{ Zz������{����|����c�ҝ�7��T�t&����5v��c��Þ���>YZ�n�;�̖z�B��b�����J�ۣ��Ϭ��ɡ�>\3�ӌ�\��6�˗��M%��"����d�V��n 1��|f�@:~� �a��8��Qq@��-l73�qH����\[�������2M^<]k^��� ��c��S�d��_�?�'�'&�Bu�j.�)c��hM��|�)3f#M }���<GԄqg/؛V%ܮa7j^�tH8�.��J� ������B��b�2p�g/,�P��8���D�NO��������g�O++�D��i�-���pp���rp������4��7jl+��_ ��Hl\ƚ���з^j����D&�']�ݸ��2Iot���}�Y�hċ��`\hoݳ`XC�� ^p�q��*��C[Thn[��+��������Pz߲(���38A֙#5{�u��*|j9t#Q��{-�On�P1�E��e8�]d�v�JAo�nn�3͜D�Ws�"�� ���7Er�-w0(�˻���L�TQ|]n��ɶ�/���g 8g����>x�i��'�mI}�4�ŗ��۲��������SZ�l<��n���s2��'g�gq�ӕ9�x�Ʈ5���2��i25v�ҎɖA;MM���|4��iv�T����<新I�f/�{�cA��}����2c6 oC������G�����Ŀ~K����v�W�l���G՝�v���A�m��t&�x��h����1Kh+'z���gkK�l�NDT�w��M����~��J:㝣��^����TX��Ü�Ȍ�unW��Gt��(m�� v� o������8nu*���EB��7�I�n���5�A�0�D��q�fMƓuE�:U7��ؖ��t-Jw�_䗹!£�6턪�������P�?{�s��(@~���lJ~3n��ҷ�Ს�2��\�T��#�?�{�=���ց�N�J��b�������kx��G ���vwR�v�q��<4��Yړ��f��ΟI>��-x�ũ���~ ���I��j�t��c�G��� ��jn�����ɫ0%i��q*� �{�+�����B>�C4%�����s��˞E�0�գwK2��R�Hx�$&�K�}� �\U��J�����c��d��8���+�n�y~V���1P��*��<#�v�v�рq+�Ah� *%Q諏3_���_��DŽ�xf��Q���3� �8�:�8�$��c�8���y/���`�����q��Ʊo���<��3��(�B50�f���j��/�� ���K��KJ�V�%j:�<�� г)���9 w�p���Zt+��[W�T�4Ŏ|c���o�k'��Z��D�0�U"�;H�>5�{������v�N]�% �fW��_+8N�W㬆~D��K�6��6B���1x�;��ɾ��N��u� ��~��*?GH�K���s��x�ŷg���.vP��~� w=m4{�Ea/|�hу�<�Q:~Im�;ees�h 5�xQy�HȀ��&jX��U���qVnN����������I�� ���l-�$|�Sg8�.��6��[��? D,� ��!�\��Q$���](����=l7C�X�|��*8�kĎ�Z������L��a! �a��(���_z8C��G��8�G��.%(G����]6����s�� �f��.a?��Q�&����~o�;�b��a[����W�_����X�L3�@G/ ��ã��+}�IPH�� G���f ]A�4cӽ �bx����,Y�ҡ���x���N�7c�蒈��÷#�*�NJ�?�2k���� ��i�U&;��i�S3��o��l׆���dˈ���q,T� &��6-�Ȯ^��gQ�;�4*m>�k��-�|�w�7n�{>>�S�?�ӇȁP ��*�x��^=�Qߠ��.�cD�tK\�b=�D�(s�ZW˜��¸��R"��%�����q͍�{�G����D��zy�W��N}ڟ0�zW������8'�ld<��L[vJ�4�G!Ά�����J���:�Ձ2N ����^�UTH�E��Tb/ܵ ���K��r�����;4?��ۋ"x�k�&d^jG7n�55C�O啤}R�L��O�F����"=m���vu� s춅1Y�&~3!��e''*}/�*�7�q�O��kE��N��#Mf�(<���r$���(����M��������X�B��?�����(��x���`��E)<Y�J�t���)��Ϙ><�F����h��ſ���,�[ސ���F��tضm�/�Qy��ٞf�{�}k8q2��85�y:���K�T�q}�X6���#]����m�B�g��j��b�p'Q[��qE���0����|��NGl�o�:�`�$g�����q�C,��I�h�_���ꢆa4=`�? iK�ۤ �������B1M��rWz�V�V��,���5�Fv|���%.�����u�kD�B�%g_�`F~��q���vR�u�S��I� ���!��/��&/Ux�Bsq|��G8��賫̘ +e��I�]��q,�Q9�a�ﲳI��U�y,`_?��ܦ�-e:�U��u!��F�*Y�+�;�^r�#�]�V�G�qX����J1y�*@|�諫m���\q�'�FNo�o��y��,�^"� hS�0� U���ӑhbG��-�fn� ��<���r��o���G��F��g�j��d[��;$����-��6����4�]�bV�� �R���"ͻ�+�8=+;0���2<�j{m�v� ���(/8Go����nQr}XP`�X�!�t9��i�$X<c1F����ͽ��#U6���#�O��io���M(먖���xU���]K�7 ���l�C�צ�VK%6E�%�H������c!/u���o�ԅ�11�"ؾt}��7�R�����֢z��Ml�^��wpPB�n�{ ��/~�@^��2��� _���༕��@?WÞ���QS�]�ܷ"�뤶�LF ��(x���+4!�omϼRȿZ<^/ �� T�/��;E61
Static task
static1
Behavioral task
behavioral1
Sample
3eea679d882c62b1de55fc7e0e21c472b6581a082a4ce0f7f34977e10dbbe46e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3eea679d882c62b1de55fc7e0e21c472b6581a082a4ce0f7f34977e10dbbe46e.dll
Resource
win10v2004-20220901-en
General
-
Target
3eea679d882c62b1de55fc7e0e21c472b6581a082a4ce0f7f34977e10dbbe46e
-
Size
319KB
-
MD5
7a4d18cd0768a692ea613053af0f4900
-
SHA1
cd86dcd16b48bcf2cae878ab0ce2b754978acce9
-
SHA256
3eea679d882c62b1de55fc7e0e21c472b6581a082a4ce0f7f34977e10dbbe46e
-
SHA512
bedbb3a5ca06ce594e840db9a42eeb89002fcff4dd965f87cb62ffb0ff8c8edba6a2286373e229f1dcd6310f72630174a2ba940b7b12a40087a1459f433a5560
-
SSDEEP
6144:VOIQW/HfyUdEia7jfGpi45en6a9pUuEdLPlgNjRFHkxb3Wctl+oY:VOeyUdJ+j/Ge6rLqt+3WM+/
Malware Config
Signatures
Files
-
3eea679d882c62b1de55fc7e0e21c472b6581a082a4ce0f7f34977e10dbbe46e.dll windows x86
acade32912db8f0dcb793dfdab01c0e4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
modf
kernel32
GetVersionExA
TlsGetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
CreateDCA
comctl32
InitCommonControlsEx
ole32
RevokeDragDrop
winmm
timeBeginPeriod
Exports
Exports
Sections
.code Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dmz0 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dmz1 Size: 317KB - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ