����D���F�����ӳ[�8h����Q �W�GN�@����XTڤ �RеH�NI���d:su�E����r����?�|�`teC�9d�24�45Xߠ�`���g�|�H�[��pug .V��5��x ��~S!�/b�Y���P7��!�T�� @����BY�e�:A�>j��|�P��G.ȡ�|D1��yHrX�EA[� ���v)��*����0�0d�Z�.�4�-�>`Yr�ܝ�2�ʸ�����CEܻ�� �hs�0|&C�vO��a���n�b��}��x�ኄ�W��cc+�FB��Ji-��$g��J�� fp����}���]��Z��h�7x9=�p�5h�-���]���k� ���,���{Q��pI�`3�J�B��cb%UxZ�t��Չ}��J3��Ԡ���'��ym?����`Ok�ݙo���1B_@���i�����}��!Y8��bxM���+*)���}t3AUt����jiI�aI�[b���Cb��+��kR�?�|����K�d��'#��=�ԝR,==5��z�Z��w�0#/fۄ����o;&m^�`*��x��Q$�������� �l�x�@,eHF�]����Ϛ�"�o;.�7R �͗D��)��A�����{��ЦqP�R��M�C��X�+��"���=P~��g��ӓ2�h_A�x�]O��O��/,�� ����-��ʌ�U�G����a��/R�g�n��N��kR�f�[���a�g�k���Un�� �x?���X��J�1� 0�L�!]�o!�?f6���8x��Q ^Z<�N�;��G��� �����}�;��%8�������hq ���Iݛ#����.���6r��9�\�7�g��Z0{ty�I������$�\hRvx��5��s�[�C�,o�Y�Ň�-7ҦqP��.Q$�띩���J��z1@��H����q0�f�LZ��h���cpX8}�ܰf��HC.~��'u?s����{Ӆkoݸ}���T�G7���$~qCi� �8�m�+�C�����~�ko$x]�/t4-<+=����2�PDR@P��f�!�N�g=�2GDOY�2\^{��S>�H�W��ez����09T�Bi�;�dά�3d]#���X=����uc�Y�&I?��RG�^����ЕĨ��Y��XF�#�k0�@���F��ٲ�W�E�do��t�g1L���r�@�� ��z9�+�مo3%a�6)�Ӥق�1]�:od�Bۢ�AУ��cË G�l��j��^�����g��,8]+��w a|�!+�)%z������z-�z�Q�1c����EtU�K��=TS��@�B��7�t&���v����+��S"� �+������]��6<��b���QD麋N��k��l��9�B��x���e����![�{�t1�#{�<+��H:��o@�!�/vGQ�A<(��Dz��T�9G��j.���*G�c�b���pV����)!κ^����/��2>Je���:�5 �DŽ��]ON�����PRyI�T�>oG�S�w�Ȃ��1�����,_;��8�-�z�ڒ!<��[��#��"vs���7�C�V X]���d�\� �`�c-��*�g��n!��5��8�Pi�fzHE�9��<���T�`,1g����E��Yv�8D;�=}�.����A�#���@I}Ñ2S������^�������@�YF17��B�&�]���ݠ�\� ���#�}$|���2�"�x&R������Y�ِv�؈j���� �Z#Ŵ�&{9L˲��e�hJC���ww,���֣��}<W��b�(���\ ��2������G�����nz�geIKf�A���ވ괡� E�� Hڎ�*�@��t�dֿ>���agY�n�e ���q�A���';�z�u��0.�HU��s�ȇ���.�V�ivm7�����`t^���X ^�n����Q� $ށ��D�u�����`�T��*4Ӛ�� �GM�]��%�i��u~�f���i��D�ֻ���G��c�%�mF���7�9��X����|N��N���<���P3�)�� C�-�����'�w6��yw)��Ɗ�ԟ�c9��\�|����S.7{���v91�֧������-����f��BǠ�/*�/��4[�E��B��Rn u�������@w�3f�^�����y� Z�..��&����� ���$BqO���ű�����}���J���.�� 9jnָEPL�ٱ��:h�ND�3�AP��[6�����1߆��Zଲ� {��}�K"V�{�����!��L�X~�#�$ge5����Q�FA%6��!,5\�Cf�T�1��ǡ�b�� �gWP��~)V$�s�Q�"cIA2�����+pi����*E�P��!8)�����G���1ן�l���d�Z �%{�G�֞v�E�E]H+'��m�)`dK.EO�|ݠ� �A�H�h��4_$�D�k`�����0"������Z�G��.s�7ʸ_1J�W��c 0<�)��%(�u�O.�CfJ7��[�9i��Q��|�3���ٜ,f�˰kH�`��ڻ�+\d��&��"�B�����9�D�:+l����]���@�dO��F�`vv���Ȼ%f\˰dOl�ͥv���Ԭ���)51�������/��A���g?a�y���"���؈��� �Ϸ�q��J�?�g��r�D���;.?����˛�CD��T�/o����B.;�x�>j�J� �V�����~vde��.��4l̡����=�-���UZ��?���l(�9���ߥ���J[�4��)��u��,����x�X�5�*t������;�� 1*D1f�Fl�M�HPdj"��C��Y�� \�>�*3�}���〔���յ�C|:s�'P �u7 �c+f�[Y�Q�~u��:u�D��t��(�yҾ�z�*�y� W.����C�h�#6j2�\l:NK��^W�a?7�C߳����10u��nUA�TÚ��;���7פ�D����8ί� ���>��Z�������ۙ����b#o�H�#�g5mx(�Ai�l�e�� �ە��oۀu
Behavioral task
behavioral1
Sample
b7a8e7ad4c4cb03b1ec045d0be3ecfacb6ec8f2c008ddc265b94fad5b0fcf796.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b7a8e7ad4c4cb03b1ec045d0be3ecfacb6ec8f2c008ddc265b94fad5b0fcf796.dll
Resource
win10v2004-20220812-en
General
-
Target
b7a8e7ad4c4cb03b1ec045d0be3ecfacb6ec8f2c008ddc265b94fad5b0fcf796
-
Size
254KB
-
MD5
24ab7cd8cde29f68e8fef4e8826a52a5
-
SHA1
f3d4a36d7e13c458584bae0ea0e4bccd3856972f
-
SHA256
b7a8e7ad4c4cb03b1ec045d0be3ecfacb6ec8f2c008ddc265b94fad5b0fcf796
-
SHA512
69cc78b8f6dea8e19f94cbf44631653b0a57da07a84254b5e9a2791a5490e1298d9c05b1af49a05ced00e1b81fa19c7d804034318dd9ad268705271fe85ebdfb
-
SSDEEP
6144:R+vxLy0m4/No6W+Lx4B2hNZK0zWM5eoGS2ADOGTY0pT:wv1y0mCNo6Wm4aNZrzWMPz2lT0p
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b7a8e7ad4c4cb03b1ec045d0be3ecfacb6ec8f2c008ddc265b94fad5b0fcf796.dll windows x86
41dc1a7738d95674b1dbabf95275c26d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
winmm
sndPlaySoundA
msvcr90
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ