��t�A��AS� 2%�p�|�J>�����ﳎ������ӳ*��O��Q��'��<x���d��ȱ��K;������r�Bq�c� ܪֻ$�G������Ke��j?� f������K.DG-?Ä̲3��O^B>y�ʪ����l��g�43OD��i�(�7�ࢯ�)a���k?�x�G��=sm�>M����y6��'�>${+��T"��7�7�#*�� ���T S��)��4��F1��Z����u^��v7"H�'�+���F���Z�.0J��W<RY`���偨7�߱)87��r����P��" Y�+�ؖ�C'�'�����S�}�M�3�cLÙ&D�y�P�\2��?��k���������L7��*mۊl/�h�����A����N��Awj�ߚ�w�����P�����=]kc� �r�U �h��;�&F�a�e+H䖜� S��wI�-�3ܑ��T��懜��APxϟ�,,)���HS�0pu�je��w��:�L�+ `���cHB�*��&��2$��_�n��4�1䗖1P�}&����SD�L����ذ���=�+Y��>~$�|!Z�I��H��l�;:����qgRH�ĒyȮ!A$������9��WO���R�'�o*H�������v�b��x�Q�$�H}�9HB�d�����H��͋\(�� �������欵�5�b��w���������(`%R68�g�;k���pAbI�n\_�1��GB�d�E�q��~��`A[��� ��<���b�Q���THF{lH<���Z�J�bZU/����3��E5����iK�cJ�=��bbO$gcM�[<��������@�F�DFƃт���hI��I�k������-y_Ѭ�=��yu%� p�euV630����p��/�אӺX0Q��zk����_���9[z�e�T� |L�[��BW]�tI���k����=��l��0���.��rAf�b`n�V��/�� �)���l�����G�q.e��N��h��wlԿ[�����a㼉�����XVƊ�:��˾j\��� Jh�{�wM�)�w�=މ��Q��������A+��ٹ��������=)�j�����Ft/f6'��N.m=m�8�Ӂ�I��ML8&���1�����J@o�,"`xZ @P�okn7����\�m��E~@��jf{vmX�㻧FEU�;З6���)�6g��-DYX� 5vV���>@�����,�K�S�P�C_ (5C<kM�#.y��'�g2��?�2G+�4�bK�ds<U�)�$��fP�Tt��>N�M�ˋ6��?�f��&6��1 ��X���v�d�})�26չ0��.����&v� [&��݈��$��T�{����/��?����;�b�z%�E�va9 {ݘ��w ���d��x��ML��bZc8!p`�,�o[c�:4[:���;I�>���'Sm�gz�G�բ2Ø����B��_� ��0�>�r����~ؤ�3H�%�a"B腲]¯x��L]i�Xs@��3�I:Q��/�9��P�w�IQ!Y\���p�ݵ�x��ן���/�Z��"I�����*פ�n�֯O}�s$�I�;z��'ˈ4���Ϡ�������{�Z�Qb-}0U�X�1��M���}�?EP�4�L\��l����UM�Xj�x��0˴��s��&{�:��b}�h��g�<��=r�h�3�J�~зvk��Tf*�L��i��.��yO�(���u0SՓ*����<H�{��^Z�9�e�h_"=n��s��ˤ��9��D=%�����c�2�Ӳ�G%{N~ � �_=�g�d@|�#�57tKus�5�E�g���(BN�ծZ�����r �sYP��^F~��U�7O��F���|�PmY��R?T������ �'���U�ng�p���e��0����j��(a!���6�����eEL���DΝx�s$6�6�MA���J]�'��|�Q�os��FU��b��=&'(@fn@�#M#�%&IvAk$)4�q���I7&|�w,����\����l�2,:��V��J�w�9p�i�س�C7��`��B�7���5S����د��͈W?TX�5�W$���A�؞,M��"PrO��ٟ�Ѧ-5���bU�?F���ߒ���t�h�RH<�-���<��ک��]z�fx5��Ka7�L3��ٍ�.�I�tʏ�����LoG�g�T�!�J g�d��m'��=Z:2����S��0� Ԅ��YӨ�m���u!r�Ky�ף���ˣiZE���αm���/L�W�4 d�Y0���gr:</�pq�U'�`Ȫ'���F�=�{�V��%V���X=�\��ޱ�9���z�n�ď�EZ.��}��I*����2�@+%#Ĭ�P��?�@��-�.4歬����=|>s�v 7���k6����ߧ��J�Պ��El�p$���hr|9�1��)�W�e�;��G/^�?�F�����Q ���+�����m����إ����Vq��#?�*)�k������%�� �"��<�<�@��t���E�w�8�)b� -i��!n��V{O�}(��fc�ME��B����BXZ��γ��uzpxK����Z+;Vd��m�g���(XU�Y%UNH>5�tW��`0����; �;2d8@�f���iִo��A���UW���u��<�����&R�(�˧z�`�����d�D�|@/� H�O>������n��]�ug�#�r�9��R�K�K��ȅ7[�����b�ܱu��&$Qݢ�V�& /��Ƴ�ɮ���#y�y�y�(VR���|�����(q��/����8�M�"1��T�Ayw��e����R儝�V��7��#ku\ݭ�������:�HC�<���*a��i`��~w_d?T=�����9I�_�}4��9������ T]Ϗ��BW�\yy3L��8��"2��J�V�dZ�X����tz���lY$��q��m�u�( $l���3)>���������͑n;\�����s��7]���WA�~j�g����m*=�s���l?9j��2�o�B��+G�pQ��?hQ6�< ��
Static task
static1
Behavioral task
behavioral1
Sample
sima.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sima.exe
Resource
win10v2004-20230220-en
General
-
Target
sima.exe
-
Size
7.2MB
-
MD5
c5e0fb4ecaa8a7481a283099d604f7a0
-
SHA1
df4b0c0cc823da2b0443076650c292b43dd9de33
-
SHA256
c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
-
SHA512
375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
SSDEEP
196608:5HatuBgIpTVbThhJLvzwKVKgvFXv1bbPC:5/gEVTpZVKSFvo
Malware Config
Signatures
Files
-
sima.exe.exe windows x86
c41f72930d6a9fc390cf4990c8e5fc1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
RegSetValueExA
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sWj Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.{d4 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3Vr Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ