%\��5�k�lkm�>�y��M�g��ht�S�Ev��[x}�~�[9���m^��r�5aT�����\�F+�?xb� >�yʗ���ä�V�rvl[V��@(����%�sջ��S��k̀)EYH�v�E]?n�L��n�}?����/FP�%ʡ�2�͙*e4�ޯ�x��c�� f�t\�����i5 |�J#����d����J2sN��\.�������bW�.�/~�A�|#�9�^�_�������lf���~z�s>~Po|��p&?p�<Eթ�S�<ߛLͭ M��'� ̳��B��i�GBm'Z������$l3���U-p��SL�wqz��O�d?!�<��>�>��]^��ʳ��fu�P�9��Z�~T+ň�a�j�eo�e��?� יa�h�ξ��c��f�e�ޫ��23���qW����v�Ψ�ښ�Ց�������LE����8���^E'��<I��ߌ�����X\9�!%R\ņES�30�����,�\�� �T�D�/i$2�/pD�|����C'գ� �ѻ�i�!�:Ș���0,�ď]/r+�J˼f��|�����N7��T��z�V�V$����r��C�R�H��/j��L�Q����t`�w;w{M�N��Zc��g;���������y�ZK��b:��J�a�"��U�����6"�qah������变,4W?�-:�;�"b���'A}��46��̾����1Pþ%d�&��5˘��0���l�),)�Tz.����X��o2��S����P�{�3�t!Rx��N�>�j=���@"ZΐUi�h�BQ6���"�d~�j9:����� �HAu�^Y5)tn�z�O�'��@5R����d�?��+�T1f�H�4j�0I\O���O ��A)ӣOG�U�@�x!������!���ң�����Y��h4I"������E�^������}��V�E�L�cC�A ��A��"�_}*���.GmR�������m��T�Ћt@�z*��f۾ST�B;��� ��즘̖���ՒE���E �_"�_���Z���}��;�R2��'�$_S��^m���vϩ������4�+zr�U����u��`8���������T%�sƧ�H�&~=+��8D��2(���l6�8�%�/��y[��LbCIS��yS3>ah0izz1V�����4¨Y�b���X��V�����17@����Ț3F{ޕ�qO������R��_x��g��`��%��� r-�4��=���eq�a���Ggn����)�`��N8��CX�pOl5<+[�.��w,2�"���pؘ\5�h��H��,(�!n�Dh��T�=Jcս���w_��ʛ'���pW8��|�"O���*�͕?�/�i qrJ�.D���A���� �8GΆ=����Brx �LI"r �O�h�D����]�o\��l�q��YX���-;I_�C������p���c�@�:�d�,���1��.9�poi�H�e�X��x�M��-��f�[<ղ�����B8L�ߟ�)����;v�T�e<+�Ÿ�E{--5UB�H��U,SXH˴d�^��04k?����\���u��)�h����@��z�O :�|�mM�g ����_n5J��3�6��(q�5��( :�c�Ѧ�P�R<(�{�2�؋���5��Sxg��Z���i�.��A�@�l^�Vǿ{<����bPߢ ���us�^\Ú��^��.���آY�+���C{c~�P��_����LaH�e ����nJ�,Eb�|�Q���/^]q��'tT����K�c���C۾��~z��=�sO��.8���@�b� ��]}����y�=9�X!��'P��w��s����t�{N�+� I�d�^lʣ�tKWB�Q'���]�+�`�����L��� Ce�SF���z��<B�p�[�j���#,4zW?��>�D���K{ -�r���H&WJ;�N���E�O��L[�ے�ý�{��N���+�kcj�X�f)�zH�Z_�m.�N��֦ķ����D;]��2!��3Z:g����(��3E�-$�|��6xt�FZ�h�/��Ӄ֥�%nSb����_���O���Di�Kp{��j4��-���R��}\����Y����x?�� �']��'��O���)��?0�˦1a��H���c9���aZb�a�g�n�<2s�r����D3�:�&Dl� �\���V�!v[_�c��q��CV��株P������4��4lKǂ�_pK/l�u��3#h���X�l�T����7c�9A����pycE^J��i��A�嚡�k�����9�}��=ݷ/6f���e<qb����#d���2;���)�ᕝ�?�ul�%i����GȆ�A�tl`ZK=X�F���\����XK��?��+���W�������G�h�����5V���R�՟(�4������4�N�߷x���f����k�A�f@���W�y#Ðr�B�_y|��{��9�C��5I���q��t����ұjU�e8�Ȇ��F�������D��E��4v�ӧ�M���nq��xږmA�y�oU� p|� �_��W�ҖS+�&����vs\5!�2�Zw��ip�r��r��?�k�/���#��U&8PdR��F8��3L��e.�-�����5�V�k�展p�R-��9��z������������T��vܚ���M�,А�;�J?��^�z)����Z���h�F�tOo�w]�'`��&������Ԓ~+�;�,Б���Z����`���4gY\�:�hD� }#�m�ۿ�v9]��� '��JCLI��E����S�Â~��_�g��+�����_��.S���SP�P�7�K�v��V�}���ֿB����SC2�4ϖ���� �r�bcg劗���T� &��D��������rӳd�屢�����˦��:�е�IM��tU~Az��d ����z��3Fyp�.s����ˑ�*l��x;2�����H{ ���W���r~�)�n��ry�V
Static task
static1
Behavioral task
behavioral1
Sample
321bf9d069d39bf01103bb5dafb8f65a4dd0bf3fb4110e316c58bb75a9c7147d.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
321bf9d069d39bf01103bb5dafb8f65a4dd0bf3fb4110e316c58bb75a9c7147d.dll
Resource
win10v2004-20220812-en
General
-
Target
321bf9d069d39bf01103bb5dafb8f65a4dd0bf3fb4110e316c58bb75a9c7147d
-
Size
386KB
-
MD5
6549cf63d986546280d51bc24220d407
-
SHA1
4d0f5edb105790ae00975f42e51057213ddcdff5
-
SHA256
321bf9d069d39bf01103bb5dafb8f65a4dd0bf3fb4110e316c58bb75a9c7147d
-
SHA512
60038623ca1b9de3f586cdd63fa57728ed3d5f0b5e183aa38af849f7b09136ec3cf7bd59da7ffd0fc7f103805aa711e1a2500014c7d6e0cbeeb7cf7d89aba2b1
-
SSDEEP
12288:DIBkUw/VJo0fa975RKKHcRCVB9l5/mes/pP7:DvUw/37ap5rHcRYl5/zGz
Malware Config
Signatures
Files
-
321bf9d069d39bf01103bb5dafb8f65a4dd0bf3fb4110e316c58bb75a9c7147d.dll windows x86
612c06376cb01b10c245ea29f9ed176d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ScreenToClient
MessageBoxA
gdi32
ExtTextOutA
shlwapi
StrStrIA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nester0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nester1 Size: - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nester2 Size: 383KB - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ