�.���$�ޚ:��I2GH-�W��yp6�-��A�1��uq '�I�� ���v��i:Ԛ��_"O�g�����H�u���L8㯡|�z�����\�����$LOf8��:�K�&���5��r��p<IAX¿�&~��`�M��RaT��e�Ҵ�Sw$�j���#=��S�*h]��$���������*���h}&%�G�PR�����[��WV�����:�I�ն�j����E?f1��z��\ ��px�M��r�%�ݦ��d�OE2���_g��S�d͜��:��7+��u����O?C��$wG�8 t�um�?��-җ�a�;T��ރj���@��I�dw;���:-���,�vɡ�F�L��%li>���S���d��7d#��2۸�yn������y��\�ݩ[I��*�l͗ʹ���ȱ�`�.����$��Pe���D���_�Y�����.���+^�wa�o��kqj��Ъ���[��%������ݳ~N�5 �^���J�������َ GϑA���Ɛ�]���K�6�=�N��������ƶդb2,���y �k������Qu+DZlG��ӆ� iFW�o(�K9�xp��K���$��w�Ё�x�[�X�/wY��0�om%W8=i�.<Ř�>j 8O�O��5����Q�?V�2Ӣ��pM9F��/�P� ����Ȧ�œ�=��!;!r�<+g�A*g��,^ � ��#�p\ik�A �ܤ+��AZ� 3����&�@��K^����x7+��?��`یR��d��˄��|�T%���P��s3�W�p��e��I��gbL)D�HRϲwJ�_cp[�В��&������R7d�����o���M���`��Ҳ��r��c�����A`.�p�o _MӬ�X�-&����n$T�U���~q�k���< *@燷?���wihz��~�{7C���R�F�1@%s��*��/w�AI2���ѫE�m�����ĤmS�]Rk&��Bn�#,�g�h���$cHC���ͯ���3<�,���/B�Ò��ùoD�:1��R�} ��c�|��ߛ�r�)�^h}p�3q�d����;r������;E���d�K��'� � �"R�}�]5w �������#l��E�u68^@���P��c�z���R���l|�s�Gq%��w;�Qfb�x� ��"gF̿��2˱�R&":À�8{�k�Ljp"���bg&*������~ʻ>�9���5��M�s��lDv����F��2K��W���>�g��T��ms�e�w��e�Ɛ�z���cC��l�6�g��f� ?��eʪeSIT�v���)�_� �_��@�����p����@�Q�~����,7a��vqZ����2�W�k��c�j�%�B�Y�@�Yxaz.�^�¡�n��*�OPr�2ڧn��|�ł��G���`w����9�A�������=���Y�����j���$�{r�h�7i�dW_w�]�9�����l6����C@�_�}Th��e�!��P��*%��:$N,N���3]Ǐ�虞�� :7�3�r��K�@��`aVxhWؚ5 �a�ӆE�M�wZ��1���5�g�@X��m��z�5C���,���RQ�,���:��dx�N� 4R&S���h���^���8I����u��D�=c���QS50���A��N ��E���E-嚙��/2ݻ,z��#�cB�rP����A��x~S�ף��S�pk������z/�c���7�n$_\ᢩ����^��d%�QEs����W�$y*�]P�!Bv:{�s���R$��9�Xe��ɛ�|U�K6[�8�ؚ��^��h0~{$��+��&O��q]��A/3t��w���.�h'��Ϥ5��q�o��#��H����@Vc����" �=LĜ7�왳���fm�S=8)Y� ʌ��A"_�@a];��5�{"}/�7p"�� ��X�PQ5P�^k�N{��YkSZϰ�N�9��s T�[�xPm5�P��-�U�师-_�n�'ܢ�"�2tcT��t���8��W�=�$|�v�x��}B��]$�v? ��D9���O��'��"��@�Hz��)-�#V��M���#s� �-��^:m����]��p(0���k����v�:b�7���$�z��@^<&��� n��Ye{{��2��o�C4f�i->_�N�Y�H���~X̄� =�;�vKī�$ǣ]S[�BP+?M]�\������������,Wra��Ӕ����1��� V�GvS=�A�A�Z�6,���u���v�p�O#������g.y~ :���<� h�A �+��=�&��8��et��z|\� ��H'-1�iK�Gp�?�6��- M�D+�N�'�%}[�+O))�,�cv��P�8���sݎV��k϶��i�j�}a����n͟��k&�ؒO=$g��_#����0cz �����'��eyNs6��q����g������ކ[��RV1� ���ԧ�#��N�`�߸ �� ����<{�ءmT����q���&��`TK��s�\8�A[͢���p�6��4�ٿ������XJ�`[����@*�@��K5e��D#Xm�2�ӽ?Sƪ[;eׁ�ɟPfAkD�tF�Gm����)ⰣU�ȼ��P�C[�DPb�c��跇@X,Xʻ� I �S��!_�=���F,s �����2�k.K��a�!a11�(؈��ӣ�����S͋��e���2b���Ƶ�%p��a�ݢ�էf���=�F��{����d�~/Xif����>�_Nx��Q�WS��9�ʈu;(1/tZ����A������׆�X0��@��Tx%�zIYJ��>�� �K)'�U����@)��X�i�Ch6nh���g��q��A�C�N���9�5Yj�Q�������Hj�JS�hOq4(]T�}hpƎD������∉�&�Y��8`t�s��[�V?:��#��gGhk4 |h�e�uj��k��� ��,݊���?��&H��8��-��N�'�{�F��ܗ(G�����Q��?�K�� 0���Ewm��U��Cǽ��
Static task
static1
Behavioral task
behavioral1
Sample
197b03aea482d24fd0c2bf115595e3af3247979c214a1c70bf14905199759d21.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
197b03aea482d24fd0c2bf115595e3af3247979c214a1c70bf14905199759d21.dll
Resource
win10v2004-20221111-en
General
-
Target
197b03aea482d24fd0c2bf115595e3af3247979c214a1c70bf14905199759d21
-
Size
1.9MB
-
MD5
cda3bb4b1c0acf731cfa2846a4efb0a8
-
SHA1
e5a1ac72c6781fe624659ab2e16757f6fb31b7a9
-
SHA256
197b03aea482d24fd0c2bf115595e3af3247979c214a1c70bf14905199759d21
-
SHA512
71d61ab18d2d6cf37db7193036791bb83809c9504f01525e94a9da68a5667c2d97b2146826488677a4be1d8451eff2be01796fc12c104ea9e632a4fa0a0270da
-
SSDEEP
24576:cQ/eBRsdyvmWJ7uZA8cYXMBVeS/+i6ncnI98jyaIJ/L/08SmuUSdEdBs44aSL6Wu:hcR2sdtdf6SIykXLSd6sZneWYpqU9S
Malware Config
Signatures
Files
-
197b03aea482d24fd0c2bf115595e3af3247979c214a1c70bf14905199759d21.dll windows x86
5dccce0cd929b03c8875e3396c0fdc02
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc100
ord906
msvcr100
malloc
kernel32
MapViewOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
advapi32
RegCloseKey
rpcrt4
UuidCreate
iphlpapi
GetAdaptersInfo
winmm
timeGetTime
ws2_32
gethostname
Exports
Exports
Sections
.text Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.LieYan0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.LieYan1 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LieYan2 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ