��97�g�k�h_����QX�#:EI��jh >��t�쭡���2�O����q��Im"�G�UQ?�태�����jKW����[��̜d����ʵ��T�$kH���L���N�Z� {w 8$�F���*��B�\^�"���]MpF�X���AJ:K#���3�H��j��I�&@�vQH�IK�DC~�٪��T{�wA/�ƚp:��;25�g�#����~r���z�}�� (z�͔,T�2x�lí K�ݦZ�.@A���.�r��b�Z J�zi�v�����r�E�<A��*�W�X}�$9�Bn�@�բ�yX>������<��(~�29�"�6s���s_���ɪ�X���c��cGr���"3�0/C��D��@��i�U�ghj�N� �r5��5�'�IK��#�K��*�O���i��gP��������nQ���B����XF��[K~,&��Ëg��s8� �в~�.��t��� �Ђ�7���&�ѭ��9>M���| ��!���P^�ʶ�Q�\��R\E=zԙ�{�"�`�;��v�x|o��;"���0��$K<�D �]S�ek[/nF�yp��ɾ� ��y^�![b*�#ZV�[�S��v;���������7�-IUЗV�FB���t��h�I����6�1Γ��i ��g���C�5��U��켹�n|��q9fk�$����ɓzM~ ��Z \fW�[�X$�zlq,�� r]$G@�m���K8����&��2�W���]�P�7A������K�b�:x����CQ��BZP��h懆 �8i6�,C��W��R�yb2�f`�ÿnAr<�j����m��ϴ�ƔH�t�w)�u���G����Ƌ!C�l���=���������;�P-����Mo�m����,�:����d��� ~��Kp���Ty���'��du˗(i%ZVmm��k{5/;�FH}�E5h��6N���_n�t@��)�S��%�����k����A.G1#P��_& {�m��`��t�1��:ݼ2I�y�8��!؎ԁeiEYs��������Ӆ�Mʹ�6�(�%���$�Ϣ(ius����"�A/�~i�0�Dc���v� ������h�c��L��n�yQ��s��n�@n�js#�yS�f�+���GL�Ii{3:��A�=�mr펵 �����V@�<K��$kJ#&���&�!�o)P5H4�Ju�8�}��r���vD�B˔H�X��~���W�b�������5Rȃ�_�J@0s��zT]�|@|] ���-D�X�v���m�،|�兙�4�7MR��)d��_�H�aC�.�T�j~���wOpQ ^Ҕ��^��6j��^�tI��X�䆤��'�D����ߌ�H��o�ծ�=i�5$� � 7w�5��r�.��y��c8��y\w'�0������IKE���R�{ř.�d��g���KF���2CYE���X�~C���\�s�#6�f���8���kk�n|��;������^��mO��r�G�2�lW8�Vʖ�@m�hr�`9M�I|_�I����� <� ������G�W"h8��$CZ>W9.���%����F/�khR���I�~YW ,Q��TͶG�`�1"^t�����5�\�G�UD����qD�R��į��ө{��"�k�C�b�:��SUx�{��Ei�*�Wx�,Q�9�5=��YΦm���V�3V�0|z1���|'$Ɏi���b*����ƣ������fO�[����o&�;B�P�alx�%��� $�ʜo �LD�XB���>�q��7eH��T��دŜή������6���6��m&��W|��WA(�BQE��wTz�4�T��LG�+�dnf�N{��6��-<�3����E}�z���q ���(*3���R'�T]9�`\>(w�����|HnLJ�8�g�������'Z�W1w�ԓޤZb7C�@�����|6�s��)mnj�2���l��G����eՊM���IAU��*Kb���;+'����m���t�-�d2�(��������q��u�L��>�=��>��//0w��N��(�<M�W����xx�j��ڴ�T�8͊MիL>��)G���:�$����iR�� �#C]TÌmqZ�*Jg6������n;$��l ��EݨM\G��TaW�V�Q/��z%�ϛ݄�p��>�&�Y�i4s���k� d/����$�6��Hf�� I����j ^^"{�A���^b�_�EDN<k]R�tG"�f&D�� X�4��2)�v�: �eZ7K;��w9��]� �Ac��S�b��8 �YT'͞���4���hDov�8�o1@B�:S���[�.�#U!�p�2� �������̀�qd�!,���OR�ހ��vT��V��?�U�#��E�(&N��Q�����[Tg��C��B ��U�)���|R���e�*�>�@(.6b�Ku� ������kr����5P?:o�n��6��/���$�g�z����ɡ��ć~]�8=z��$�7�����UK���N)�Z�x8C���-�Vߔ�u"eI�1�A��DT�I\�;G�����bBJV1���3�� 6~t���8W�ݯP���/�:�mGЄLג4�[��*%�Tp��9J�Kk��e�Z/�U)��eU�!l'fY��q�ώ��Ύ7�]�x�1R�`s������ %���8��Zj�a?���.�rR�P��2*��Mn��2B�����8�3@���[�s���0��V�PPNmn}���3 ��X2��Z�y��ǧC�@wfv�y.<c���B��!��`���v*?�!����#�$G)Q��+�aH�C量��Zd]v���=��B��1=�����H *�cy����oB'��]�) kBL�[��vńHSy��O� W�0��Ӻ����w��0����ճ)N�M{4}���{�|cA��;,J�uG`�SBY[�sEĥC<�Y}��m1� ���¼� B���WC�i�M�u"L�b!���u��0a�aL��8 {�{��:��v�q�-�ˀ����!�Z�R>?�o�0�������M�fʀ�-`7��3H���6X��u�-�����f�z6s�4K4�s[�"��P5N�t&�� �V�Ҥ�<$eQ(/��z6�;��K@��̜ST��9�ꗮ���\��؏j������f�`�� �;Ϯ��E�� #� ��Qd���� "]p_���\�L�&����4���(�3tK�T����^m�`����Ru��;���`&�Z.��bf#`�7��ɅU�y��K� s���J�v]N��Ux�])B�e+�㽱6�\ih_[m�ÕV�(�|�8Q�X5���㷷�@C����H��C!�h�o${���Q�*y��P��+��+w� �Z����.��^��z�p�VK����c�֕�5ꌒ�r_Ou�U�־!�B|$P�k{6L����X�h���H ?�������Ek���M�����#7�q.B�����BU�B��I��{����Ϣ�?z��� Έ z{�}�Y�N�����Ktl`��eeo��H����"���� W���_�)[Qg�$��+ci�h �ئg(�1<|uQJ&p���=T�Nm��#���Q@�r�E���B9�\�K�:��9G��������d�~o�8�����A���{6��% �o�HU���;�s�k4팟�Z�I.k{�g��M���"}�C ��4L������.7Зzݹ5{e�+h���!
Static task
static1
Behavioral task
behavioral1
Sample
b56d12e111e21493fa45831fe7723542.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b56d12e111e21493fa45831fe7723542.exe
Resource
win10v2004-20230220-en
General
-
Target
b56d12e111e21493fa45831fe7723542.exe
-
Size
2.4MB
-
MD5
b56d12e111e21493fa45831fe7723542
-
SHA1
4c696241e5cbb4cd68aa6fbc9d00419a5e460a1e
-
SHA256
d75531da2a56e7bb421f77d24864976be5e25ab9260249f1af2e1abd6ed9e9f8
-
SHA512
d5f48dc692b919a337ac4807f5423f75e6886bdaa7d6f49bc91ec9bad116e8d0ea1673b5d765b2d77b1f23f5087079e057af2ead9630b781e0f52452c60185b1
-
SSDEEP
49152:WJZQdK0ZqZ3TACMdqXnst8butNAHFJCBVfB2AQreW5kTD:8Qd9CM0n3u+/6fBLQre+kT
Malware Config
Signatures
Files
-
b56d12e111e21493fa45831fe7723542.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 38KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 197KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE