���.���b�l2��;�vwBg�� =�ܠ3����o��D�_#Qm^3)�ћ�D�@���Y,�mf`u'��k6�O�P�)�f�"X*�G���6w���mK��{xvK+������<д�.�p�-���l���^�#�e�3-�t�/� �-�k����DŦ�n.O���P��n5�/ �,!П� �0��}MO�#�;����=;���& ����z+������R !��3����GL?��"��,����*�=��bր�|\ԕ!�A���6���%5���������2�sp���N�$���2]>�P�zL��p�v���Ҝt�uu1�9���?4<���~�sG�mh��T럕���9�F��ۆ&����f��P=�F�⣙/-��i<�=��Q�.Q���E yY���̴��6I�&<�e ����@H�+�E�p���L�� 4�2����ԇ䠶�Ew�PUΪ��V�9�o�ˮ{�\�д�=��nIJڞ��MՑ-I:u:#�߿��Ύ�x�>�ϭt�����T��L��Rw��}K�[�Ϗ7.k��\L:bEfz�`��)As���$�'�U�t)B��=�<�+���;�]��%t$�ظ~�!��q�:�<�Fo����}����f�IV��{o#$�|�y���:ϳ�y�W�`"�<vQ�Ǘ6�(5W2I8���,l��}�vwW�I4pC����_�"��X��غ����[�?$���� C�;2�8Р��`��ǔ�.�{a�u�T�j���и��@Q�!����Cfb*bg��IG���]���\��c���%ǐ57�xER��p�ZRF���DHr6pSC�"&틖�lc��L{>D�<E�T��ϣ�&���Ek��>7���0k�va�9_�b&�NG�����c�Ћ�\���kcm��K�ư��D��,�۷�M��02�� ���J����-��b۠�:����,ѡ.��Q��m�Dw���e����e�c��k�a��ѧ��{���F� �v���=��[��L�vp�5X���i5��ѡ�eyռh�UUdp�%�Tb�OH�c��/�%6)"�0J�Y.�Kh�$��������uO�PR~*[�LH���+}���1a�}�'��5S�#�5����)I��Bs���ɑ��Aܱ1D;��ս<o�h�� ��T������?�CG������m�!���aS8�W9����Q�iUH���Icx)UW�Y6�г��V������o��cO,�~��;�[UK�F������eZN6^d=ѡ7M�ͤ�����XF�f�Е9�� ���A�X-�pz����}�<����!�m�3s�!do����Ѻ��P�:���s�P���8C�����N,m�Fjj�rp5H�`��|a�*�瓯{����a\XBU ^F�B���bZg��e �h "��Ss 9���Y[3Tgy�c��um�#������?('ao��ݼ?[�1o����W!�TC��1���d��Y0?�E=L|�X��=��7���M����ڛ)��_��F�N��꺯%i��օp/]�%���y}�0�o��`X��2=��70vi99@&�<�+�<kR�h�qRV�+���e�;����5�60�<U��J�t$�M҄~�dE��e�]����?w)�H�y�����[H��k�8��ڍ��V,��/����R��r����nxjF5e��\e��OKeR�,2��2*����g�4\\s����� ݬ�k)�K� ��q��p�a���Z*��!�n���]������M$�O��tzo%�����.�'F��9$��u�j:p�k���%�,~}a~'j��'t�ݾ������{F��&�����'�3�i_���:�2Kļet52j�[�{>S}��0���*1 $Q놪�4�8�q��B^�K�n4���:����MO�"���ױ{�ǢcJ�}�ߛ�e@��f��s�w ���v���8P�9 b�Jۤ)�T�cW<�R���\*5Վ��@��T8i� �wW����h�E��]�M�`1�|�M��&w;�)�}��/u_��`v��_\:߿.�({�a"�C��`��Ȣ�'m��<�̲�0�S>���1⮎e�{�@~�P��uu�Մ��z����Ӽ.�];���ߞ�Ondr��S�=0&\�!�L���Bk,��!sK�az����j ��6Mi�� RW���������lg�І ]k%��!jlh��!7���3tw��Z���Wv*����Jh��ZI^~��H2}qD�A0��.;��$��z�}7Q�t6e٧j81/L�Z+=�3ӥZ��P?SK�����pu]7@����!�J�g��^���A�Q��U���fMi�=������}���!V�Uݣ�?�A �;8*����><�D2*g�0�XDz��ƞ�fc��v����o4���?IR� �gj'�S����Sd�B�U#�G���B!���c�E�����q�,�=h�Q3E����<5�����x$tugu@6�i����9C�2�Z��e����`#����N �ڸ��G���O�o��ȳ��N��m�w߬���V��Z�@|z��|�u< iS�^�/Cu�`��]G<-����� y���$���E5�FԵ��a�ћ}VqY�=�������d,X���U\�^L ҜY��z'7�fr3�&�42@iRu�l͖��в��7���zq=���yn�e���J����p��c��Z��q��Ijȝ����lL���~���� jS�L(_���]������ج;z�P��0�p ��M>�������+��z���{��3t8/z:������� ����Wg~���RR�2o�&��@�������MCK̈r�#�c�gw� ���F!�U�h�i���O��\q���O��"9�sCr��O$!�Z&�G��߳�!�Ǻ��D�9�������IM�ˬ N< ���o)�������lr����o]y��O˾K���k�ܯF���/I�Y��W�ڔbI��7ǐg��FHn.�7:\���E5
Static task
static1
Behavioral task
behavioral1
Sample
e22c8eeaa309c98fe03c757cfde85f29b30a1e164baa3fec02dba74f7e1d960c.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e22c8eeaa309c98fe03c757cfde85f29b30a1e164baa3fec02dba74f7e1d960c.dll
Resource
win10v2004-20220812-en
General
-
Target
e22c8eeaa309c98fe03c757cfde85f29b30a1e164baa3fec02dba74f7e1d960c
-
Size
497KB
-
MD5
bf26419ccfdd1ed4b41a69bcb0491a80
-
SHA1
1943faca776130f21488b89c193d7c73e2e77918
-
SHA256
e22c8eeaa309c98fe03c757cfde85f29b30a1e164baa3fec02dba74f7e1d960c
-
SHA512
6c8b5fc4095df32f76f95f5c4c65d3b53ac633ac18c4fb4816b6da6a551583ce3cbc52969897a0ac0bd2344c034e3a8134fec191facf90e45ab9038ed1fb192f
-
SSDEEP
12288:5DenEmrTFgT548X5tlGqiZSoQ0puU2YWw8:iTwXRGqidQ0Ihh
Malware Config
Signatures
Files
-
e22c8eeaa309c98fe03c757cfde85f29b30a1e164baa3fec02dba74f7e1d960c.dll windows x86
16188eabe2556c8862472098e8c2306a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.px30 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.px31 Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ