�k�Sf�$�Ĉ|�xh�~z��1��k�Ѽ^�����6�_��,g�j,���ɯ$\!C��Lyh�#C�z-l����s���܋N��u3>6� ��s�����-$��p�Fa(��<�P�P��2x+�����I:$�0� ��1�o�C�\+��ji �_r�$v���5ͻL�ȬҼ:իAа$��Oc]���WD,[�l�0{p�^�[ �H:�)���}�Jf��e��::t�wh������U����f�, �t�2u[����܈���G�-�iQ��*ҿѣ�w>%��=� ⹉�S�p�\ ���`?�[��|̰�>=���0?��B�CN'Q����e����28��:�]1H��.B_�'_���t��F���KX�zb�:J�m<������ὖn���&E� �W�|�2x@��#w�tԈF=í�ccu7C2����!1��� �Hm�Q���� ��=#�X����ym/.�Ԅ�ݫ>�&T�Ѯx��,������$�!��g�`6 �a����l�,7`� �eN��l���V#�R��8z��s���� ���-}{����c�(��0G)&Ψ���V� ��ZO_5��&� ����/���U�\Sߵ�s/T�r�({� >jR���eKr埄�A��GGg�N<�2~���=�B�{lӀQ���^����mY&Sc���)9�|�G]�8�dä��C?���lp<���������o�~���)(�a�$U�4 ���"s�1�\��{)�\O���D-/K����Igz��=�/�"���⎤���V-���k�-�ק��VL��>L���U}H�7�)��7C��Y�X��$���Y�)[g�ٛ1�HI~Ju�h��^�>x-��t���� 1����(����RC��J�EN�>�j���'�t+�"�������1xA��;�ι2&l�"SĊ����N�@(�O~sEС�U�Yj�I��Xv��%���mQ��Z����B�c�x!5(����?�j'�x� p���c�x��Kl��� �X,}�|lЊ[���8+�o��u�^��ܯ�=�8|N�M����=��Ơ�7 �yP��wj ��?#�ē����<��Sb��mwj�z�K�`|���Ƹ&��ޞpZ�l�~*�{�\U)��F���Ak{m�6S|*mjeQ�r+���ۿ�I��2T���#K�5ބ��V8 ��kc��< ��w���Z�fQb�w@�6�Sv����@XȻ4��P-a�g�+��*�˯�c��/%�<2���<O�h�#ۭtX��0�|̤����N��+sc��1(�i��.תl;� �ląPF.x�_ ]��U7�Ձ�V���I#+��_O�-����3�����?~�����N�ϡ]@�~�{�}x��،�U/K�H�^W���/5J�s~ #=7�r�&�U���Ef�<�|8 7�HX?PuKʇ!�Pf�R^�Oi,Y,�M%����_�R'�a�! �"����V���~�;� �]=��=9����APG)�w�M;�~��_�_���q�;v�X�>o�7j��,��`Ŵ���3ǰf��ru�8]H>�u�����h/k�m�_�c<{����+�2 Ɔ���N�~�ˮE��}ۣ)�H�Mܐ9풩'=���4ַ�/{��7�o�}m���Fk{y�P�,{$k� y�ҪE��@��=4)痹�-4�K릚�I�쵧�|c�:A.&���H��8e�6PK��%)�����k�C����Xi̇E��A;U�FF}�P �Κ<������%��� oQ�Y���ފ`K)���h}�pb�> ��3o�Ε�qf��v^��QM��4����>�〒�ڎ輏�+��~4�XB�-��Œ�|I&�yr��@��(4�y�x��f8#�٨��EL0'����*ٕ&���vx���������Տ��ka7���sz'8q����6V 1��@7CR3����/��+]h�{�v���%+p���(��= �� ����՛2E��m��V���%��C��0G��D��S;&o�@e���1"��������+��JErdgA���.��#�'���g��U��s�x��@-)vk���ؚ}�,����I3�RO�ӊq~Q4��ͬO�`W���ԋ+&�������-'��<;���Z��GE�q������ɉ���>Kn�X�畤�\G���(���r -ϛf�r���⣏XG|-�b��|�AA7Tp���)���)����ʘGOcC ��[P��=Qb~e>�J��f���y�'�D�C$c�SX��ɧ6W� ��֊�U�{j9A�p�K��jG��Q���i�0?�������u�EJ��"}șmC&S� �\���vG�iLt�c�����e���L�^����[Thh�Sk��=��H���o�~�P��*�1#��mN���ۇP�v'3�|���ٕMPM]Xn���9��� [�_y��Z�ڻ%��'����3=QY�"N���^?�z����kUS��Ss���9Yݷ���O+�V�Vt.nWYV��M�����rω1����s��<FC4�u�@�g��g����YMj�hC���;ѱ�&��T��m*3����,��3ܦ�L���n����ՙL#`�� ��/�xh�DQ�4(`�w��%��$�z��� gD@p��۴���I��/���n���t�=E�����IF����t��6��Ѝd?Q���I�kj%�D��p*����r�ؒ���>�|"x4R�'�1�re)��yPt����ﶃg|JA�\V���Kfr8k7���0�d�'�;����s>�� �%���;���s�3G�7gW��I���1H��(�����^n���;JL�qF�.��q����3[���O�f����x����n\v9Bb�~;fU>��N�Aƹ������� �g�n?v�$_�SI(�}�RR�2��D3.=)Ɵ�jHN�c�y��!}���G�ӫ&�G�j[���0���A��!b@��a,g�< y4�*>�½�A�5B��D����d����UX����I����n�y�SNA�l�-r�)��R�M˭��� ۿ��<忮
Static task
static1
Behavioral task
behavioral1
Sample
1f9bd27fd7591a98afd67499ae6730eb56c137335d283892bc06b7ab2241ed6c.exe
Resource
win7-20230220-en
General
-
Target
1f9bd27fd7591a98afd67499ae6730eb56c137335d283892bc06b7ab2241ed6c.zip
-
Size
7.4MB
-
MD5
4880475db6d2ec11cbbe480ea1dc83d9
-
SHA1
55887360054fe0631cc069f28b65624315ed3ad5
-
SHA256
ca877d2b2b55cee2643d1ceb83e9f8978aaf1178aa4597f66bee88085ad58b0e
-
SHA512
e0491908d22d72799b3d36843f77387fe423a528f178589176f5ee73fa9279ba921e461643b200fa7d49978667e30eede0b5299a57566a10d6e198ad72fe0354
-
SSDEEP
196608:tLiMVBKKEZTH9yvHApwRO/rt0zE4vq5R7x3JTKv:1ftsyvIwE/p0zEUER7xJTU
Malware Config
Signatures
Files
-
1f9bd27fd7591a98afd67499ae6730eb56c137335d283892bc06b7ab2241ed6c.zip.zip
Password: infected
-
1f9bd27fd7591a98afd67499ae6730eb56c137335d283892bc06b7ab2241ed6c.exe.exe windows x86
Password: infected
201158e51d2f48f39b5bd36ba20e0af4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameW
user32
EnumDisplayDevicesA
CharUpperBuffW
gdi32
BitBlt
Exports
Exports
Sections
.text Size: - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.voltbl Size: 512B - Virtual size: 52B
.I6g Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oLB Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!Q: Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ