v�p�1���ckQ�z�ٍ�N���W����l#^jX��nO�w:�j��;����ֈ����GM��::����� �`�iǜ$�ͣ���7���� ��n}Á��\R�нYa�� A��p]\��BeV�>�M5udX���C�9]N���Tk)f|�X�-���RW?�������֥ Ȗ>�+j֞�K�)�&[�?��� i'?ѨO'D`���oGu%���Đ�ǜ#����E�m�yX�$E�e�~2%���N����J�,�&���şap\����-�#qK�iqbk��~y��N��?�Sn^u��&���}��'��lM�4��'�y|e�2��i��}���,�� i.�|�y(�E�=�i����}A�}z�vǬ{�] ��/�#�LMLT]�<+h���*�;So�����-�`n !e�����2������(n87��$$�u��2!��,��$<9�}�oOۣ9���'�}fV��M������H�?�3�2)�NT��I ���A�����/I*��!=�R�nY����|�O� �/`�����=�(T(2�����D�kf:X^��e����[�_�#��Nq���TS�u �1K��eףA#�#����.b��EN�:]�@ħ%�k�I�"���炑��,E`�� 9����~���>=�$,|�����$�U-�����Q��d�V���8dAY���������6}��f����8#��3�C����E�$2����Ci�*��~R�!�|ӽ+Kd��8���N�5>��X�M<��Y��bs�����V7� da�퐶E��k���A�������� T��Nw���dof�^�;_�h͓��I�}��Y,K��(���F@���q\�1=�w�N۱�{7֔��_�0�����(P�����O(�`�E�{���2摐5��1�ͦO uK<��~DH�G�^��-���J���vAj� ��k;q��L��h�R�������-��ߦx�\q�e9y w��|�|ޤ��c�s��>C�Ѝ�Nl*YѾz��;+�\f����J�]N�N�����M��� ̱��& ����6��s:��S�O7Wsَ6N"���ۘ� {<w��ompoв�#����V�譴�a��5��[D$ƈ��wk��w,����/����N%r����,>����T����q���ɠ#��ʳ���-@�����*N_��K�1'��;\b�!��>��T����8�#g"�g��9�]}@Be���(�����s�# _b��> ���O)ZQ2j�����3��� �TOM� 7Ktfw1 H���uWg�Od@��=n c���k)k�q�b *�{9I���"��i=5�dh��e�����[Mɠ��D�*�bÐ��]��x���æ\�3!�q}�[�g�Kj�P�f� JN�h��i������a���-pO=���x�ue�ZY�����QJF�� Fd�����x��]n�[Z�ެ-��K*E/�\ _�3W"?��R�n�L�D��,�.���P��<rw��9��G[\�`��+xC�!������ះy�]%��Tì���v��\����=��Τn���5R�� y�g��/�� �������%�~x��=���-?^~n����7m�c�ے>Pz�{6 �w�v!��FZ��O[������8½���m��P3_��Y��m�<�����a}��sw�b���y��8-Q�G��=��wIU��w��B�"��-o�fJ���8��w7aʇ������-���D'nc�Ċ� �F��p�".�f;�;"&]T9��ic*M���1{�&L��?��E���i�����6,���f��嵌p^���<�������p��y!�W�)G��&��]Ǐ�ɪR�p�6�.��X������3\��I' `^x�[J7 ��ѽ��]s��aՒ�1���Qc�n�(O��D��)/�G����g�� �w��a���9C�F�'��5:R�l����&�� �[DO����c�O'ث��ϙh ���vg�s�O��#���N��|��*�������]�U�����}E4��SR���|�!��A�C/R�n�٦��z��l���ϋ?BB�͞�Fz�qe���D������Qh��S��ڨ�a��h$�so���%oߪ�4�s�� ���+S|,[�)}������R��HI�����sH���w�f�A��1��5�K�i,�p�cx�'���Sל|=���F�}I>���$�s�CIgZ�Iɖ�|��pM��f��/��KMڑ��NPc�̯h|��%=E��K��"e�O���?�Q�$w�TWgC����Lnh�$h������Gv�x�)G�5�w���Z� ��{$K+QA�r9 yPe��u �\𮗇F�T~�T{Vz��G�x�2�{����>YƮ��哬� �x>�o�@(��5����F��w�@��|�P�~^T۔��eN ��l$}|`?��6�]�:�ﰓk�� 4�� ɖ}��b=�8R2!����w|��-`�$���nH}����P�� d��5 �\�E���Z�͉vJ�I�z�n�ĔN@���מBj����!R���#�mbˋ�2��]��v����ŨlX���dt'��J�����5��Qi�����%ڈhP��Qm��h�_�ϸ����������M�7�e&5�m ��i�r@����ݎ ���4���o�c�Q���'���i�f�d��?�c w }�' ��D��S��:Cn\sD���'�]2��<�"s#`�fDI��ުtN�FY�=�D����!#v ���6�?�������C�1��L�� S!?�Vo+1�k�_,�� �p?��#��/5[�®S���V�h�>���!{�L�Z�s�{L0�6P�0W��:���v�8�����w�).Y��ͥA_���� %h�X@0����Et?p��%.����� ٦)!���I���3��ew��n͆��g@7F����@����V��ʏ�r���]��u|2�F��mF�m�%�vZd�\.�O,�/�4^{�m��^�Mf�jؿ�RF�猖z����ԅ!�>Q2����BjD��_^���Dz�!���v�������k�UxS���w0|���x�%~�i,�Xw%Y�e������7 �NG�YF�p����=:��N�d@�"U�PM�� ���ٿm�~G�B=�R�@�)��c���a`�5�(v�¼�oj��Z�S/������eC�*���6#(�k;0`1�o� �5X���u�ԕF#3]u�.vz�*�JaF����I�ug:fȴ��+��Tl��(c�6���E���t��2���s����@�P!�mn���h�{6pY.��x[�!��"3pѱ����,Tcm�����)Y5K��(1{��[<&�X��=#�!O���4u� X�����~���WW3�:����>e<ȶ��ܩ�ي\C�t�]�� 6��f�U]����u��*������ ���@���Q�d�B����5���y��?��Џq��L����~K��\�:�-`#X(��_ gm�y�]XU,���LG�7�q&�V�GN�ݤ Z���5�^�`W�*ͽ�w��%V��b��q7���Z>�=��e�]���hi��4������H�T��
Static task
static1
Behavioral task
behavioral1
Sample
b5f33eff2e9c30543b748bb8d7c22844cd00960c509617f55d58d01e6c65dc65.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b5f33eff2e9c30543b748bb8d7c22844cd00960c509617f55d58d01e6c65dc65.exe
Resource
win10v2004-20230220-en
General
-
Target
b5f33eff2e9c30543b748bb8d7c22844cd00960c509617f55d58d01e6c65dc65
-
Size
4.4MB
-
MD5
004610affb94ac327b9ce2b0ca6c312d
-
SHA1
4b30689d4bce6a4b635e09084951f44d168d1713
-
SHA256
b5f33eff2e9c30543b748bb8d7c22844cd00960c509617f55d58d01e6c65dc65
-
SHA512
53b1950f68a65914f585d91354551d055e2b40ea2682e2cb58c7d832a8d4c5f713926a0e9ccebbb19cd2dd4b95fff4c70164c99b6e0ae964dd42c22cb86de722
-
SSDEEP
98304:nHhUrSTdo5jFD0MtTBcCDt3PMw2x5vs3XKj0YO4epO/dvc:nHGWdodB0uTDt3MHvv0741Vvc
Malware Config
Signatures
Files
-
b5f33eff2e9c30543b748bb8d7c22844cd00960c509617f55d58d01e6c65dc65.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 694KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 75KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 126KB - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 856KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 65KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 166KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 193KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE