�Fd2�Y�mR�G�{֎r�R�ȅ�d�;�k�I��e"hdu�����Mh�{gjPKJ��� ��~5!6�W]ڑ浡a���T�"��g����V_V�J�%]Om ? ` ������7c_�G���Z<�����;m]W��䋐�_�?m�e����8c�6E�r&�)����a7_� s D�◙k�|o=�\�>j �˹{G���wJMu���������g�i�\�A�M�7���ḅ�F�����r���I� �����ڋPIP�G��R����A��Ʒ ���*���\�cF��t�!˻�ǭ����_v*�m�I��n�4?|��Y�.joA[��"+Wܷ�%�M.�?���9�I�=8��D�ȩ�0�C������z'��yM��������q�nS՜C�_� ����JM�gϽ��b��?Wc�$f���ϔ����A`�� nh�����AdW��)� xA��o��%�n*��c�����RyZ<,�pR�4����������z��"Q[��v�@J�0Q�}�>�W�җ�߆�}gk���W`��^���� k����fW>V������R�������0_ .`�!i���ʍ�1|�Ց2�*8��&ē�\ȱ�����f�<��|~p:1Dn�t�9$٠�_�~S36f))M{ёx�C��N����}�+��K`�qc��f�wK`�� |I�M����iC;&#Z��)i�l��a;�/�N+�����vϜ}q��SkSw��Nh�P6jbŴ�2зlM$"�h�% �o���ŝ��x�4i?P��{����E�A�����9&U�Ĕ�!�Y���sIq?69�&�ٝ��v��\�Μ0r�B����|fc��K� ��Z��Q�ҹ��s*�I��y�\vdf&�-fф`��dX�c���?�֠��W9���K��`�d��-� ����Wi���e^b�8�PX4>�� 1��3���$��Zw'`�VY��{�Ȗ0I�_Iz��us�@��}�X<3��9Q`�E�9��#��h%�����ٰ�v��yv�c-n���K�"6ն�M�JLR�%<���B��5�b��E:�YEh�i5��~3�����/Z�g�����K[�cdS�W��=L֒�u��8���7���X�醾�i쥁P�fq�V�C�|E7�����7���aj}��_/�H͡�p"Jb}�Hg����H�,{x��zT*��N��)j�p��,���(�<��B��T;������}gt��۹�Df�� C�.yLP`��q�������G@��_<��]������q�T!b�h%p3��/�y#����~H�'����`o�3̄����������|0��r���h��X��5�9���[N�/�XΖ�B-�[k�80��ɣ��{�pc:/��U�U�lT�BQ~,{`�g�LNe[X}?;���Q����<��G�!_`k�����5v5x�h4j{i���j�Y� '�&�r�Q n���d?�r/�DK���N���Z��`�anC4���,�Գ�����@�Xy����A��X>ې�U��-��x {�ܷ�������'�So���[�.D�q�2�*j�e���kج!����|!���Bf=�VOE=7n�������+��t�`F�y?zl��S�1�ޗ,��.z�C���=Ԅ��5W���T�~��l��8�ښ�g����ʎP��HU����B7ax��*S7���R����@ �O)3���i8T��6 M'��K�U� 2�q%`��,��P�J@��ʞ�`�����-�l�̐г=i�6uUW��ǝ�� �Я�{PW�؍��r*M;�(.��FT�g�������X*�;�~��W&���@�48kٿ�Ӏ�Z7Mou�V��^N��>�vW0�1� @���d�p� EP<[GʠA�h�,�[�P����'wH�Tx�� �~�j�¦`]+>K�%��Fogԉ�BM�d�5U���H���6U<ynO"x�)���SC�+��Y-&�u����� Mh$�C�B#��,����$v[FbC�M�0�'�@���S]��{F�T GU��j��k�A���N�/'��y?�U�<�_���/Og� %���*�6�7�����S����YHg}R�I���Z��f��CC��C���]<���U�7�Z��2U�!g�J����袞m�~��y{� �mq�s�� �Z�l�εޝ�%Z�t��9��:=����{]�!lqx|=��ۚLX�DĝQ"�I+4���Si�����e!Y*�� sE��ӹ�D���k^��CI�'�0�y=��B۠��A~:>��yY�ReI�z��z�Cv��d!��bI��#�� ����<�20q�}��L��d��� � �L�x�a�gۻ���_�.� �:ff[��h��N�p�\o'A`�[B��h�D�a^�/�������[G"Uy#��� v��=vP���6Nv/� ����.�}?���M-��ǣS���e�����q85Z��-�'.������eq$�/2�������%���*ĝc�=D)����Yn����A��nW ξ�>�W��l�;�{;c,z����Kn� eH >�g�3{�� �i�HӋ�0���moZ�~O�t_�Zv)��Q��n~��gD2�ߚ�İ�dVݍ��Ǟu���F�qT��;v����qgb�<R��#�w���Qg�Q)r��e˂kH�醋�^d�xt�>�/�����L������&��������$ K��$�U9���m>����C�"7s=o��?�m}{F�B(J>_��[?��L$%s����Y� ��1���h�S?���V i��#1��,����h���x�q1:�6*�&��V��p�l����V�'ӻ����᚛�r���ϱ��4M"m�,S�t�����C�@��R��=�� Y;v7�y=�ߐ�0@{�Q��]�8E�@ta��D�{[�l��V�Er�q�+��8�����u�����%T <����;�y����D(�~�H�����TBj�5��/�T�Q��}�}�ʪkP�Q2�<��]:���%������jl��6��d�Ϟ���ClΆ������z#c�p¦�χ�g�Q���p��/��SX��-�l�dN����"�K�����<z��#���4�ȅ>��Fڴu��b[�i�����Wjn�����C���䙽-����|�;=�2!RW�� �E�a?�۞�z�a}�����<� ���x4����Q��Mji��i��I���:Z�)�&.j�6x�6��S8k]�3��MD��Q�{(�Ɛ}v�./��7 ��BG],��%�gE`-հ&���y��G������i�_�Y��KoyL��;_$�\B�kR��i�m�O����d����������&�W�����U�{[�Ou�D�RH��y��+{.��r��Cm����0T� �����q�K�)2]<<C�L��c���).(8��Z�RIB��P��$7!��M�0�&pF�� �|���pG���$x�DoX27S4��"��+��@��*�&�5���$�:�_~�r���_+���$����o�2QR���^��Re͝,�*�Y�4����M�{S��B�v��*9�~��dL��\#�14^Y_J��'�ܥ��`����?����
Static task
static1
Behavioral task
behavioral1
Sample
39a0450ff41ddc06f9a8abe433eacaa0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
39a0450ff41ddc06f9a8abe433eacaa0.exe
Resource
win10v2004-20230220-en
General
-
Target
39a0450ff41ddc06f9a8abe433eacaa0
-
Size
9.1MB
-
MD5
39a0450ff41ddc06f9a8abe433eacaa0
-
SHA1
0c36a415615cebfacdb6b992ba4053bab4064826
-
SHA256
e0342b71ae709cb0c15759674aaafc69c4018e85e26838a85dc789d010d266b5
-
SHA512
d7eee0efff21f79f611e2d10079616a350f5f6826c7db5f1b16bfc89b4d55509b5c4a6add6ab36d08572cc5739f3ba1d3fe70302baf5f75c823686337f0a9dd3
-
SSDEEP
196608:AmrEBEwlYtAccpnS0LSGqmX3veTBsU4LuXF68:AmgBtecsklX3IBsUlV68
Malware Config
Signatures
Files
-
39a0450ff41ddc06f9a8abe433eacaa0.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 226KB - Virtual size: 476KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 48KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 294KB - Virtual size: 38.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE