z���%��nZ�F�e���ټ��b���e��~Z8�� ���P���A(���"��f���%q�L���m��0j#=kT�����G�����Q��=eu�67(�%k �)�8��I����C�5�d���z5�h�e�n;[�3����Z��Ǿ��!��P�����`S�����,�b�Pݳs����v G���aN6MxL_8��2|�/�3~��>�ى�|��N`_J�:S��5�5���륿[^l߸���1$0�E�F�����ے�j ��pL�|�GRǒ48G �)��0cd�g�O'o2*u� ����v4�S��O_8�6'^�*��.d���磪��K�����k;��L��U�z�8/����x&$X��ssO�����[!�ȃ��0_���Rhy�(�G�1w��h�y��O �k�A�O���~L����ϱτ��p��[����E��N��P{�@�`B�����#Vp��``�m�Qg�[mK�t����ޔ���:ܴ6C�3�I�x��ß�ǚ���6�?�[6U$҉/浪˲;]$��Ad�d���6�>|��Q����3��|v��d���˦�!���6hnB*�w��n��B�1ċ�-���v{�#�@��z{4l�A�B~��7��ʘT!�@�8Y4��~.G�|gJ$~�c���w��)L��ϧ�W*v�l{~Cs�%����c�ou˵y���ef��&Q��YN͒0���3q�S� Fa8!)�6`���l�����'��l��AR���QL�X��]'���3S�e�üI�`���$J�U )±�z� 3�k���O��ܽV��} ���#}�Vے�<;%ݗJE�%���r�^%�������N+����=��Ƃ� <%�������S,x�9�,r����%���͜�E�%��'XX4�,�i�;"+o� Q�O\U9� �&'Ё�e�e3F�quz���_��� R��_�k��.�Q����I��mo��7Ho�H�%����k��Y�V�B�ȸL��'�5P)2�]I1)]&�zs R�p�N�պ3*]�O�Ŗɣ��Ia���WQco=�3!oY�UNE�!<�];���-�l}~�c����#�~��:�Bo@�� âK��9:����c��;xA�����Dt'�R}2�&�YB�5xHu����ؚ��{l��b�.���7A6��g�#'2��K]���d�T�]��J�5�k~_z�0�WH�Ood9��8^���}/�!K�����Uˏg����uf���D�At<�+4pz�:���p��n6��Y���d���o�h�����aZ��R��u@f��]e� P�" ߰?����cz�������8��ڊ�S=����B�?U��%}J�@��Nߎ���]5�M蜙6Sʷ�N�� 8 ��[�mKD�?����.�b����QJ��@���b� }t���^����>�8��/c�$��- j�B�ųF�x��bf�f���j\{Ir�(?� R"�� �[�����1V�MG���%��)��m ����h>�\J k�1��|�����E�����?%}���lkIJ�0]���Xx��#���D��ڎ�pB[��������Mv�1�<���[�Dž%~VE�������D3G4F7�Y=o�.��s�kx�Tdg*�TB';�C��݊'X'}.A��e��5���6B *��>���K���SZ��)�����@<��� JйX��KE���ɶf���7i�$���~[�p&����sT*������w�턄�����za�-�� sMnV�K�����HO89$��"pAz�2o#��P��]����b��GZi6��,�ӦI��7)��!�5�a��F��?;_;�A�Q6y�{d���\��u1�^3@l�� ���u���U�t�1i��_NJUp P�p�>�����ij�Sݟ�<�: =��/�)?�)dɸTC�2w�w�����>]4=�-�Y����P ��ї9���BS�,nV���ʼ���OZ������^�茵���7����X�eJ}�V�d�:(u03�9+4M8�s]6d��������g�R����x��Mx�!���y:ٟ� �<P"���d�=�J�A8�jIn��e�V��K�?�⨬�DimZߔ���4� �A��t�2�*^��o"䍌���Z��Tŝ�ľ���(x�U\���=.�����#��U��Dh�[ �|�7l�`�D2�lq5O�����}�1�%��3����"�7�����%N����f�AH�?����B���D�ݿܙR��� s]6�:l1uL��~����f̑�o41S�w�L7CA����m�TzI٧3!U���B�P�z5f � �jD��3+���a&)u{���k���Ms��y�L.n�x[�@��<���.�+sv��Pu0�9����u�rr���ߨ�Z�MaW�t��9�t�D�m��A0�e����e#�*.��������E�<U����DOC�8R�0�,�x���������u�}f�P��N���҅\�i�'ҧ�����j� VJ��Wa�>���L���z���7�-k�¢R`���㋼��墁�$[��n[�q�lՌ ͐of�����{�ˉ��M����s4S,7�d� ZĦ�r��Q�+F��@�6Ղ�}�>@,����iҚ�I�L�[#8땵��ў�k�v(m�n��6���CY�����L�*�U�a_b�j*�[�1תG�$��ƚC�$�nU k�+.�ٷ��#� �zb��/ʎ��]2UH�Q���jL�C�w�����6B̯�.O����i���f�������Y$<%O�O�G�p2=���!��5��~��s�����?��pP:��|��=j� �&���*��<5׆@Z�P��f�N"��G�3rs�E���O�ժB\��S[�U�)��ŝ��+�\ N���On����{������6߀����o0��b4� ������1�!��\�@��v���U�eʏ�M4H ���y����5Z�~����p2뚷c�*m
Static task
static1
Behavioral task
behavioral1
Sample
1c3615f92ab26802bfcf1575485fd4fe.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1c3615f92ab26802bfcf1575485fd4fe.exe
Resource
win10v2004-20230220-en
General
-
Target
1c3615f92ab26802bfcf1575485fd4fe.bin
-
Size
6.3MB
-
MD5
1c3615f92ab26802bfcf1575485fd4fe
-
SHA1
5110da60117e2a2d0f2d3971856246f3c659d0cf
-
SHA256
2437990d15f126e69a56fce1259c4ff90433a991d3f4a9464f2598bb5cefe3cf
-
SHA512
9631be2c8da8f7d110c00463182bc0a46e8dc266e52c6a61eb7d20a72ab9cee522912a77bcf642e8ccf9112917da441e02eda6900ef8dd895da6b123909214be
-
SSDEEP
196608:kHnUZL7oNz1+hjWA1xkYJqKz3wnjLwPMQ:kHhwfxkYYbjLMM
Malware Config
Signatures
Files
-
1c3615f92ab26802bfcf1575485fd4fe.bin.exe windows x64
dda4db897b7805bbf638541fb9462195
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
CreateToolhelp32Snapshot
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
CharUpperBuffW
advapi32
RegCreateKeyW
imm32
ImmReleaseContext
msvcp140
??Bid@locale@std@@QEAA_KXZ
d3d9
Direct3DCreate9Ex
ntdll
RtlLookupFunctionEntry
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.G*n Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.t1& Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&<b Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ