9�����?���S�3��:�X(y�%�����Gb P�VͿ4GI��rk��@��긱 96D����o�:�P�_cd��T@�v�ʹ�.Rt����^�5�"�髐e�\:.mr �����\n���ϐSp�Ak2�ùn�m�j'�Bđo12A����X"��N� /P/$Lư���̛w<� :���o ��t/P��B#ڗ&���Ɯtm˻��W�����m}��!���M�������J�MKU�/|�����9���u���'��qL�"פ���F���p�YT�4Ϣ!=o�(����5�R{�Ϧ�Ev��m���� �݇CZ�����3�F����5��)�FϪᗉʞ�}��X��/~��]�s�KV�=-����t�V�d�u���B��s���?��b,9�����<7�Z���$���4�t��\Of�9�o��t\H8%]�uQ@�wMw�%'8M�{��{����v�r�q����A1,�bʢ ��'9N��㫢2Ŋ��:��2]�����' q�F�%?�Z�N���_���D�YК��'4���)��bw���VP*le ��*��������~2CˍBJ:���]>Z��N��������,��NW�URtdg<,�;X� �9|�����T�����$A��VKOK�I(��L����t��4\V��A/퇲��Lp�*�E�QpN=[� ���+�D�*�2I����Y���ݙ�J���jr���N��p������)h �4���'��ӴwP\J�)�z{9hS<�va��,���ju-�_�������9x�g+�])���|e*4B�f�v�)��Q:e0��N\`�-�B���o��T,`����{/K�˨J8����h��6C��Cܥ�KJ��gC�F7GY��0%����BM�4G��g��Q�CY����[� *I�xF�6f��QP�����2/;ڠX��+�%c�>����� ��6�Z�MD@�VN{X�)p�}�n��q�|0��DVP.Vp��H��h��%���%]���=������Lk����G�}u���M�)ij�� �n��0ϸ�"��aI����܆d��J�nac����4,�!^�e;��;I�:7/��V�j�pR�d����W�&<_�YT���ceg'C3M���L��4(�����l3�/�s�@�/v}ت(<m�U�jT�Y=�^�i�N�ތP�.��n��l 9��bCU�ӥ2뢊H!Vo�D偿��KV8S�r�Cݶ��)N@f㹭 ���a��=�`g���E�j����]?�@-�-�Q�Ne3��# �����hx�WmX`=��ȞXJY�#�_k��[���.r� y�$Cv�e]x��+�I��n.���f2�)�צ1�9��tp""#����bc�f�����1[s>P|��� �\�����je�b:��Љ����_U�Wc T�gc�~���/�>T��*uZu��6����(�-r�9g���������C1O¥~ ����y�:�GM�Wz�m�T?�Y+B4`���lD��9.��SՁ���4�ղ��l���wߗ��r=��/ٻ�lp�/i�\��Дt�� �%�@�����͉��:ކ��v�p�d��\��ԇZ�������'�u��� ��A�9S�>����}F��Ҩ�)L�xP��T1D�q�dJ��x ���1�W�n0$U}&hZI �pg�v�����%�/V�7���,CU���G��4s���w�E��R�C�]�z��dNGS�<"?#�8��<� >ݮ�"?�U7���|�L�fHܟ�/ �W��d�(K'��Im[HS�T2p���(�JK\>��%hC�-��]Z ���I��8&�ٻ��<�Y8����1����;<Nm+h�S������1�⛻P{�0UI��p@�K���VsԌo"���2�4_]���:�=�7�a�M7���ܸ��s=�"&� ���N�A�99���L����6jԿ �v8��`����X�NP�c����Fq�d���=�a�o�Mdl�Aei�2bӡ��Z�^O��qp��w��c�����]�<��1��U���i��۪����*[�4E�-��X�5B:ޭQ�q�N�o6w�wȡDa��yy�D-�Z����}Iѹ쁛U� �|u�����S"rU9�U���K�?��#r|��PՁ(�~�%���}��~D1����3�� }�2}����5������|w��#=��������}�����r�>M^"��1@����2�LN9��n�lf��W[`F���YeqvW�����ӟGeڒ�TmW+!8j�Ʊ�� ̲���,E��C,d4�Ƌ�Ֆo`y '������ ѣ�m�6T�5^d�������B���g����7�� ���C���u�iB��ì�,�fM���[^�����D��T���ضu������"mE����Q��$]�V�e��:���B�@�v���.G�ʨ�fo��st���:�ٺ�����ԥ}櫭�O��5܀RJ辦|7q����X a��9���z�g��)�5̊%�%�nHm�g '[ v�yJlJ�����di���֪�����T�Q�q7tdj1�*N�?�ٌ��*�-�$�����ꒈ��?Z+�����jTzļ���QѴ�������8 ��5k�����ly�Vl��|Vi{�)��u���)�H�&�D� ~��|2.q��IɊ�o��Y[�wZ'�X9خ^���X(���-���q�|�R+@������6<�Lb. ��A�:_��QF�(�F����!�Z�4�!tջX����x"XN��ul<�4�Z����j����8 �cQ��ߐ4w+��GGκ�����0p���:���m"ф흱���OY���`�k���T^���f�1y��JOZ(nNe��R�q�G=� �F>�~�4o�s�?tIE<%A=�XA|��U �Q2Ξ`����lR�;������W~y������h����1� ��uA���.Y���H=5��>�Hp$���]_�R��%�\e��l��n! Ⱦ�ˈp(�P�+ l�����ق�ğ4�B-2 ��Z�>�{A�!���
Static task
static1
Behavioral task
behavioral1
Sample
Kaspersky Tweak Assistant v22.8.6.0 by Bambang.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Kaspersky Tweak Assistant v22.8.6.0 by Bambang.exe
Resource
win10v2004-20230915-en
General
-
Target
Kaspersky Tweak Assistant v22.8.6.0 by Bambang.exe
-
Size
7.2MB
-
MD5
0a134a2cbc99e4aa5b22ae10d5b8e70e
-
SHA1
cc9fd33f019b959be12583351a5b50080aa3c0e4
-
SHA256
98783c856f8c79b5a06ed527afe85b953de06c21ed24af4fc66886bd84e59af9
-
SHA512
962f3b95cbfb4a8641ce6a68bf7587a6e155e0ef44e7e86e4ee13291c4be381b1c326b73e03a6debff902350bb1b7614199f811e71ed5b3e52b98d37a707d6b0
-
SSDEEP
196608:tDbGUnfbNWomVrMhpwgduDVhFAdGKkfgFpnmfVg:tRfwVVrepRuDVhm4KLDnmNg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Kaspersky Tweak Assistant v22.8.6.0 by Bambang.exe
Files
-
Kaspersky Tweak Assistant v22.8.6.0 by Bambang.exe.exe windows:5 windows x86
516f628ddc4e74e673979a661d44b9bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostbyname
version
GetFileVersionInfoW
winmm
timeGetTime
comctl32
ImageList_ReplaceIcon
mpr
WNetGetConnectionW
wininet
HttpOpenRequestW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
userenv
DestroyEnvironmentBlock
uxtheme
IsThemeActive
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsCharAlphaW
CharUpperBuffW
gdi32
EndPath
comdlg32
GetSaveFileNameW
advapi32
GetAce
shell32
DragFinish
ole32
CoTaskMemAlloc
oleaut32
CreateStdDispatch
Exports
Exports
Sections
.text Size: - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qei0 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qei1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qei2 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ