��U~Q�)8"D�ҫ��m�A���|. �{��p'.2R�a���5ܿ�HJ O��vXR�-���w���Ti�����~��,�}���5�|��yT�9�i�a�ީ��8��ƺf��t��� n������b���F��`��5�&Yf�|�Ґ�Y0#NQD����~T����T��ی�>�1�!�?��J�3�m��7�dz��ivG"� PB��ijK��,-��)*h�4Qx�U5���EE�PG���Ru5��5#X�����«o �T W(�٪�Y�f��i��A:H��� 6Dذ$��St�I�У��*��t��w��.7_�iN�b?���ZJ��_�2�j�Cyx��3M��y*G�+�5A�G0��}T8'U;���U��ɃA�A������RD�q��|ӥu�_p{?�^u�����Օ1�#@��%�҅��e��_����O���f���s�䷕'��5Z[["R�`<�/A��~v��Wb��1x��{�����J��E�Ы�/k�C5��R6i�R�Q��������-H�yi�V@��$)�[O�ZV�`����=^�ni���2�Ǯ կ��� �Y>��]}����Ǎ�[G d����09�^ѓ@H�_*���r9��V����_�u2��Ӏ��QM��?�K�g�qu��(0U7J�tޑƩ �R#xX�ж/?��u� Q��� ,�f�L㍀����H����j�����H~+ދ�^�� nWQ���� [ ��-R��t��h_��t�}2����kyh����<�e1|��aH���t�$�Z�w�犭�~I3逭k_���K4��^�6����T�0�Z8�7f�������.w#��l����m��\Z�������f姊��N�S4�1Kq+�'�I ��1�� ���ɴ��Z���m�n ���m�`[2���fo��d4�=_�Ԯi��oR��!�d�"�g�yY��D�!�Lg���6�;3����)(˃-L�i�C�"�zw�z�oR7��7l�eT����;� y��WH��l�Ac5bD%�e��$❐�Q��<�O��������b{�'� ~�FE�H���\��#�>ДC6T�k!��oIni���-�D]�';ocgĞTڵr�7��Z��c�Pʾ x-�!M�,�|�==�計/&Ұ�� �yp���%! OR�����H`'Ͱ�Kv�`�8�+�L�ׯ �ԕ�S�-�&e(&6��x��W�7�Z.�����<���xK-̨�� 3_��(?ExST�Z<�%��t4z�} ��b���}#;A�U�'��J�@cb�ޠ�@Ч��d �8�c���Lڋ<������d�4�+�� ��� �������r4��ߐ��jo�m�0�lh��y�b-ʰ� m�%MW�#�@�)� Z�F���b� �@$v�i�_�"!�b�wXg���Y->���Ff����c!�����)��A;�=*��y�o������� T��|���.rbmJ��T}b}Ԁ�9G��1�QY�C%<���ˤ�c ]�w�$�c<=Y)��~��\b�Vj4�5X�JH�E��f���́��������AH��3(�8�$����r`�ì�[bz���b�G�j�8�c�(��G�����#��<ä�y��2����l��i����u�@�ľ�!���Ǝp�Q~[����sz��A]!,��-���w��r[�sv v����*��T=��]�6�*��r��*(��7^!��ک��wV���LS��#��CB�7�V#�(�tt���>?��J�FU���@Xݘ7.D� L�r�Z5ce�Ԯ �a� ��7�P�#-꩙3���cl\p���ؾ^�S$;���2tH ?�LB�����E��&\�▵7���b9�G8�6>���d�w��u�g*� ���;u;�Ʋ���92�A�یO�X��A2��,�ω�E�%���`.*NNL��Q���t7M�]����5�|��BXh}��ع�T9'w������EP���x#��Yfǎ)5Av��g_��Xu��z>Y{��{D�$��o�P@SC�Y�bW ����~�W��*�Oct�l~ �y���cc�=���~��:�$C��c�7z�GUZY��m�n�U�MW� �2f���Z�^��L DuRϪ�Ɓ�.�\-'Ѹ�*���K�τ��0�x5#�)Gl]^�C@s`��n|�Ь�������d|z��e���p~���P�m�hx�����S��@/P�LQ��}Dq�]��������oN��!:��+��"�4�"-5��]� ��W�� $�����������獉J��.S+�?֩�:���3[����Td�B����<����F���Zvy����\�zY9�+��~�*�z����:����qZ��{<��[5'd���zi�T ��R����_됮����`���qCc�ž\M:�����9��������buz)F��h�;�̑�>��A/̡:J���e�S��A����8Q�����o�V�]���ض❻I��b�,h?%��GKuX��R�X��f�Cԟ�9��V��7l���0��ʬOWP^��m��.66@_�ϧlNc�'�v ���]R��#�Nʄ"�����N�ַ�"��*_�wX%>��mC5��� @���Bj���h>�_R��~�o�`�rg:�.%������xL�䤐2�c�S��u=a��Y$�\hѧ��ߺ�[y���2</jq.�S�����>�U��C9S�w;Ӓ�] h����5^'Σ���'��1W�l�}5�����m(�Ue��&�V��?�:*�����}�b��/g����9-�r"`z�d�Y9 L�E��L=#c�;XU[����ě���a�-Cˇ���[��g�O���s� -3˺c�&Fd����bM�n�����������\2���{�E9�^X%ݵʖ.�a~�k/��=�/y��|O}�3e�q��m���%NA��/XE�1 =x���0�pC��<��*rLw��C�OP|������jw�ߣw�U;�nC7�I�b�!U,9� �:n�>&a�r�ݑ��B������T����(���:�&��v��
Static task
static1
Behavioral task
behavioral1
Sample
mc.exe
Resource
win7-20230220-en
General
-
Target
Release 437.zip
-
Size
25.8MB
-
MD5
d3776239745a39caf3bc345199c7b848
-
SHA1
504e0a9adc23686ebb1cc2d83a8503dd98f13d4f
-
SHA256
9fe3736f011875175a5af5894f8b4ba539be5a050859a5d59355ab98cce63653
-
SHA512
ae5d63a28a24e228d949e3174ef15ebb6a0b9cc822f3a62b7213c17ccfb4eb46a35580615f19a7123262075930bbe0cf1ed58508bda5df38f839d2cd6129139a
-
SSDEEP
786432:sAQxJCW7pG9cAjyEY3GJTn15uVgeJLvddk7K:sAKCW2cAju015leVFdke
Malware Config
Signatures
Files
-
Release 437.zip.zip
Password: 69420
-
mc.exe.exe windows x64
Password: 69420
ab6db24281996adddefd4e9c38cfdfbe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.4370 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.4371 Size: 25.9MB - Virtual size: 25.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE