rkq �ӸY�SϥZ�0 O]f���]kM?4��R=��F=#w{2}1�a5Qg!��;�w��[�P*����!��}���ӭV��^�J^���Ɠ���aĒ��:O���x鳍�i�jS#6a-��7���Z,xja�!�Έ�vH���_i�Ȯx�r��n^�t���?��6�[� ,�"�&%%G!M����^2��@�Z�ǙJ8)�KM!�L��$Y���ỳlm���r�1�Z����1G�r(�^Uyu��G(�)O�SS쑇��'XX��h]=ULhd�<��j!C&����a��o��E��#E���fK�?��`5��!�wz�N��r��USX�˳�����[1�vB�uҀ#ɋw-�7mP�%����RC"/fi��4���)��b8���4~ań��:W� ��n͋��&wT� wN�� ��r���r*]��5�>����Q3=Y�L_`^ʈqѓ^�=G8$Ϣ�luz�mR�C��E$ &�k�;\F2�9��~��*�U�$�JXֺ��!n��!�ث��Mg���)'���0-�qm��_�K����w�)`����i�I���$ްɟ�m������:$�u1�=����o�6��$�!����p��ٱg�I�^���ڎ�2^ރ�x�-��x�pWCJ3��F�B�#����ˣ��|�i�K��c�x��a0�}�왤s�z'LY�r�,<� ���J��p�K�"�����S�j�x��LL�2�u0�W����7��Ю��OP �ڷp�������(v��;A�v��)<�R1���QjƤqP,�g�f��B��?T7��=U0wU����x�� �(/�c��&~� a}�+����l~q��|hG�4�뀃i��{�I���X'�>;���l j ��5J��R]?�<,�sF���j��>Wf*��IM��o�ή�yE0�ڍ��~��nGP��Z$a��^d��O�#:*����� ���S3���냧�Ef[����LE�N��F$����8�/8r�^=>'T�0��h�e�G�%U4��/���xeo|����������Ĵ�-��R��eΏ��j�*ܦd:��*ܰ�Z0dz��Q��?6����3�� �O��~ Jyne����ƫn*Y@��.-��-G�qb��62v[Snv�ڿ!�U�O-~�x�1�2�mM�͏y3Sl����ς0Mz�@���`�x��e̳ݪl5�����U? ��9��(hd.�:A����)����Zϧ���ٛ��'��B��!�����$Ǩ�8E�3b+�[:�UB��g]�ֱ���Tm��i�,}h�����I���3�a%�@�x�ػrjYdKf �R�1tƒƍHLM�\�L@زK���0Bow��4\jሰ�� ����I� k>� ��8�I������YC0ZΩ"�}�}�`�ƫA�:!�_ԉ�7�9z<<�k25���m�1����z�p���;��KN3?�fiƒΰ��#�X���s�T���5�C �YI4��m)k/�"4xm�����ޚ�k"��V��㸛5o�I3��7�#�0�� ńX#`E��*�z��uqo��\���� ��s��x��3��7/Hܔ����!�J!�3����W�T�B=Ļ�2�S�n�A��Y���ǿ����ԡ���._��ߣ}ن�e�ܮd���3�]�0��K\<���OyL���#FX����C��/ו��� ��X�2Ѝ+{�O���0�[��< -N�t(�!m&}�F��c�����0n�h��"�(%��6[J_:���WH��>"b�d�0���l}��q��N���h�r38C�Z7ٽs@fr`Xĩ�=|ۍ�3�7��g��x>Z���I:�� ^B}hB�:�m��D�f�S�9:��n�W/k�Nꆂ0�.)�K,_�r�\���T�^���jcH�b��=���.ou����H��ś�N�9��+pj�w�M��sy�F�v�B�I�F���z�kE�O�'U�]����,���ʂ��mG��|R��n�A ��N(x��#�KJ ��Y��������q��4����j=�960�Ӎ�RF� �'㻌N�̩B����@U�ܧr�Y��yt?Fp��s=���I���U�C�Ѷ`xH��3ί�$?pU Tb+��P�Ld�r��Y��M$ޙ����?6����W��L�����fe����V�,kV���nQ[���U|��P�Kq�]�O�.����96(�rH��l���tzƥB|�%���dǽ�r_����;g���V}��\Ep�ն�c��O�W�?j-��5Ww�/��˞ ��˔�GN]Q��Iy����."��������Y�����57 _��<iY[0tdx��$���7��]�-�����k{JB���:�졢m�5k<���G��2m:����{T3zL)d�b���Ɩž��k�n��q�~��Lw����W�K���Nt@�4��Ū��Npw"8��锂i�jC�!�~��jf ��C�Q�b,*,��{��.īwK�FR���}�&�9��^{�8�v���l�w�� 4�s�hM&GO��U�AP�IJc[�8#E�Q�,��9Ƹ78r}�}�������9$D�mr��k��F7#�������j�t�!�V> �+o51�n WD�Ng��n��#.���������N �)hͰ4?C��>Z嘹[9�39֯��.-F�tP���4:��S���$���3��թ�U��'HA�vOSq2��� S�0�c`�0%���@���؉�3''�`s�F�Ξ_�� � ��ף�u� ��p����hX7��]G�ADf=]@���4~��э�k�!Ji�*��x磷X>�8nA�e�>�����s�'�շ�yhR��Ϭ����K���|م�g�T'�d�I����n��b&Ә݆eL%���SB�9_P@[{�%Wbl���nQ�E�_?���v���2���MT����2�o�s���X�O�\��w!��w��� �e�[rv=S$�d��(\�F!�gC��?�������9�m����Bi�:x��0��>uK� �����Im�Zأ���
Static task
static1
Behavioral task
behavioral1
Sample
DisH+11Tr-LNG.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
DisH+11Tr-LNG.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
JZ5Uɫվ.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
JZ5Uɫվ.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ʹñض.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ʹñض.url
Resource
win10v2004-20221111-en
General
-
Target
1d654b945de5f6d7ce27865a5cb2d463101ab836781e287df340509f0d91b72c
-
Size
2.3MB
-
MD5
f345d16452d3ca1a87856c2c76d0752c
-
SHA1
14ada5f6b5d59c39f4fcc18329335be466b8004e
-
SHA256
1d654b945de5f6d7ce27865a5cb2d463101ab836781e287df340509f0d91b72c
-
SHA512
dc03616e5e42e212a4a55865801a2ec0c47fdbc28b71ba3d738270177642522d7cc286a70d11038229c5e3d05c3de9ce7eeb4fc4f48ba1d059868c77685113f0
-
SSDEEP
49152:/2zg1QublAwBmwpRH8trnK/xxtPiRdD1s1XHcVeIpoU:/2Ql9myRcyWiFI
Malware Config
Signatures
Files
-
1d654b945de5f6d7ce27865a5cb2d463101ab836781e287df340509f0d91b72c.zip
-
DisH+11Tr-LNG - I.N.F.O.txt
-
DisH+11Tr-LNG.exe.exe windows x86
7c75d69bf5d34699b502e36246130411
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrFixstr
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
JZ5Uɫվ.url.url
-
VERY IMPORTANT!.txt
-
ʹñض.url.url
-
ʹ˵.txt
-
说明.txt