�Q��� ���m�^<H�FG��)��-*r���v7��J ��I81�ߞ��be���0;)��t���jT��� ��.�4|����r���8�H������K�)T���� �e�;���%��ҋՀ����L?��]5�*t��3�c�rMD���c=�1��<6-��=8����uA�e�vR����H���B��?s�C=bm�L'����/���|��9���ܬ�� >��)����1c�������l!�����YTⱰ&�9����`�/=-5k�<eͦt 5��?����1���Lړ@xHED7D|U���UED��6p� �H�$�~���qܽ��"pB> �-q�Bն>�Q��\F>2Ọ_��ك/��o�G�q<^iFu�����u4z�Q?��8�|�G��}`��z��ً�e���N�^�f/���0�.��`�-;��D��<���f�`����)+ۢ��l��u��=S}^]yM&�H8l��1��d�s��!��D��pR)�|��eH���Ǚ�G������BVݚm)=C� �庵�����ض\X��T�D��W[�c4B���Z�qOZt���3�#��!���W���z��ư}CͲ��(�:�V��d��~{���ޫ:w��[ Y�� ]����s�u�^5��D�ڌ6|���<2:�E����,B��>��4�Ȗg�1�2�|�3�"��� D�)%0ɿ#��/"n���$"��T�wg �ӧ.R���!>W&�nV�����tP�k�F#n9\�]}A��xI����j��Ǩ�2X�$Νg<��c(�aU�<Z�k�xb�sU3\[Oֳ �v�E�!Zp�R($f){REju[�'����/�iەu��Vn<�u.qK�|��>����\o�i�Hy�~hy'>��(/���W��^&��m/C��T�-*%�O!�m,�d�LJ���Gl�y{:�l�~��mzu8�Ng�[��c`Mg��0E��<�k#'�!�[f%僵�6T�4���G�X%TE��B.��x�����/�UD�ɫ[!:=���Bk�{>c�&r�cm0=� ��!��n���6���^�b7�{�?*~'V>���?�I.,�[����t��dkp3Cac��Ѝ�����U���;oZX��`��. � j��ˁ�5��]P9�F��� �a��� Y�� ��r���3 8Gf�5�ٺ�����*��=]�ߙ�o�t�C���ֆ�cLj�N)�I`��"䟽]���e �j�ğ[Y�u標v%��b�lv��i�|���Ƃ���1��\���Eln'sh���rٌ B�.��� ��7�y����[�ж�.�k�x����y����z��:ڑyP�s�&������!ݷ*�Aés$3?e}���K�{4��ȄNdB��ⲭ����v��"����ޢ�� r7Ğ���W���}8`c��_�ў�u�-�_�v9<�kq��"�:��g؈y��U�Ӿ����h���8�w��9��������-���-�j� ��47Ez��|N���)�O[��n���riY���s`������ItfY�fKˮ��H_~�ߪ�3YL��s���՝L`ݹw!,��k�T%^&B{:B��g��`��h"��_H�<]>��{���|� �Ko�� n���]�-D�9�ͨX��N�=Ή#](x�����&�nW9��S��ɑ]�` ���Mbp���S2�x�`1؉h:�^�Sˢ����0��M�;B4;�1�~��V�5'����"CJ4��sP�ņ����}���r�2��l� 3�F�ê��t!��U6�� �Lg��J�?��w�(ʥ�ʄpt��������Pr�8<t)1,+�Hj���<L�iףaO�X� � �Ȇ�V�����_�]lp)���L���D9��PK��<�����W͎!�C� /��OM�s��1���$;����.3>V��F.Rq��T���2B6��+-��)��zKB�M����(�� �I�5���&��b����R�'�^[r;�fh��[��b%�.�dA���<�/���\oNjt�����'�B�>�vCo�h�-hb���l�0�$j�5�)6_w�����LG�i{�'�Y���@Z@����_!X��y�2�b�T��җ����JC�%�:�����G�������⦧'2{{�-Z�#�S���Q,7x�E�qmp���xAR�{��>7W!��{.��� ٻS�m�u�N��߮y��E�o����k�Q� :^����F�1� F���r�e���&��I�z'�b�><������Y��?'�<*Ϥ����N�nɠ���¯M��� Ի4gT.^g��.�g�v.2]��̍Ed<53vMr�p��b�X0��xO��sr�~����<Qų���w����*�?�EP����Κ�H�{�c~{뎕xz; ���;�xi7⎈<��2X.�49? ���s��2$|�&=�&�!6G��IМ��"�%GF����gs�]0�K%U�a��}{{@O6������߃��!U�����J @�k�kΐ@])�^SlDxb�Ӝ���gA�mv:��?u*�۳*,����k��F�1(��,'�|!:^�^W�8�ɚ&�1��¤� c��uѥ���]��Eq+ -���l~ju���e��2b���j㒢�]�c��'Z�T�b���6B���[�)�cmU��7����?��t^'"M� �S¾���ydgƐ�������/�d����sZ�E�.mg�uC�WjZܬ���7HP��g���mh�Q]��L�1��e��~�m�yi�ʢs��Qb��!���NZ�:�I�����`�� �;�}�p������� ����V�����C�S�2a��Go>��"*��i�P:��m,�jQ�ա�9������]��i�����oyLn�o���hu�������8�oy"<��p�K�/�ѳ����.g>8��*���x�sB�w,r�o�6���v����<�?vO��&)�G��Z��8(,�@�8�W �+@�;�����w`��ё]�w�=Z���L�N��J�eˇ�w`0�p��p��!o:Y�����;-xTgL�Dq�e�
Static task
static1
Behavioral task
behavioral1
Sample
говножопа7кдонатыыы.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
говножопа7кдонатыыы.exe
Resource
win10v2004-20230220-en
General
-
Target
говножопа7кдонатыыы.exe
-
Size
8.4MB
-
MD5
fb34826059bac7b4c63a07a8af467f1b
-
SHA1
be501bcc77e3f97944a53af873bfa93a611fcf98
-
SHA256
ccb50278b7c77e1fc120e543c76af23ad86991c21e6c3b1ac536b3a3cce1b284
-
SHA512
ce32f8ab91d3252d04c2898c79f62048d3162dfe399691f96e5e619f4a83abe2cc563b5a23c9930a16863ebadea6c5b1b55db115049241502207021fd7b7397c
-
SSDEEP
196608:r6WrOD48aJayAKY7+69cRQAOoR1xsrVysKcZsDt:r6WRjJarKQDoR1OV3JsD
Malware Config
Signatures
Files
-
говножопа7кдонатыыы.exe.exe windows x64
4032ae839b59c279c903747aca373204
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapDestroy
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
oleaut32
VariantClear
imm32
ImmSetCompositionWindow
xinput1_3
ord4
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
d3d9
Direct3DCreate9
psapi
GetModuleInformation
wininet
InternetOpenA
ws2_32
ntohl
ntdll
ZwOpenSection
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertOpenStore
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-filesystem-l1-1-0
_access
Exports
Exports
Sections
m]e Size: 669KB - Virtual size: 669KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
a%> Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Pl_ Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
[r; Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
`%` Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
#[2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
<>o Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
eu( Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NWx Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ