[q�qA*r3�^�]���B�n�6��H�~�*�^�q7Via���#-+�8-��nkv .Lフ�I���\�,~����T�[�A�,(֜z��k�)�H"��*����:��߱X��R��E��o�YOP�v�1�{+Rۛ��ە�o.��h�2Yw��G8�]�g��E����Wa �I��N�c���7����~Y��Ԯo T�x���o@+���P0�i (��-�ذ��l����'ƻI�ww$�ݵMA)*%o"K ���ѕ0���dwt�lw��;:n~!h1��}�g��. D�B㸽��u�'$9��� `\*NOM���d��\DZBH�w6�HO)ʳ���qں��[*�o� [����V��4�jFH�p���Z|�$�㕴}���)SaZ�O�a��v<]τ����qU����^�=�j��z �d��?���@���g�oƔߟ�`�~�����,�E5g-C��~�O�rPr�aZ�;���[����8�nX��s�Zy����~ћ1!�����g7�P�\���/ �,,3�}�A��� ��}�~��nsu��+, S���}犮?�g2/��Ԯ������pM����P�� ��������O�2��I/w��H?/��Ľ+t ��m}�cRLޟ��M&$v��� �d֗/r�e�8Q�_ BN\u�G��\�;D��4�2���T\�I��d���z��۾��U#缣0����m#,��^��S�,*w��D� qƣF�lp�8l�@L�g�*��?Ϡ���{�e�c�UϖY�zZ ��EH�m��(p�]>t���yJ)tDDN�g�{���� [IR&�>�Id�5.OГ�D��>U��J)ʐ�8���|�T��Qc4~7�(��"!���4}���w��QVV�w����<�S�9�y�}N5-�f漧ή�B�YS9��x�w�"�M��bc�5��lw�?>���Y�|��&���ҖQ�m��<�>�V��Y9K2P!����{�ި3Xn�:�5շ��E��Km�>ą� 7a'�ܫ vB�?ڜ������+T=�у��~�2�)���o��K��x�Zu�ļ�eh��Cv-�W!��#�gM-�7�<f�@���Ϡ��!э�������K�^���T�;��_j��c^���ЊE����_�nj�l���n�e�.�ŕ틍�j�y"(�_ϟ�M@��l�<���e}�l��2C��1�������E��8��k�+v�R�i%W��q,T�xre�+ �D,U2�T�A����s�W7j����c|ݶ��J-��=�>��n��'���������J'�X��z���?4�S6"�P6r�h���Zb�g��ծM-�hWA_%���8�!E]�-U;��E�X�Ո�:-������ka+��U$Ta��m�Wq���Ȅ�-<�d Б�@�1�x.�e��%B��!���D�����[y��S���P+J��_����f|�JPOˌr%�°�/8/�����3�b��K{����{�j<;�g��ЃBxP�TnDa�$Mi8�y,ނ���վIYQ%�鳓BT7�m��-Dȕ���f�4ޗ����� ���WU��1�EA����Ϻf zin�rk���n�1c3P��{pMΓ 4R�yŁ�%�}��e�6��jv�����|�4aKc0a�y}R�ҥ����.,2D�HD����U�����}7jr�~�0pA��ub�)���\�XaW ro��p��%�z��'�6��0�v�U ����)��<M�?ߟ!Iu=��A�J�����P����ܿ9�m�d! H�Y�m�Ɩ��:�[����|���l�8�x7x+xPQK��E���6XP%M�Bo��%�B�ӲAT�[y_WGyT��U^6� � x�7���W+2'��.���^��V8S�#���i+��B�i�O��D؆�j�z��G�5�/��zd*���%^����{Ҁ��"-���Ύ���ّ�X�#|��b*�|@�31��@�2�l7p���P���ބ��p���������N�l_,�F��D��π��Y�̒�b�v�� ���g�a�^EE�f-��|��Я�n�/)�]���U��`U6�.S<5а�Q;����%+;�X����b?Ӳl��D�U���GV�Fy�<I�;B!zD�\�}6l�%����u�����1��C\�}���E��(Z���|��j��T����^�^m(��;&-��16�տ����|��'Y��U�C����K/��h"�q�K>M��G%���Pn�o�sG�U��5��K;�j R*��g� a�8�$�h3 S�ucP����/�}!�1�d���G�M&4-�|yS�v�>5���[d�-��_t N�4ѐ�<+���L<Q�N����BD�-j5(-�P_J�=�Dc�^�d���*S�| Ω�o� K�K�A>Hd'����3@���4)߯O P��*��t��'�Xl��WK4$��8��g�:GGX'Ϋ��G�g�D���ځye\!��f��QL���<��k;U�բ{�]�1��~��Vt$K�/��N�"3�@�mqE`�n�Xɟ�87��Ӓ�<U�b�@�4�D���$Z4�e6'��[Yyj��a�5aݏhK ��LG}�i�#��,�����W��ѯ��@fy7�;�����)�4�㦲������V�+���������)<�� Ͽ��q�BhU�,A�k��W��2�y�1^���N�m������Yq7V���tx� etf�2E�AZ�;���`ct]��-����#vĒ���6�����D��JY���z/#�;�}�����1�?��a�0��~�S=���5����e$&��w~b�}�?ء����%�@6Zn`E� �5ѵ�V_ؾ�sP�D���>���?) `���ޡ�N��ti?j���2�'Y�:�q����Or8N����v��z6�ڣ� �s�P�!���e��o��p}� Ā�b�?%�h�,�g��@ũ'���ݓq�E9��>'�/�gH3���u���Rg�������Q����O�����zܩ����g�����b����j,nK
Behavioral task
behavioral1
Sample
c76619e762b7c7090877b320e649c4b4d1b07adfe11ed15afff32b786da7d91a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c76619e762b7c7090877b320e649c4b4d1b07adfe11ed15afff32b786da7d91a.dll
Resource
win10v2004-20220812-en
General
-
Target
c76619e762b7c7090877b320e649c4b4d1b07adfe11ed15afff32b786da7d91a
-
Size
218KB
-
MD5
7b6470a49392b1985f848ced73eef920
-
SHA1
ba6d9547a3b245de079e9306796d7b42ee03b71f
-
SHA256
c76619e762b7c7090877b320e649c4b4d1b07adfe11ed15afff32b786da7d91a
-
SHA512
31cf45e44286af360f2c484d618a6d4d51bd5c3a00d2ac95749ec9c5fc2a8e4f82cd2246095e3675b6ff64a18c1d17aeb9a8f26cd0d17cf5e547d5f11afafa05
-
SSDEEP
3072:6AWrkUcrM+rJfzWFSHM6ArRavqFfufjO6gPfIE4kpI8bbSN5i4rHGFRGV2hnhD:6GM+7xyavxbESprJ4
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c76619e762b7c7090877b320e649c4b4d1b07adfe11ed15afff32b786da7d91a.dll windows x86
8035a565dd6b224b25a52d8334282b54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcr90
memcpy
Exports
Exports
Sections
.text Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ