7m���N��p:F�=������ o+�H����Ah �փ��I~�Q]�D�c^Y�.��A_�5,d�yy���w{7Ml������S\J�\��4�x#h������[��8L(��uU� �4g����mf5fH�s�;�-�����J@�N�mW���0�1��3��u+��r�P�Y�<��^��x50�>��.�,�����E�r�z������mZ�H�h���Q�x��:��V;ȫ�V��Di��=�3�O-Y���G�8`(�"3�H*���k>���W���� ���6��V��F�m���j~j��M��;�Y7'��hV�x�D����,�8��+�Ũ=�2��d43,`��qm��p�8Ia w�]7��,�M?����E����� �ї���-�2�1 �����:��fp�b�������z꒯�aO���U�X`��I�a���ۜT�"�����R`~�8����k��i��o5wp���/x�t4���O�ah\��E�̳^0i��}�]�X���� ��c��������8��+r��:�hU�����H\ �����W��v���AU�K�&�������F��l"r��S ���D�ٽA\b����Q>��dÚ��aU��~w`���W"B|�|�@��E'���tv����bk��P�kDx9;�d;������C�C��5��A�b�#p^�/������P|G���@V��<s����^I���,V�o�[�J�P�� ��I�ܠ�w��G,�eڐվ���h�=<z�Δ~n��1�� �9�tҽԚg�S�Һ�Z�L�\&;Ǵ����tIAe4�rњ���[#�� ����k��$ =�?n{Հ�a�����b9T��/2R.`�E7CAː��_��*(�L�Dи�i#"�����|˃����u�j*>�ay�=��! r����g�s���<<U��A9;�Y*�F��b��Ү�T�VV ;v�t).��Do3H$2���=_s�36H坧�2�M$����� GK_wfc��C�� Nd� ����]k��eX�t��g����N�H��*�O��X� ��Y�y�����) �o��� r�<�Ue1�F� n��ݹ��&�SθVPC�Q�Ӝ�}9'�DM-s�v���_�Rv �����ؔA���y?��X[{��[�>���V,F{��KQ�\=܂}⚤Ԥ���s(DU����R�:�n���Ԑ���P| @�á/�Ѷ@!:��Kg�d�{ ��(lM�`I�El-V�@ЉT��q{$�=���smhk�e)O� *[���t�����Aw�(�`��r˼���ۄ��߸1g)F8N��G ̊��y�|[��Jx|Q�`�_L�\��/8�U�(�A&�ot4S:��=@{���|b֓3:gr��� uc������a$�sW����CJ��X~���=]F�[��d�C��]F@���5��[RdR��y�y=�Y�����8� �4W! T�E��[�/5[�ֿru ����o�t+�{Ν���������L��������o��h�ּ,C�w��=�����L���TnDZ���))B����0ӌ]����mʮ��"�'C책"��(���3 ,��Y�Ľe!�7�Β�UKi�B�תP�ބɴfm/�"�*���N�4k�������Э�8�,�0{� �����֟w&Ȕ�����ޞ�.R���A�/W����=\`�]1ͿIr>������"�L�0XȞ�y���z���H�|T��~�5��x?��&�|��r)T���{X�g���K��"SBʭp�ڼ�ю���hm] 8p{Շ�����є����ۈ��X-1�}�H���Ȉn�8+��%�;4��+����a�o��VE���yd�� ͮಸd/B�JY�G�)=x[K��pII���a�0�`{o��yϸ��=�YV���G���'8��a;�R��ZG��߂���ܗH�=�u��+�o��#�M�#�z=�+Jt�&�;rŗ2d|M �|�/3���(3��u��_`��Pk��-ф���C����3��)�6J����M�m�래)#dz��p7"@Nc��AX�>��`�/UG�Hۊ�mĠ�=����ws'�� sS��vE� h9�}��ci��駒�J��_��T9�����f���? ��N�V����k�\��) �pg'0%a���)UɘIwQdQ���kF���w�������\� 39��K F�#T�r6�����d瀎-�vTs��� ��Pb�ӛ���z���Cu�%�Lx!ջ�ji�H�w�/ߜ�%W03F�3�1>D�%�>��:�d�>�$ό�w�]��Of��]�].�/�Tv��%������ }�ڀ����K&��[}��)I^� �[�Mn�b�7a�u?_�v�D�^S%Xo��v3�� ���-��S�*�Foծ'��KJ�E�݆!��E4H�.\o7T����A�WS��U��*���E��`���Łѫ��irV���V\��ɇ6�<��v�rW�F�jN`�&_��P�NͫČ��?]D�i_��C� `\(dںͻ9�M�}rL���uN����~�K*ې��NkA�:�+����m*8~ q��R,�� ��*��;��0I������_f�Y�[�R�ؘ Ա탰B�H"�i��=`ט�� ����agwu�a�`�a��|�M���V���pN���%A�K��(R���ZR�P�� ]��}Ņ��2�_�lVO\B/^���u�%�5 M�eT����a`���[6 ݠ�>|2���(G�������6��67�������ߜ�z���0Y:��g ������[2k:��ǟ�iRd�P9Q=Aw��T��&�T}Ƃ[�T���.Td c��[�2&��(Рʅ�\o=�<�mϪs`�\�T��[[�d��y5/?$K�0�CYdp��S�!�2��O��?`��A��r�d�U���d��P!v`�,��آd�b&l<�I�Η��y!�SJ�s~��Oxxe�MvД����e���Qnķ �i{����K���� 䜬�H�\#��������$�g����2�z�'�2�M�^
Behavioral task
behavioral1
Sample
08ab1a9e1335dc8a5c5b19e81a495040d657cd4fa280ecf72cc3dc60cf7b27ce.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
08ab1a9e1335dc8a5c5b19e81a495040d657cd4fa280ecf72cc3dc60cf7b27ce.dll
Resource
win10v2004-20220812-en
General
-
Target
08ab1a9e1335dc8a5c5b19e81a495040d657cd4fa280ecf72cc3dc60cf7b27ce
-
Size
148KB
-
MD5
6b51540d585b7b660011df1ed79b8b0c
-
SHA1
09afb6a06499010adeb791ab15d53fa6b8d3a9d6
-
SHA256
08ab1a9e1335dc8a5c5b19e81a495040d657cd4fa280ecf72cc3dc60cf7b27ce
-
SHA512
5d60c91667f9f20f5e15cd382644fa8387cbf0488657ae016e906caf47f892a90ad7a432f25b6ebeb288ca35a775a24337e3894113027a331a81cc565ec8b817
-
SSDEEP
3072:XYYdsALtnVt9kFvn0dDSTOkSREQaC6wGu9J:XYqfz9kFHYYC6wR9J
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
08ab1a9e1335dc8a5c5b19e81a495040d657cd4fa280ecf72cc3dc60cf7b27ce.dll windows x86
019d0805e9542e5a5182f8d1ef377af9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 136KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ