��]�%d]II��"r�����H@�Y�Q q �?us�4���`����j�7Eݽ/�iǏ��D�~�A�7E!BM��D��X+���K��,0*&��"�,���.�l���*saq�2^fƘh@Z\>�ü�s�'�n�?�A I28m�ˤ]uա�Z��q�]�ҝ��F��I�� Į8��:X1���8����u���{���v�-��q-tJlE��_��r���5�g���Ds��>�<0�,]uYPߐތ\HtU��{zli14)q/_t�̬.|9x�7�Up�����7R�a�1�G�+�B�6.|��R~��g ���2I�[�Ɨ���x�0�JG��L=H�WKێ��M��]:���Q��!��R˦w�f�O���4�_�t��>w�/BY� �~�'>ce9���4�,�XѠr)��yTy�O�f�G�=����X$�����:�� ���W<�^P�@����v�hMv�I�>��t���b5e�CZRn#o�o��@� h(7���Z��2$�!t��0���-���bW�˼D�w/�u�K<�GG9s��óa���������$ڰ2��Q=���m��X�o:YhyI����)�.و�� 0�0f������Ga�L��qKe����q9�x�z��ܭ�E�#P=������N�R����s]�V�W]��J��#��b�������T9��s^�UU�Ƹ ���,T�_ ��Ob��R;�ˢ�4D�k.yN��)�����Fݷ�D��tP��nI�=β�MP>���֒z�������P�'���[��|s9<��Kp��Ƀ�m]c@�-��ҷ"J��I,�C5�@�5r'2���+���k��n����$1�Uɓ@[��t�@sc���ws�W������ScP��).l�Z��`S�_[hUL|�� ��)D"��|����n_�@a*�ۼ�b=^W����|jb�ؤ� ��)�U7���ǫ6��V��H�A��!::�b,2���/���hj���o��ioC�Ct��{s��>O�_x/dP���y�5N�,/Tih�MM��κ9[6%�΅{� )�eqy M��^�m'Z��E���"J� �s�W�F ��*�����o-4��B u�{�-ƞ,�'"�<�d��, '(]�N�LQ�l ?�� �V/3.�'�>%K�����ƿ��������F���\Ts��|2TYT�a��O;��U����?I���˭!��W�jܠ��/2B�*t�S�/w��唰�x��-�c������I���$ ��2���☉�?Xy�WP�:�� �t|�@ ��u%���k #E��P�J����f��5�����H����^9���-ʣ��-/��c�.��rR�u��>\�}����I�wiB�(��Jg)�����]�*�Դ!]�Q�bV�X�!lY��Nx��+��>� O���ǜ'XJ�'&��%�}�b��߽����F�q2�o��g�
Static task
static1
Behavioral task
behavioral1
Sample
out.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win10v2004-20230220-en
General
-
Target
out.exe
-
Size
30.0MB
-
MD5
69218ce3ad8fb6a6f13e1f1a898bddd7
-
SHA1
7c67d041a6987cb4f9e65edc978164bde7ec5831
-
SHA256
4a5d75e48a94a625e05e8c01cedd4ebc9af1561dc36125e3da77d875874a1f9c
-
SHA512
583248619a42ebd7722a39622d59ad361b6f5df4f49b02e2a4a08ba143e3160b838e2f8026cccdf1f9cfc5f46c38fb92798f31fd4f7cc4c89f495e599013afa6
-
SSDEEP
393216:gZTPNjdghreKEpUFuTrVUkznVydZ3yRlBhBtKhRMg:aTlYbEjBUkbkbygzMg
Malware Config
Signatures
Files
-
out.exe.exe windows x86
69ced1ad11dc0af68759e861c3ff436a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetFontLanguageInfo
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.:;c Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.8P| Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1,H Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 399KB - Virtual size: 398KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ