��8�&/��9��;!������!D���f����� �|{�Z�ںQ]��3dȳx=��\����]�QjN��1���h��C�4�Bb+�>�J1��{�R�\|���2�7���U�����T�G9��24(`��\�m���7��ƕ)��E���[����=�/�r�VアI�ivc�ʅ�\�^Y��F�D��Ϝ�����ژ� \��2� ��ߘQ�� ��h%l��d(A�#� ?�����]�t���8(m�c��7����ܸ�ޅ@ � ���ۉ�jd�;#V�t^r�8�( V ���*,?Vl���*���~*�$�������E�^���^:�e�tE�M�VG���V-���>����� V[���a�l�M9�,�xV�w$π,�J�7"I��eD{�eP����� ��݈<3�w�Cco�2�X�&v�](�%c��9�IE�wV�XM�f� �˥�Xg?A*�,Oc��P���H����F�NI[l�֟1n�� �v�x�[j�ɷ���5D� ����c���'Ў���R�g<����}>��Wddz?L�nu7�5IWȫ� ����� �T�$S}N^a�|\�+���n���|�x9~��������"C�Ƈ�ª�S���L�.�(���E�����V�9o�����s���z�j�i�%ߥ6��&��c֙i=������5�AtɍJ�Wf����e�W�!�ݸ��\M���Ȣ�����ɵ��A����ă����A���r\ �j�LIP�`�H붵��v<�����)�V=̙;G��=Y�n��;�5{�^�d�{3���W�����Jt���O~]�B?(�Z�Ƙ�l�6��1�- 7L����DBB^��!8T���>&�|�<�S�-�eIo#����I0�' �t42�lUBE֎k�p@�DY*v�TT="�� �����)B���Ӊw3w�g7�Pl���Qʹ�)�||9V ̚�P&��Q�z�����W��mQ��un Z�x�'E�!��;�l��<#��D�F+����d;}%�*u������F�2�졻���"�ϥ0 ��!�u�z���ˋ�� ���s�;R�9BĂ�c���,MhLw��}�EmY��M����`�z�^�z���]�!��7�>�,u��ΓK��x�)��m��_�� �6vn�,sG�%��ރ��j�X�;�>9))�Mu���,���к���X�?c[���Z�!6�=�=l�Q�Ee[_��{Wkct� ����T��ٚ��1v��E��p��a&"9�����>=���|r#C���7���k�����A�D��3�,� �,R�~o�D��P�t�Ym9�1\��c�w=��b�SP���Sa&6�� R? W����,ɮ������-|�O�5�2D�mc�M�]KoA�v��3�Gf���Ş�K�Z��G���ó6����!�F������ 8 ]-' ���0g�+��*�����;�����O��bN���i����WA�4\���� 3#rQ�������S�Q�|MA�| MT0ܳ��~�h=rc[p � } ?�7'?M���:�X�O��PU��Ko!�4���0��a�*ᆵ��{��24u�7b�ߩ�fh �sX���֊?�7����͌�u������� xT�8�'� �%�I�]�$��P��Gɩ��<|zKl��������{IU<��;� Z�&�S�;�U"a%FHT�l���t|�Q[=����|�Lƽ��f�}/]1�������v��O�<�nm�ǥ4�S��K�s_U��afr�)�!��J6w ��U>p4�b� y�J����JO]>d)�u���*ؿ'B�d����j)��9;��Q���\��Zd��;�7n����E����N�)"�âcf"���ċ��X�iyc��8���c�Y��:��q�K����)d7��z�w�M���)�8Sy�9��a���45$�����梐Gb�Wѕ+��i��\w��7+���5�6��,���qxb��_6dTS��T�]��m%�a"L�S�a�����B��������(��E=Q6ix��/��&��r�n�#��{oQu<c��������.uG����l����/��w��)|����¿m(���XqI���s�q�E80���OK�����G��.�^p!{0�:Ʋ�G�]���E9f̨�^l��G 9��Z�.j5���_Pc���' 8���({��g�q�*':�)���#�]���ڡ�� �{=������dJ�EpuV�s|�F�[�9��%2�J����Z�������SR�kJǘ�Jθ)O��%��W��<�|K!Z����K� t; ��#@e��[���j�ex�!b��dq��w�9]�Do��pXk��b���!8���W��-4Z$f�$�Z�Q?N�׳���1FF�v��D&��c�vЌ,��(DzH����5�ۘ�F���f�e�zEݳj�o,='�s���f�M�Ş�ÿ]i�"!׳�n���c�T�P1X�:d#���_ҏ��D$Y6+�V������r�Z�M���G���^6>؆��sc���S�b�g��"(5������� �6-��ET����>L/ '9= ��M��T �Uj���%�d��]˥w)���V��-�2���=l�/5�LT�� }ly1 �U�2���Z����s[JM�?����&<z�F!��=��ߜ��Y�1W��^x��`���� U<8g%���=[��]�P��I��y��q�Y�KWk�7AB�pV�%��W[u�#�}ϑ}7��v�HD¯�];���m��j���q'*Y���̐ʡELS~��~s��� �M0����ZÈ�Xa%o���%��KxW���n��y{�����*��+gJ͌�TvnEH��O!�8����F�L�����Rz�.�gi�7�@������"�Mo��N���u.��E,�^+�8[�%�g_9<�Ȥn�Wx�N�B�"�<F�$��� }5v��U��w�'#�|v��i�_��8�<o&��Y��V�5����}N�jYŎM�̅�Q\1�L�f�+012�q8Y�����M/����6�!�!�ޮ���l��3�
Behavioral task
behavioral1
Sample
d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll
Resource
win10v2004-20221111-en
General
-
Target
d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561
-
Size
1.2MB
-
MD5
58266a786dcd19c20c4d862574c2d340
-
SHA1
2ba5ddf6103506e07e05547fbb5478149bd80984
-
SHA256
d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561
-
SHA512
1792726187ddd2b06523c082d4cf1a346a3421571308b8dc6748445887fcc98a876f63688befab2f18d29f383e17bbf8506f75e38e28dc8bbcbff4f17c04bc09
-
SSDEEP
3072:yOr4+eC4mlbAmYCiUnti5ihgxOY4UckdI9fsbD1e9mbIFtjcVdUfIxZn:3rn5lbAmYynhNY4UvIW4xPjkde8
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx
Files
-
d7af9853fa6a63ee1374c1e16c535b94a6ecc1d4b1547d688d622e763a78f561.dll windows x86
5cc2f48f70ec35663eb4278fd1b2d25b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetConnectA
user32
SetTimer
CallNextHookEx
EnumWindows
GetWindowTextA
MessageBoxA
SetWindowsHookExA
UnhookWindowsHookEx
MessageBoxA
kernel32
IsValidCodePage
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RemoveVectoredExceptionHandler
MapViewOfFile
UnmapViewOfFile
GetTickCount
WideCharToMultiByte
Sleep
lstrcatA
DisableThreadLibraryCalls
AddVectoredExceptionHandler
GetModuleHandleA
GetCurrentThreadId
CloseHandle
OpenFileMappingA
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ