_���ޔ '�jP��O����n� �q]��J'�4rTd��l[}���b�7]+vY���M��\+���� TPX�r�u C����BٱD�S|>�H>�0-�mF^�����NK盀Y�j��j;(!2�r&��^��@/_�[��i� �1��� �V���|�ҕ����Q�O"֑~|~cx`�]A�ݢ:��'1j� �����b`��߁B����U�rŃdE��7QR�g�f�$�"PS�I�d����B%��4�kZ!џ^��=* I^�H��<�!�q�sc�C�[�3�Q��m�<� ��4�;��d���*�������\�W=�ܴ�t���x�ȅt���V�~��Lc"й�`��4)�h���$�SI�4�����`������>�ۗ�0s�ib�*��]�O�w���٭qi�{V�z����?���:�0Z��±�QL`=�7 W�k�ēJK� (��Y���h\��AE7���{���(�Ј��w��l�ԩ��%�˓�XgS��������<nLj���S�H&du�K2�c�G)3�-�9�j1^-����&�!��{_T�@P���K����K)�j���-�J�t�W!~��S~��_bw:���mNX� �5�f:���j&��s�w :8!���������f�f¹�vist�yE,�����Չ�Z-��g�E ��������A��0�!�]R��e���E�ϯ����>ӝ�u��Z�K54�n�������[�˖�����Yx�)��;�!�BO0e����~��d���>u���I_E�eo�1�Y�V�J�����?~��NB,n��Z��R�gN�H��}A�QQ,.�m�� ɩ����,�K�Su �7 �1E.��2��VS�"�+#�����'�$�Z�cM�����'( Ш1�� ��"U����o�͒܇�n��$�Ԥ��]Ra��yeqY�ql�*H��+�_o���4�6r�|�ҧ�sn06�p��x�Q���+/�Fњ'N�������J�C���e�ws_ָ3��ނ������G4��~w�����n�I�S]0<H��h(��q������_�)n�������㚴@?�1� ��ۢ��[���xlg%ӥt�<�U ,�C� a�jy�J!������]�0t��Q�]k���ͷ�L������*�.��p�Y���u�s�>��6I�ڲ�Ĕ}XC����ߌ�~O �S����!�$�$ ����q|��R�?������:�_��Ǜ�y���6uma#Uzy'�� T�GF�T��!#�%l�)���@?�<�|�BL��$��ʯ�\R�t�rP ��*����K� �����0�ک��ؖ��.�n*�Gl�����c��A�-���y't��� ���2����q�\SP���PK;VJ)v�K��Y�� �����' 쌃:�����'����K�-�]�*V��Q���u���������KNd���|i�h�:������J�o���k@��"Q��B�E����4Y4��Ox������v`s^��ނ�&��r��� �DR��]��S�f;��I{R�O.��K����es����$�U�c��5��IZ.��E��n���C�4 R�7��ޓU���%�6O6�Z��G8��-��q�]��δP���*�n�Ժ4���,��@¶nR�X�t e Ty�}���b�qu��&��M��q ��O%�����c��n�X��O��&W~���Y*�bo&���>��l/����bC��,#T�Q~�VyXM�x�6�S���? F�3�u4��|��� p�-���x��56��WN�Ls������ڧ2>p���l�H��bcp�Ai����g5+���i;i�1�I�����x�l%C�~�Uy�?l<^����rA��R(Zҹ �I�N#�(J�����'}�G wU����M�go����]�2�R���ޮ��^]��wOXڋ���?�Q%��h���� {XO��,|���̈���O�����_�'"t1���r%�߰3U��Xʀh�0l���� �����Hz�)��a�WƼRi�6)hRc;6��E��l15�A�=�ܗ��3Ʈ(��R��~)���&?`u������Ӟ�05�*i��A!�ؚ��kt�n�-�#�S>J�0�f'�BI�!�QK�i�w��`�*��G���x2��ܷ�nN�s��4c^ �W��v��(rw���YX�R �Q �~�bKb��TT�!�s�=��� s�����좨cHS�x+���'���Ϋ�%k$ ��$�e�3R����H^��I����JM���i��駘ʷ����TBc�6l^�% /(�u�v�DYK���]hS��<g��λ�F1�r������%�f�)-ز����M�W��j��[`��!�nL�d��,���rw����w�㺃P��y�-p~���bon��ccuͿ�nfv��@��g����edmoo���+�i>�h�e|D䑝�H��P!�5��Cp�<`M����g��g���x'�֬�b�����孳r����55��u %���?�����~P=�8a��w���H��� ��4 � Y����RܦkA� ��({�z�#��7y�n+�,Zan�yKT�j'��^���,�CE��/��4�i1喞��`ݧ�J}� ��b�X�����V3*Ƣ�������m-�R6�!�.^�#�p�7���Nd�{&�2���_�2fQ�U���>�O��l�U��|ܖlJ���,�`]J�ro���cl�Y#�$X�$�VK�E`�B�\~��%���U�V�XXJ��o���&A"�g�U3��< ��s|�N�'�m�/�]���m���-�����p���`:�*g��h�d�c�sta�%:ݨ�&B!�O��W�ȉFPFxa����TY��Sn������9nvH!��Y�@�$*t�r��$f��!oi�~ƴ�hn3D�M��P��[Iyɬ3F�~���iS�1o�]��+�y�5(X^�G>wh(nAC[�+Z�Dd����Q+�^�� ����}S�M�M�oU/�Z5kx
Behavioral task
behavioral1
Sample
9c78a2b6eb4cc851ab57f5889cc02319d81b43ea1d52fafc9d5dbcf7744d5c9b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9c78a2b6eb4cc851ab57f5889cc02319d81b43ea1d52fafc9d5dbcf7744d5c9b.dll
Resource
win10v2004-20220812-en
General
-
Target
9c78a2b6eb4cc851ab57f5889cc02319d81b43ea1d52fafc9d5dbcf7744d5c9b
-
Size
278KB
-
MD5
3fcc40a37ab51cfdb8bedd2f92bcf4eb
-
SHA1
c2a168c9788b2ab85af022ba99672f5dd8ee5220
-
SHA256
9c78a2b6eb4cc851ab57f5889cc02319d81b43ea1d52fafc9d5dbcf7744d5c9b
-
SHA512
587a5650aac0df82635867d3c999af1be553d75af52d97f171facca67be04adb92555dfcffe1031d8a9921e0cce9734135dd257137b99481bdb08c4f235b1b90
-
SSDEEP
6144:IjjA+lBwW1tTHah/QdWxFuJm8uVcLA2eofwe:ylBwWHT6h/RxF3VVV2
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9c78a2b6eb4cc851ab57f5889cc02319d81b43ea1d52fafc9d5dbcf7744d5c9b.dll windows x86
9dd5d8b153b60b5db268b6ec0838f037
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsProcessorFeaturePresent
VirtualQuery
OutputDebugStringA
CreateThread
VirtualProtect
DisableThreadLibraryCalls
GetModuleFileNameA
GetCurrentProcess
AddVectoredExceptionHandler
GetVersionExA
GetPrivateProfileStringA
GetVolumeInformationA
MulDiv
GetModuleHandleA
ReadFile
GetProcessHeap
RtlUnwind
GetModuleHandleW
GetProcAddress
ExitProcess
HeapAlloc
GetLastError
HeapFree
GetCurrentThreadId
GetCommandLineA
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
wsprintfA
MessageBoxA
GetSystemMetrics
MessageBoxA
gdi32
GetTextExtentPoint32A
CreateCompatibleDC
CreateDIBSection
SetMapMode
GetDeviceCaps
CreateFontA
SelectObject
SetTextColor
SetBkColor
SetTextAlign
ExtTextOutA
DeleteObject
DeleteDC
advapi32
RegOpenKeyA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
RegCloseKey
RegQueryValueExA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ