#PՍE��${7\�����U״�%/�.��C~�:Tí��x�}�:��|�,����f\z�=%��&Lm!���ܭ�M�g�G$M���D%&�E8�P`vυ��O5�X5�غ.�l��mͥq�ٕO2�x�M���[8(�)k�ø� �j�I��ʹ�k?,6h��������1���������ϣ%^ e;����L Br�>����ڿ�G�V���Ƴ��Œ>t%U�l[�>r �����=ɅɎ+�o�d�B�'p�t©)�Q����Q�l����<���NC'���X�O������|��$~��[k]��،��1� 3�z>�A��99B3B���Lr�HX����¦�6/m��r �tq��Qg)��D>r�:�Bh��G�5��G̱m�L���Q�)� 6��������25��n�B่���ݢ�ZHy��nF����/��t�<LC<����[d��}s�,��9PE��p�C���S/�I(���B�ot<�K�<k'ƶKA���<�RX�,)/W�mЛ^�|aƢSo� �ud��*Yu��r�����u����(dz�l�V�4)��"� �����D�e~�B����T�>�z��_4�=V/,ӝU+Up��yGu� ��I���a��Y��H_v@uiS���$t�F�¤�""���,�0|�u��u�1��C��k���LV��YF�^�|�������\Uݥ��8���U��Ӫ]�Q�l���{����/T��@֩����ue��'���J�^v��H?�:�s����u�#ƹ< �4ή��}����y��53������5�M%ϫ��:�;qdA�T!���1�N���}��?h� ��@#c��"���*�W�W:�q��k������*|�E��&P�^/�x����*Ѣ�����\G8��.��_��yYH�m���=-J/BK����D��k��[����D��0�u��ǢT�E[�A��UC%Hmz����v�����*�lZ���,)=� �M�0����r�"�enU#�rb��g?J�& #�@<B%�i�rjDѯ�l,�$p�����������+Dn�tc1C����+^@'}w�a �ĿA������S��;ZB�՚�w����`9ݭ|���ͤ���!�hiK���)�g�24ɝ�#+����L��r0��m��Gܭ}�������N"�$�c�4�R vF4�ھr���S����iO��X������ëJDŽ �[1�ny��"8Ff��B�Vf�/�7:��n�oOgi��|*`vޢ"����b��d ZY�L)�9fm7m�u�?O�l3����Z]#�.�㌔�$ ���+箃�e-�X?������W<H�[ɝ�k������n�jRX+Ii�]����`l��իojY��Æw�,P�����!�����p�!��gW�-)�?c\�����h:��$`�+�������q^WN�]��ե3�&m$ؾ��� 1���s��!��\d�Ku�b4a�3�G��1� 1��Z[�a_�c�o�XY1�(ϛ:�����6�/V!Y��n�s�W����:E埝^����g5M�jҼ���=����M�yӀ��v�����5&Ҩ��8-�5%B��`}C���u��t��oM �&$�0���{�`��Ԕ$X�MG�Os�;��O|i-ЀY��0�� �:m5!e#��O&���쉣V����IV�K���P�ј(�Ң�w���b��l ���'�W�H�, ���ފ�y邧!Z�k�� ���%�L��7l���H@'R�g�_���{W�N�J ���`�LT�ٖt2��G5h����EJ�6��>,c��R�D� ~�oRs���� �or��A=�����d+ԣ��tq!F�4ݙly��D�Nh���@�é�1�X�8�Z��N�6���ť�6!�R$�z���\66A��V��^����p^m��h�t��V���a(B�����Iơf ���[ķM}>����ۚN8�9v���x6u�1���d9֩�.�G�BJ>eL���7�c�Z�<5�~�D=r>|��"$o=ऎ���Qx�a���+���M��i�kϵ����iC���w��8v!ސ��ΗCy�6�1�s�0��@��U&�n��s�P�G��U�U�<�>�l�Z)�p�p_*kG$��ǖ�&~��i<�.u�3���nㄼx�%F�h1K�T�W\A�I��VI6 �e=�@����Ӳ}b�L��P0�GT%!�{� P� ����������O3e"�9D�߀B�p��M���j.B�����L����=�-�K��� /*9�\�>_�����p�=�F��������6������eF��U��8x;M$�kXW�s<�^ውDN����"l�Ų��E��Y�J�3vJm���+ǿ���ܙ�9]�Hq����V�ġ�Zh6}�pb�e�����w�=N��T��~(O�ǭ��g�mEg�ZO�����Ҡ�,�.���5�3[6k����eb]�x'��HA��̥U���E�`�PSC�K�I��<���S)��)D�����AƇ���ri���S����Bp1�=8��C�܄��.pٝr��Sa*�C�%��.�e�]m ^O�:���ҟ�ob���C4�cex�5��1�B��D��Y�g�\�B�u�bM��{`K�M x%�&Fy����U���6�� ���&���9]��K`^� �&:-)�Qke�gv�eB�{�(���蓎�����P��<���y��������0<���zRod��pH�h�oLo�wS]�ꯛ������ƭe�K"�{���B�<�ʌW�+�MP���`�e���]'�D ����Bt�M�p��9��_���AP+Z�3v� ��E�O$p�iU�ś���k���˗������z��\����B�m~bF����:�����j*1D���n��dp����S�v��@E��h|(�]���eTo�2Z$X]��U�y<A�������A�ً.ۊ�J��?4V�v$��K4���od��[���[K��Z��A�-�ej��cR��5y�U�3H
Static task
static1
General
-
Target
activator.exe
-
Size
786KB
-
MD5
ee3d41e460639b6d275b06db078b7dde
-
SHA1
730bde929016c85a7c3baaa146dbac874551f55c
-
SHA256
ad55978ee35c23b5ae90dcf7eecf180bd781a346cab5c2bec3080026f555d2c4
-
SHA512
43d2dcf9fced966a38df87e108205df5f47430c2c6d58e795f99060fd7a7e0525b1fbdc22f01977fc6a907c8220399d1d3564fe8d18758f4a3a0d5d619dc748e
-
SSDEEP
12288:9H3sct1SPTrzGOs6TLuTcWGtHG4C8ieLmroHhzMHPj5rmhyGazb/nzzDeu:98ctovlszTcWGhLmroHharmhyGazrzX
Malware Config
Signatures
Files
-
activator.exe.exe windows x86
41b832ac855812e8b8bb98a0dd9dd072
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EmptyClipboard
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
fopen_s
api-ms-win-crt-math-l1-1-0
_CIcosh
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
setlocale
Exports
Exports
Sections
.text Size: - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MaCon0 Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MaCon1 Size: 783KB - Virtual size: 783KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ