ý$��)�] �4O�q~�[4��}��0��d·�CR.Y��R�>F�^�m��ʎ��O(�63P�ӷ�I8z�H�HE�_i��V`��Aq���vG�~lǦ&�Hk�Ju��S�4p��C^��.�xB���l~ _0�~�n}��D�~H�-K��9�5��.�.lX�.��Pk�(�9B&À��@��oإ+#_��0�&��ݸG��FM :����w������2�PO�R� �R���ϡO�q�R9�Jv�5�H�2�u"��,�7v?7ub�ViI.z�Ë+�o\G��oQC5�F�j�V���+��Cl��g�IO���}2o��v�k��6����{�c�����]�b{���Ґ�c�0��*�C1����5;b���?�牋y����&��X�+q�Ў,%�� �Mf&�W�� ���>��Q�_g�Ip��:k��4B�j4���=�o<�%��F�����8�o��y}��kE�2��[8�;�)���E����$��~�_l�J�i[\+�����!-����d����;.WT+��X�ᬵ�W��P���l��s��$K`Y3�|��Cv7�[އ�u�'"�D��m������������ �%+3#��#$4/wQ�sPd��@SR�@���!��υ�aЋ��"���Z�^��G�窵�x�wڎ�L�t�v�!�V�8�ؓ�+�8)��� i�-���''5�S�M��bDT�73V�ai����Q͉pR:^��g5>��%��&WQ�@ܯ���$����Y?�o�(X���4�Yvn��ω��w7>#�5�. B�s݂��$��Oّ�_����*�խZ4m$�c`S�����s���jT���i96Raˣ�p�}?�z˂�썁�{�����)��L��0���c�_�R� �Ar,D�Т�n�Or����Y���zM�{:l*[��/�w�h4�[���{ �:�c�dV%fI�}r��h��:?D�L��N���cy� �����&���>9m&�VA�K� R�+�Z�M��ͺ����,�[!y�Zi��y���_��?x,��5��^�4t����E{^�`?��R_g"OK���]#��nc=�|�q�2� �gSP����[)��*` T������6������!�?�W��@�R�~$Q�)T����8��".>��.�9VWLs%���K�W�AoD�}�d���٥Ր�,��8p�����]��Mx$A�}��E����e�L����)�8w*��-.\�+>q� �����7�7�~��Цˠ.�Q�����J3�Z7?Ep2"���p|��Z����\[O+IL�����?����� y&�i�����o`d�=b��FW�/+������]!�ep�c�����t�QPl� �<Af�E���������"��G�A@|8/P����P��w���t�}2S��)�s�I#B$�����+�e�k68!�K3���z"<Y8E����$Y؉��mhjg0�T2��?֧*�-��P{52/���l]���lxE��;���R@�����W�T� �|JV��U� j7�z�X���J<g�S2�PYe�Y���%ml��4���?"��IT�B�,��8ms�T��m���b�(B�9�DoX�Tr��v$�� ��C�@k_�"� P��}A�����s������j�@����a�V$�Pe�M��[H�gR��2n�0�.��N��(�!��9�WEzv&� �3��9����F��t$� �T̬��ƕ�� �ڤ<D�m.=Ƥ���'�~�`��������7L�����#�zm\m�]")���Ե����o rʳ�5#���!��Vh�jl�8���ܦd�q���F�K&��B��2�b�}��`�����WD�������r��4F7�(��� �H?�FC����ˏ����E�٠���D#�I��r���J��I���QxN&��]��U��s�7���Y?F�T���nԦ�j��&͆* &������o���ҭ��(��=��eb���w�M��NU���/������DwAEcޯ������n�A�{.2�c ��H`�=����d:��� m���i���/'�´z�p4�׀��)?�<r���s�T�� ��<�!�j�(�|sZ#'�\�-��� �i���2j ��pf8�� ]���9BZO�k+5o�����Pۭ����8�Q�η���f���U@1�!�T6�ji\�s�巂6��ϳg�!tB4��� 2K�V:�,�'+n��ֆ��7>��i� a:/��k��̇U�c�����Y53��_�˭��PA�Ɲ�DJ���Qw�#g���M�Zm<�ߕ��8/C�@l����#��1/c�������<�+A�n��Q��m��Թ>���{ �A��}Nܢ��Ԩ@�M��<���>R"���<"�ϵ��h�-"�buY��p�M�{E�Xp,Ǥ����5��KK���рs��H�˘�?Gstл,��99��AT�8.�Z��?�1a�8��P��DLs<�3�^* �����(���:a��vT�H]�[X8�zgKJ@K����F~��V���TG�1 ͦ�����Nd@K��,m+�����r�.u�t����D7`�>3;d����^@�T$յ����75�&�U#efl���Ł���h��!��N�$2��\��e�G�a�#�'���L��\-/���!�����b"�����%-$5u8�+�b�R%J���o�`��Q��gXR+�(O�Ų��u��/���%N��fW;��5�~��1��X#4��Y`��[�h-�e��X,]k�����ͺCw�}r 9���hd/Kht&�|%���-M1� ѷ�r,5�CCג��ڀ�yO�(R�N��|�>��Y�ٷ���}�f�b�� @O�E��q�:`m���3T;�h�N5Fw�9�OP�f'�����Ȋ�Ls��� �p��>�_s�r,�&I <N+Ox�e�1u��D�s���� ��2���ms��+�No��b�.mc�չ�5� ��p�l��K¯�ɶ�U{6��'��E�SjPdi����3��tsd���y�:�*�X��EJ��r� �L��E��~�����$l#�,��D.2$�t�Z�����=Y��K:���A����MA��S홳�iޓ1+(똦my1�QՋoLm8���TǷ7���[�d��[Q���V%�I�>x ll0rA���Z�~E]�cF_,���K� �Yi§�����\��*���x�v�;p�tӾ�]��v?�6�����q.Ә�Y��P�so�S.v��`�$ʍ�����@DME�߇����x3w����E����Ad��x��e�h�� ���}Q<o)�� �����V7�܄v����yWCK��:�'�2#�� ��P��ɉ���+:tr�g-����� .�z����z��IM�9�Ҏآ
Static task
static1
Behavioral task
behavioral1
Sample
a117f881db023599d61cdb4b5ec34701.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a117f881db023599d61cdb4b5ec34701.exe
Resource
win10v2004-20230220-en
General
-
Target
a117f881db023599d61cdb4b5ec34701.exe
-
Size
5.5MB
-
MD5
a117f881db023599d61cdb4b5ec34701
-
SHA1
c85908997a4ffa4a9e4dfd24ccdc8702e06c7fac
-
SHA256
7f1977f060d63fded5ad0c88615804b6e412a9f149348683eed55a794e7f1fff
-
SHA512
a16ca9037e4524e64dc519487676bc0fc6eb5b6f509abb86ae6dc9bb5d4d5f79e9f07c5b590d9caad7ee9b8662aa84088d5b279a4771fbac312087aef088b5ac
-
SSDEEP
98304:PB6RWAr201s+0w+0CP2M/VNWwLHIo7c7BZmNlO5Hut:PB6RWS/PNa9NWwLoFZp5H
Malware Config
Signatures
Files
-
a117f881db023599d61cdb4b5ec34701.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 34KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 115KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE