�Ϋ��Y�G�!�J�+�� �� 8۩�zU�- D���_�x��g�� &�(�L��.0�jȃ�-���.��% %���3�N���뱕�8��5A��d��s�#ft O4���m�9ڂ��� �pV*�!F'd~]�Q�.ھ:��v�/q�� v�}��/� �md��q����k�� �r �+N���W��A�]&���l����V|�8�ʐr�cZD���`%�Y���� >e�;j�����O&��L�(kP�?�E~�C��A��7y��D�O��|��Z�7ǙTUЂ�@��>�/=l��G���mM;d��O�7NU�zF�56���y��H���>I�[� 7�I��*���s����:F���|) �;y�Sd����g� �>�;�^�-�#B9s?���A���C�QQ�-��l��f����A�)>獆�Fz郣[�,�R"@SD�}q�]B]��,��BO�T��5xF`���0�ͻ��H�6��gJ�9�PS�����Z8�"x0�}�&q���V��L���w��� ��uQ<s�*�v\"�L%c� 4��5h�fK&-3�|�S����ֱ�>a,Z��}�,�s~X%���&��l��}��,��H�����1{[u�M���P�aŞ����+�R:f����$� ���KF>C�:���<{4'*��4G��Fv��^�0�.���̦��! �vsͷ�݀�+�o.���A��P7u�2����G��i���<�<e��DZ����eF�ܒ�(#l3m 75�Q���c:G�A$��ݙ��VG7��Z�ꢞ�(,����&����J�d��J�0��]gh}�Đy,�\�p�����USz4X�����\��]nQ��ϗH����N-�{e�!�q&m+�-ϵ�����o�mp�H1�q��s�k�r[ܟZ?A�?��*[�8f����P��v&�����B� tf>xՏ�F�)m7��n��K���[��E��K:_�"M�}�H�� �EY��Tb8#e���z�iC� g.o�oŦ�}1������O�]Bɾ�zQ��|y��=�G?�Bł�����q�r8�:#p O���RԮ��v.����\����yf�a�Y0r�P�m�X���3��#�6� 9>���r�i�h���.�;l��1}�<����8�������d#�u���w���VwL���n=�/���T��9mKk3 �bu�����J��+�b��2J�Cxo���[��^���U[z�cU��=8��rs��G��:� \ P9�.�l�:�����܈��Rc������ʊTI�3��6C��S�����'����叼W����s��\?�� g�lR���T5������և�"�!g�:ߘ9#����زU�t������U��E�yB$sm'����Iↁ�,BiE!|�����tw����3���,>wۮ�X+RBc��mNPQ&1�<���x;�p�#һwgjy���8Ѽ���~�?���b�j���峜����~vb�^��c�3��'���᧵����6�!�l|�!��Oホ���!k�%���ң�cO1 ��j.XIxJhqCK Sߓ�I�%�[�}W�-����6��e��k�������u��onZ��ۭ�h�}vB�hW�y�|���7h�����,*#���ܪ�ef�Yw�ElLMK�&ٶ&g�.SN^d���h`Vi;��y�u7Pւ�hC�1��D��#��v�5'�w�������c��З�W�-|��f ����>[&����A��vC�9�z���g �˥��z��N�E�����̭́������'�|e���W�=��h����k�X���v0����*8�kQ�s�������f�0l}��R�]������e�5N.��-� �^ ���Zܓ�RY��7ou�)Vd��q������ޒFA���4{i�*J�]�@�� ~U9��|��� =ϝ���=�D�<��s^���j�{�X�"�����4W��@���,�'����fAy0?@y0���$I������)��A�,NAbE�#r�g(��/!�]�Kb����a� )��Q{ڨ���ֺ�.T�W J4���?�������~}�����q��Z�4�Oy�)��@C�F���%��*�w�o�w�ǧT�ū�����5,xdJ]P�,��k�;�yJUR�#����MNF�+�zz7'����ݬ�`���� wL�k�������y�GƎ��W5�g���E�P�5�:���bu���� o@AKqGluƳ9iiåvƧ~\Q�0@`��PU��'���e_G������v�y0RKd�V�#�Q�0V .��������SY��\Ȑ�<%�$�X[����,7zVkX�! �] B����鯻lŰ��Ҳ{:��4Ht+�� �n��v<C ��F�^�2;����r@�s�˒h���'컉}������lы�8�K!�i|c�C��x�h�|,�\V�:����80�Gh�d��`�PU���Cj;��G9o�L�sq�$^����0`G��YvM��9 @�UT���Z��=�!�l���o8_7AK�;�/�3{�0�����kƻ��[g���TКE}@����s"�b�����O�y��� %�<�#���r�����)� 18�N(��>���wI�1�z~�(�Y��0 Y0�MǦ܆�CX���7U�S����:DQ�r+�ӽ0���3��F��h:绥��_XWR�7/�}E&|����7x���P�����픷�B�Ļ��Q�������@��jk��v�j��Ā�p�'�{ �:@H����f�i^(����KU�Fw��[�X���u��#?��Y�����b,��㸩�L�!8���_AM��+�fp`�z�<i�G �l�/w�m]BLyQ|9���P���v���9��bZc�<=�����c���18]Y����]h�da$�"˩��+'Ik439���|�K�\��.(���D-���l\V���ڃ\�JE��c��yS��⾣���y1_���.=�����@��-�J�P��Jp��p���yz1/�ױ%��k���X�U
Static task
static1
Behavioral task
behavioral1
Sample
Pday2+17Tr-LNG_UD5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Pday2+17Tr-LNG_UD5.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Pday2+17Tr-LNG_UD5_Altv.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Pday2+17Tr-LNG_UD5_Altv.exe
Resource
win10v2004-20221111-en
General
-
Target
d1d5cd18902b0817800999ed48b3d754a08b3437480f237f3d31a491382dec3c
-
Size
4.2MB
-
MD5
30c007f7f6f13e7bda1b9ff2bec83427
-
SHA1
ea348a9a3f778b169aa4fc0ea8aad8ebd2e33286
-
SHA256
d1d5cd18902b0817800999ed48b3d754a08b3437480f237f3d31a491382dec3c
-
SHA512
4f752e681587cb63dc14fe8eaf2c554f277b528ae1701c035a2858d43b7ca21c0b25b8c8a7beeda72ec0eaf62eb0c61ece53d8b4fbe115f8d751f97a02317f19
-
SSDEEP
98304:yoIyI2HlDrkOlA5eW9b6/YJQeQKCKF6lpuaVt:t1D4OlwiYaeRz6lcK
Malware Config
Signatures
Files
-
d1d5cd18902b0817800999ed48b3d754a08b3437480f237f3d31a491382dec3c.rar
-
Pday2+17Tr-LNG_UD5.exe.exe windows x86
b2f6a2b7e4529c096c1a2edad11f4397
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarDup
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 966KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Pday2+17Tr-LNG_UD5_Altv.exe.exe windows x86
7a6e28c03c43eeb8621c1af7d365d6b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord618
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
v���V���j��N5�������_p���e�2}d��m_3�lF�iS��C���`ȁ�i��,LF.:����KYʎ�-��T?ʼn�[�p�%�q0��dy�����}z�f�\X��FX�eX5�����g�~$`�.կ�r,6�&�"'��V�����ec��Mk��?3�N�����Y���lm���Ѭ|��C2�����찚���Ń���SmYG�)���3ᨻ�x���vІt�e�ϣk'���X7�p&9i����$��6z���p��='>����N]G����$~g�?�������-���:BG�f�%H������n�����/�U4)�,%KWI�&R:��W��+��!K�6W�&l"n�lu��06w%������M H�ᮕ�h����JG��L| �f�])���dn�`��ɓ�E��ot-�$�y�M��c)6r��-?��%3q������ϟ������WF AtVj���6`�>��3[1���7��`E��~(s�]Jun2];`��qϐ���J8+ev�|�)l�x`Sd����wR�'�T���(� *�0n��ט������=) U;���8��XX��?U��bc�P���C )ӭ2i��Do �A&p_�R��9;�U*ɗk;cRY��C���<Bq�ƨ�%`��v�"��N�Lr�枊#�'y�џZٗ�A�C*ᙺ�چ�~�}~��3�#�k�d�؈J�p�-NL�C��V`;���8�����0ٞ�Q�G�VO6L[���-��~ʹ���M�Y��Ɔ���!E~FQn�}U4d�<�e9�f���8y����<6f8�gr�dP�4��R����ܯ|��zdm�HP\���x�Ξl�8��D-b⤘8�P� |���������Hs�~�e�: ���)�6�\Q�H�j����Q7���(k���a:�2��P��3PH\YT)�dC�����W�1����c�1�I̝qs�����rvW$�/JET*~txO�\ۻͷ�&K��0�A09G�}����F�[�nw]?���|�p�ԃ�* ���˞��t��E`uH\ y�T���J���Ii���K����K� S����� ]�Y�GK��{P� ?��E��Օ@��Cp��s�̆�ۜ�-�@�,S �Aq6����{�)��w(Ԃ�c�\�wB��V�B�����U�2�\nm�u�h��[)i�>!~��"יf��-��3G��Y�/�1���(D(�[ u��4�K&��IoU���4Ŕ�aQh��.]h��3�9��aب�dv!c�.{��p����j�N5�������4�U-f���5y���.o[�'��jd��8�A�}���=�����P���)�t֏����Ƅ*�+ ��!NG� �}NGi�D��F'RG ���2��3����-�EZh�� b<���ɗ�<}�Mk���b�)�)�����V^��14bp�&ב#dy�¦��[�_�ަ.�c�x��:�n��!"'^-��0�V?�Ӥ>M�e��&�Oo`��נj�6��]��ΰ��r?��� ��r#Y��N�Z�����%{9U�M6��RiNj�.Ȳ6�e����W�ԙ��{� ����b��v��!������(���h�C�k�d����L~��%�L�{X�{}4�}E�� !FF��W17��� �f��p�U$zn�x��J6H���<1�^��^0[R�����0��1�;x��>�op��yP�KU?�����./4[P9a:Egw|������ ��+�k�������x��z��*Ѯ�]���}�����CkmƳ��}9K�%kMe�`���Μ�o����7>�N>�N�kw��X��P�\�p�ku����O���V�.�l/�ѝ��h�(u�����^�t1�0�Y��cs5#b�Y~�M 84 o���°��K�fgͬ��W������� �8ήt���k����|g ���!�_r���+c(�(T��@oQ�g��H�rByy��[���;#�P�2PP�b��C�0}{��������nc�و"9+�Ș �FJX[B`抹r>�r��^sW�3��fd;�E�hy*�U�2�g�-I����3�@l���f6��4��-R�d����Ǫ� �5^%::������a��/t}�SC0��e���T �ު{��K�S��P�@ׯ=����wZ��q{��m�_g�"�k%������ݣW��0F�F���Mp��P�˜:�J�����\u"�})�N<��������1��8��J���U$ .����v5X��K�Mv6s��+*z�3�>_���]�NSEs�~tηD�NZ��8����x�rOOM�|�y����~b<�;����9�Ac1�MI�J&�6Z�M�K~L&���yK哊�� �z�Q�.��%E9����z�Ӈ�W���ȸ��H��_���F��z�Ω��+99�aq�ܿ �0�k�q}��;7���$6���$�����8���Y�?YC}|����f�2v��'��$�9�Q>��-���:�5��3����^�`�a��U����R�`��g?HQ"��0�o�˄�t`�v�4�0Ī��Yf�!�3g��r{�9���P��E6�+���3�wJ�EĻlc�7Pb�eI�#W��Gx���W�s�=�YnF��ܹ ��GG�)"ĉ�}���<�;��1!n���Z��i�żXe�3�e��a���(S)��o��`UNq\c�bz���Sk� �7۲O͡���b`2I!n���t����<��̡�H���2�g�r����;��Wvuj��M@��`�f��F�Y�Em��f@J�8��ŽKy�5JU��2��:�����85���&���!���������F=��c�z�Z���I˞�h[_��܉<���F�;k�B(�KV ��1*@���b��0w�2�{�,���,���ÆW,���K�"Ҷ����������_��(�����q�=���s�4>�R5W�������ާ���*P)��8+�G �HFd`���@�J���o��j ��S�bl��C�p���5{y<�i������ǭB18G�<�G���N���BR��%l�to��]
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 966KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE