�7�m� (�Ar���}'R��ҿD3 i�;8p�a��:?Zٸ�Ȱ-�)X �w"`'h_�i��^�I�G�D:�X/�� ��I/�ϒ��1�Z�X8�5<gj.6�z�)�J5,�����3{�E��i���Q�A_�sL��Q�B�JĤ혃<)�$���4�0=�4����iA�s�� �����~� [r��O�zۍ>��.������M�W1)��Y��[�5�&�ފ�g��{��~,W�g/ɝ�KǏ�ゖt��A3%5�x@C�?a��ی�CloY��:�� 0��M2y��\�?�3�����!E:(_�0����l�Q�8�.d�)�������4O �#K�7��Ҹ>ܸ�p{|���_����՜���O8��4���p���(ӯ�)܀*���Pn�1,tev,�{,�l*X�:�~� ����h���Qq� �Fk߲K&�Ҷ=Kd�L�G�Gm]f�[o��Q�C���L��(^$�O��L�.��{U��j��8��&�_�j2�\rqk(����s��q-;�!D� T٘½1�+1��M2V�4��H�P��Ja�����F���u�#� i1���2H��c����K.lN0.d����B�����v�WYZH�2b� Ƣ��1Q���(`-Mg�6��=O����]�L�|�-�$�h_�������i�]�vz�0���<�-C�(��Ͳp��L �E�*��2�azB�O��t����!g�l:L�SvAcd#�����c�[Yp���b���ӟp�U��Z`�ME��Z������0RT�i4f6��LfG��!��� �N���P����s);ըڷ�Z<��*p���jC�6���G��hZ�B�<�,��D?Z���v�(U�)�Z���U6��Y8*v{o���kfV�� �*�F�^�G����|�[Ō��Z�Eu�y÷�����Fde� 9W��RK����Lܝ��=���6�/�$U�`��ݘ�i.� Mc�v�{�ä嵎�k=�@z�c�@(T5s^{`�o` ,W�j�T�F3\��za��U6!/�M�0���P�ٽ�b����l���[�d����Q���^����`n���tj�iυ�ͳ=���]&K���(�E��� �_;HDH����Q {~.�(�鬭�+�GZ�ɓqe`*������n�q�O�{��x��Ǩ���6�c�K����Zi��2ɊÜq��rB�G��r���'+��������¡ '�����ؠ:��2�S���^*��2�;T��*_��3���~K��N#������G���Peu���7H,��"Ş;�V��;K���mr}�¸���/z�жK��A�,2$�4⿍jY&2Gq3��`Q�Q�hG�q ���O^o�-�]&�n˺_ʫ��cwln$�)��0���sw(|j]$��x��-�fl��>����5e-�, Tc�����<������N�V�k@L�Y����i������֯TRO�J�몯�r��Q9섃h���7��V�$M��8(��m�rE�&r_����N�m�[�쓆h���?mO Vwܗ�2��ӟ��폅�h-�]��bZ�c_�4 >����y~}t?�]�߄Ac�l#��4;���_+k(��/u����>�̗7�����u{����C:��U�Mq?k�y�M��O}OʏG��`^=Ev���s���:6���k�^>|WE�Y�G|F*m�3�:�|�D���E�c�x�J�ˉ�cJ��"�ѐ�����T"���4h��ցŁztHg��M��� 6��7*~O=7���N"W��F�M���~迡�U�f����)Y��-�ܢ���߇|��t��0v��vyiߘ��+:n�L��$0��ё1�����4��g������7%L����Y8����M�͘��*�v��i�>~�F%�@ΰ�E�#�Z�K8@'��C1��Ѣ�5b�fo��"=�~U�.'H{�B�͝D�;�nO�xk��4>5��c�?���)jX�/ӛ��U����q��շWMD�Ʒ��go�����5T�[4�� 2O��9L�UW���l�d���@C�2���&�L� R���Phŗ�US���;]��Vy@��m~K�{��e�H���vv�R��,mM^�Bs{��`��(^Se�3j ?بIA����d4�Pe.�h�$���\c��/�$�h�!�H�8 ���^�W����z����T~1��&;$�H�_����,��E���7��В�y C���F3�Fā��5��V��HY��Q��ނ�ŷ[t�� �hj!��I"�#ƭz��8�j�Z����<�����}��<e�q��]P�a�����O.%��6���͕>�q1�'�v"�M@�!��yD�UH8nܴy��<����i�^4�+��;I�d:�3�e����U=��-��e��Op��+5j����v���zۥUj��}����8y{��Rӗ��<!��t�����f;8;@ܴF+��l.U�>�):�.N(2�(&��$z�"`�X��D���<�$�^9���fN܄apsx��X��v�vJuS����g��8��x%|����x���$*�ό5f=qu�3�����9)P�����"Sep���?�P,�V��G}���?^)-%�`��h�%��l�C����}���Xo���5S�U�K�[��h�ŀa��籠d[��֨�y��̀oPS��>wW��\��p\�ӆct���c�M �ڭ�.N+��]�����`�Z����Fς� �-��E���&�auIO����r�N_ZxaM�vc�K8A������F��sT{'��8>����K���̉��53}@�ȖE�KhE�|�U�y��>�`J5�:��5s�?f��S d�m�<�,a��3饤��j�y�L�8���Jy�����CԬl>�5=���A�U�L��9d� ��f��m�NH���F#��_����PH�m&�D\�A�P�8`��1��ZJ�F��/c�G�D���{OG�D�/�x�N������5��vfn?�"��}W��}�d~x]qy�I����l�+�b�W�"?�I~%k�*�S�o����1��_J��5��^o�~X
Static task
static1
Behavioral task
behavioral1
Sample
b9c9b61c5e849ad2.exe
Resource
win10v2004-20230220-en
General
-
Target
b9c9b61c5e849ad2.exe
-
Size
66.8MB
-
MD5
bfd74687357a39286ede57b37b7a3dac
-
SHA1
b3b46ad7d92f995c68176d4234b910d9558a58cf
-
SHA256
6a7b9fa08db0bba60a36b730033af8aa6b25bb65f36fb740f03b3cab8d804676
-
SHA512
72bc56ff5f83b919bf9cd7b53514d60543c05a9f38b59b1f1b763168fcd938621c69b6123afa4ded4be0cff3a29751cbbd300f8b0c0565f9039e285c4ce3c7a9
-
SSDEEP
1572864:V2+MsAB9gTOoYN1vYJBXevSILUoRI9bno2cc4fkKSkGkUsLK:/CmTONNOL6SOylno2cfzGl1
Malware Config
Signatures
Files
-
b9c9b61c5e849ad2.exe.exe windows x64
d459812f8355ae8423b6d9071a859731
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertCloseStore
ws2_32
htonl
shlwapi
StrStrW
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageA
ntdll
VerSetConditionMask
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 880KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 63.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 66.8MB - Virtual size: 66.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ