�[��(���HrHi���&���j���Z+u/ \��CV�7[((̥�ZI˪�\��=X\��~�*=�\���W��Ă@,�ձ�b��-z�"@c�jA�������$��.�z����K�v:��W�y!���_F���}kQ��)Ґt�{�>��JZ&>��NE���ʹ;����BL���j�4e�/I�!>+�M�)��7-���P���� ña�zL}Ɇz&& ��궭*��~;���w6�7��t!��r�"�QdLj�o�c�U���ACx�j� ��⢊��e(�t�7�(|Kr�8��ε�$87��'$���죙�9�%L�k{`�̘*j���ŋ��Ge1)m�h��$�C2���qR�e�����]�i��(��bA�L��l����f2��˻��즏���a��:�� ۺ���?��q��K�kKfU�gѼ:����6��D�#� Wyb]ߘL�(e��6Y8�L��� ��K����^��T#e(��oVnf�JBvˠ'D.�}�k�Lo�����X4�6����S����Ie��j�s�#��� Dɯ���:���� ���Ŋ�P�C:�m�W�&jVo�j�f��-hB�8qr�"�@�&&.o��*��W+��%�-~> /%�8���"��d�h#c?�0� �����lQ�BC:x�7��`��$���X���N�[����ܡC��r�a����z��u���nc�#�U��x 0��&O0����Fk�k>�umCIO����3%�&���°��X�:�����^M���r��2�4�|���$t,��9e.��l�כ��xRErb%]u5?���������f��e7/z��4�"L����;I[ ~��;��.-3_N�'cs��O�.������@>ŝ� �H�8���N�Ƙ�!�&�����,��0���2�����#��I9Xs�f�Q�u�i,�S�HWk��f�Ҝa���ʤ��(�[�0|>�� �n�z�7G����E��+JV��F` {K�a��^o:j�no(���Ϙ{[�4�����}��T��{��Q�Wh���h@��OZ?���U��m�K/S����Ǚ�8ֵwp��e�} @����4KH]Y�7�:+<~7'�-,�?c;���-�~e��A�¿���ӑ����`�#��Ln���C-�t)<�� }����H]������:eHc[��EX�^7���S\��a���z|;�b�t�4���J_��W�طz��T}+qc�/!��1|V��U�w��u:1�������,r����O���z�(�]Y)�[�ə�s�N�q�;/x3�H��D�[� 2��s�_�ţ�+�۵��j���6��d>[�{�>x�3����ԩ3���]���V�0��X�담g?#3�������F&�hpU��*h �B��L0�e��V lk[UL7��S36�Bf�R��.-�?j"�M������tz��B���tD�'�N�Y�U�G<��Rr���bJEPL�y��wpߪ{H�FƳG>4/�iж4��0c��[u��rq�ė��������*�/H|8��(��6��{J ch��ԝ�p����<��@���u!T��[�hSg�z��j$b���� ��g���ze�n�U2P�py��i2�����n�c�v�6�߬�ɝ{��� �j����u3��x>�l�w.�wM�qG��]�߇��2�a�(��H��0 �A���<X�J�C��x�[h��<���� �A�@"��(J�[�!��������N�Aُf��y���4�Ϧ1�P��o����N��l_�S�r��۔�@`���S��Yپ��%��:�o��w��$0������6i�D�L�U&[ϫ������`���v�)��Z/J��Q,���vxS5{�TF��Vo5��;s{�Q���(��o�و�;S���4O�q�"��C��s�y�ֳ��ߦAg���� �V�z��Z�_O���qW�V������&o�u��R9���1[��k�X��d�.�����H����3#��b��o�y����D~�z�6c����1�Ǒx���Ă����b��&a�S�<hsn��M�Ve�ٿ��z�`��gMw8Α�t�yj.Aۭ�^�`��6+�%o��� s�۸z|JE���q��^���h��CҎz1���&��I���1�� A�9����"������JE�_��#�a_sz�������]�/4w��j؋k�� �1J�� Y5"���Mc~UM|�cnT2���U� ��}P�mkWPcj�7�p����?ʍ�(�̞S��=N�h�h�Zea��37�Rq̢��0�c�]���K�Y>�ͧ0�n��^�Y��z�����?����#��n3s�����σ�S��2e�`}'ؕ�E�UF|�M��<����Ѿw�b̡��hIvs�QC>�$z�6G�?<��T�lj:z(�3�җ�<N�۸UO��p��c��n" �T�����.�F,�-��P��rb0�g��J����C�����TXЩ���>|d|�R�8�����U0��9�k}��h�1z��hբ��� �T�J�Qw��"���(��7w]�~F��k��Da�(���������*T��Z����H�����Ӏ_�U����-˞����B�r��6��J.c)#�2��Bũ��.# !^J����3���)�5�G����kt�q��͞U�S +��T� �Ɨ�����ȭD���J9�D�.P�3���h�#����[=r1 \�P0�R=^&: IchE�pQ6��&wW-k_�k`�A�)���^NE�kd��gNG�"���n֕J�.U�g6��q/�Z�M'�@����P� 1H���{�]���G*�h�{��Px�F�e��s9 >'�8jr�z=�;��usi�G� �q�&`���� ��N��ޙ[�F��4>���^�ae�T���t�a�[�1�%�>��T����gb���A��٠��J+`���Tg1��tւ��psx���<�.�ɩt�Ί��3$�ܖ��)e�eb6�g��#>�!�����= �xcN�
Static task
static1
Behavioral task
behavioral1
Sample
9266fda2a43060ac2b36f65f07fabd00f016037a146c6a059ce500ea988cd413.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9266fda2a43060ac2b36f65f07fabd00f016037a146c6a059ce500ea988cd413.dll
Resource
win10v2004-20220901-en
General
-
Target
9266fda2a43060ac2b36f65f07fabd00f016037a146c6a059ce500ea988cd413
-
Size
503KB
-
MD5
34fa363846e1ac214b0966e77dbd5532
-
SHA1
5d620584179c5d14cbeb690f90b763aa874e692a
-
SHA256
9266fda2a43060ac2b36f65f07fabd00f016037a146c6a059ce500ea988cd413
-
SHA512
69e214c9c224875b185639001271d2d8c8609cc5cd892ab8da51d4d9c956b549658103bf8bddfe4975d53d0751f3ed529378658364eb9af55e3d7f8427dcfe2b
-
SSDEEP
12288:ub32dMTne4T+1r/cY5GozC4TWg9RcGK/z4WEnd:9dmYrkYlzVC8ip/z4ln
Malware Config
Signatures
Files
-
9266fda2a43060ac2b36f65f07fabd00f016037a146c6a059ce500ea988cd413.dll windows x86
ccaff575e699566320399e0cc7cfe33b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
gdi32
ExtTextOutA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcr90
sscanf
msvcp90
?_Unlock@_Mutex@std@@QAEXXZ
d3d9
Direct3DCreate9
winmm
sndPlaySoundA
wininet
InternetOpenA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aspack2 Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack3 Size: 499KB - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ