��6|�����rRXm�gQ�D)R�91=R(1L��ܝ�y�#��"z��� �u�(��wP�^o�0����ͺX,d)iY#��o��aN�yl�x)� /��#��@���c�Kg*�c;�����d���t�ڮ��;��i)\�v�7 ����C襙 ������u?ݠ`�� ���&T����������13�c:�6��+���.3C��y������ tI���.�+{�Eu���Z�ۣk���ms����B��N��K,_���EPンa����5�$�Fqm��F�˕���9�I"�?�{�VA -�&åBs�����}��2� �G;>�������E�ZT����ɛ���jjC��\����Ji4�B=�{������X>9X��F(̄{�N�:p��|�%�T��}Buh�2[I��2��c���,�@n �"*���H�G����~ O��X�ݦJ����n�z�sK����I����F�j�1̡Ɵy�� ',Q�ih�6�Q�=t��P����6��ĸ�`�_(�['�\#��m64���4NjOS�o�I,Lv�4���=�������Ϗ���Os?>.�G�8��h�����_^���a��f�vHhQq�u_����n(�p�2�Xru�������գ�l3�jH-:��٨���v>�����9�g|tpټ@O���ϰk���v�����$d���D�a�OUN9yfhp�Z0ȉ���w�A�O/�U���E�ԅ�՜�5i��+�e�`@R �ߐD"3������E�9��%ˈkz�~db� �AI a ���9<���s o'(��*z$�O��GCX�^��}ļ�7�j4��XL��� E��ocF�fS��|U��'��t� %`R�_w�ǒ���Nw�kэj��Z� �C�,WH����I����F���˄�p���`�Х���8�0w��2�Ē���gBG��f�Ep�t�:�g��/lz��s�D�5�$U���`"m(2���z�2��r�'��H�9@�)��E��5�\�`/���������4�s)���؊l��ɶw4�2[Z�z�a��Ԏ��}4S!�_{9EIyQ�άGx���ҬA��kv��~��T*è��� �,N/�P� +�/��c�p�6�9qB�'����a���C���ˉU��H� X!�L� �6b���]k̝ *�\��N�A�9����@~+��`���n;��C�[����� �TXd��9e����� ��%14�ll��ƌ#:�&<�7 'T8F�[�n�bYm���I��ʿ_μ::�Z��� �"OBT��;b۾�%���D��Y�$��_T�ܡ;���CL���x)v>�+11Yȸ�i���*>)X������M4�o�{�q��^��֮�ܢ���?���M��ʡ҂�t���>���(��3X�N������k����z8�8+���q��^�me�,$��~��n�,��Ξ0H�B6����%C<��N �$湬1��|ۣT=�˄t��H��B:X��4ީL�jm"����[�oNg��R��i Y*G�n;�0Q)y|��Mx}[K�3��pRX�˨��vc۪)� ?<,k��)~*��� q�����I�]�AO�!��QF��E��J�:����xh�R��_e�?e!���,�p�_�O�T|��������6[��6_�� �R�拭Є�w�qƔR���l����� �8�\2E�0�`��>�H@KpLhR��0i���$�W r�����������/~s��Em �f�4���hc���^�&�{��%�-w1�H�h�DŽ�(�QP&��n���E �J��.�U�z�������Ϳ�|��9ȈF�p������_���}!����`���%��T�C#�_�2y�f@ ��oD�+�h���֖K�����i�:Z,�<2��J�f���Q��$i�h8z��R{��'2��%}*3�k������[�Lq��O}�9�:�#\���nH�-�7�_K\�D�!� }kֶ��7GzI)����(A?��z����wfZ{�����`��=�M�;��Hp:�șLjG�apb�*UJ>�Q���>&]�m8L<�f�GͭJ������Ӓ�^�E���a��{q���ߝ�V�m~A��ђ�^��� 8�ޖV�*��-��F�-+|�*���8; PX n+`)-�����o�7�4��ƻ1�w���=�i�0��B�n�ϫ�P�7�p��د$�2y���Z�����AM0L~Jg3���Ѽ�����l.�Kn�.zT��JJ����I��z�Ѱ3���]�� SD֝D^�{:�Dg�2�L��A�:8��V�x�p&���D@�@����:P�mv�@�|��RQ"��D�O��/8g�}������c �Q��'#t�y�Q� �p�f*`���ۘI7�L� �B$���騗7�s7|� *zł�I�q%�̅<1g�-�m�h�F̑i�������t[3����~v$�I����K��`�3 |e�<LEdY�4_\�m_H�rhR?K"�p�8sT���{)���,_\";>�������xV��n)�uּl���`��{�Ĺ�V�q��9M���+�)���4D�j��]�����hQ��^�О3WR��|@M0[�")+MH]��4�]٪I�5�W_0#w�TE-��$ǝ@�9߉�(@�5������9���N�3�zX�Ü��z��y���c�ա+���錹� �܂�ުD ˣ��:���c�]_.��h���h{U�L���5}�Wr�b��#��Q*y7����d���@Hi�ښ��V.w�?PgZ�z����j�Z�q�p6Y��Ga����Z�/2�IU9-xDh�k5��[*�_�Y��g��U���Y�";ʅ�½�8�����^���`s3]ӟ�&�Ud22��䯬�|�BRIp�gI��%�1{��;���=N.��q��.h�^��9O�U,,m�,� ����<��D��E�GH�B���T�Mc���r�po�v�Js�[іd�!�2�'k!SB:~��|W#73���� C
Behavioral task
behavioral1
Sample
edfd18b9ee9b34bfda5efb66ae468a1b.exe
Resource
win7-20231215-en
General
-
Target
edfd18b9ee9b34bfda5efb66ae468a1b.exe
-
Size
3.4MB
-
MD5
edfd18b9ee9b34bfda5efb66ae468a1b
-
SHA1
d41f9fb9d1742eb1154281cf2dea6ed3d39ceada
-
SHA256
fd711e11ae23cac3d50f34218ed782c5ded317c92c6be5b6b69bf23acf6c84da
-
SHA512
794f1d47ff97122a0e5cf0edacf60ba0be6e033ce994a990d0ec695297f4d2092f59679abed2e7fb24ba119d511f9367a3a653c830847eeddd6d06e6067f4e10
-
SSDEEP
49152:4EyP6OzJuCSXicxAsPBNQOT5PnCElq4LJ0tVzWvYm2BI3NB/fAYCMCff/:/5OzJuS10Ok5PnWicWgFBI9BQY
Malware Config
Signatures
Files
-
edfd18b9ee9b34bfda5efb66ae468a1b.exe.exe windows:6 windows x64 arch:x64
8b8401f18e9c0fafbe8937dba613d42a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
recv
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertEnumCertificatesInStore
kernel32
GetVersionExA
EnumSystemLocalesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
shell32
SHGetSpecialFolderPathA
advapi32
CryptExportKey
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ