�|����i#�g�'�4M�8�������$�q�,���-VJk�~�����p���)\{���-��3�9��fk5KU��q���?��@�(�O��>b��Lb�̛l6/��H/���=CO��ؼ��P���ќM�MT��+����]�$�<P��5Z��3�hW��b������㾅Q��r��-;���g�,�Q �cqW��^q:�to����X��x��^���Uz�C��(/5�N���;ųeG�� ?����h�ޓP�q� � S���h��H��వP��:a�rN�Κ�wC�{�KF�H�3n(��g�Vʹ���ֿ����6(~(�_���5O�W��E�:��ho�|�|�1�� l��(�Ƭ] 0�"�~�L����� ��[䦫�����(jX�0��a��cJR֢������)}G��{If�ġ"oq切T����o�f�h��hP�8- ��Q���'�s��x���`&e��W�m?�*ی���#@���������m��t��~���Oѥ��CE����w�����,Jx����y>��$�����T�U$Т�p͔��ja�V��l.I�̳�!�C��<m�T5S2Yz��E�U�� �"l ��Р"t3Ì@6Ho.��.�a�RT�j�M��U�Rv&��V����߭7��H�F�S\�cs[�]%����ϭ?�L�Ozqb,!<���SG���>����kNS�)��[�&2yk{��QPr�=���f�a�1���6�\RT�gFR�R� ���X��q`�@&7k��2 �аT�����L�b31�mSB�a-�7;�M���v��U����"y�H0b�#+��=%�a�Vu��l�f!�٧�ڳ賝oK9K�$^T"�E~r-sq>uŕI�t1��� �� �����R�q7M�'ɯc>x@����m���"�`?��P��$��^s�屎�/ܻ�oI$)�\Ť�Ǫ��JEf���%k��h���=��x�t��Z��=GP}�!���$cU}ԉ��ar+�cEyK�qs�Aٽ�9@�w�l�-�yd�v@EO`,Z��)�� �.��[&�9�������G%�g��E�\�G�Ӧ?0�4��7'�J�e u�,_jq�az����ӭM��x#t�������k��/�<|��EuB�$�� �E7��~{�إ���X��i(�����1�@gl&Z��N���ќy"+��������1�.�"Q7\�\�]+�`�H�� Cs�����w��C��*��ojN繋�id'j��/�{,�ѕ���rz�o��-x>"f�-�0�ww���2��;ZEm<h��#��?���L:F �nG|6���(5�Yq^���釱���@�t,��P֖�����j�dՄ�g4�x��ۛ;>�����y���VX�@��6hI���I���`|�t*2{ø(Θ�O6+?��X0:�nχW"�0��9����V=w(נX�+<fgѯ�5���rn�t����z�=?Aȉȶڝ#���}���ݳ�ڔ�Έ�Q�����]� S����ny&�����{�$���|��q�u[���"��mR?���;�C�&kև��Yl�ذ�����Q��N&�l-�s֚���^c��m��� �!����GW�Dw�/�$9卑��'K��5h��u����0�{Y�m?I~O4���qC��I����:-�K>V1P�H�ة|��W��1k�C�a˻����I��*�U�ݰ{<G�=#<��;W6��s:�˷�4��+�!PV2Ъ��z�(�pLW�=$��e�F1� �������'v8*����ޑ� �r�ܗ�I aAO�nO.;4�����6���(#� �t����"#�1ԝ��H��q��~�[&Zr��������sT6�V ��f��;��D;�������g��`��*�{x��_��A�ܖYF�� �֒� �fB���)�ǀ��I�W���_G�\K�@v�ê �l�<�E�����9&q�2�.�+�ŞO�Y(Ml��lgﰾ��3�bq}�cńbi���["Psz^/��:땼S�K��ˍ�Շ|��s��,:0mZS ��!�҅%��B�p�a������ͧ�?�:#~��%����NXŘ1< �pf���t��ojE��pR�{���*=c�O���:���E�n=�Yc����@?Y.��w���s_���r���|W��3ٝu�e4����xR0nޫ�y@�E��2��_ۛb�U������i���T�����^,���r��B��T�[�_�����g��<�T��&6��~9��#��@�b�to�9���{�˺����p�z��(��TKWB�mV=���!#/���3�?%?�Z����{`�w�)�!�4�^�SZ_}t�S�?!�x�j��jJ�y�r���II�K��9x�w��׃���Ϥ�o�ԩ!��� ��p��XT���b?�X"��t��:C�ۅSE~|{Z��N��|���·^�j��Y�����·ůMT�����Ŧ݈����_�����H3ZG��R���k5�O9g6���%�O�*tP} ����V}*t�o��m<���]R���=��w�-Ƀ -��s����K��+�n$�'�1e���'0A�1 �['eJ%�>RR��74(}��/�?BK���Ԅ �p�[;��|5�+¤�Uosp �{:+���߮x������L�f�Qn������ӬJ�V�2�H�����R�ϒ��S�Z\:�5� ��DF��},�v��r��b����$D��%=�GL��)��2 �p�����쾛�����U�ǩ�5�x �UG��RqI]Y�9ö^�cVݦ4�.l��Q,����-mi �LC��H�5���(���v>�����L�L_H?')b�����'�_�p���>��@��Gv�IY��_+u�O�p���P���tQ~����nu�7i� x���?��wJ���n�^�9x�tt+�R~\�1gL�;q��+�19T����AV=#!v�>�A�6�v����٨�6�s�!�A��z�I�MhW��Fk�GT��������ˉ�8�
Static task
static1
Behavioral task
behavioral1
Sample
1904c80b2518d52f6909695c8cd37f6943dbb9a2ae0f1a4b2e511470967dcd11.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1904c80b2518d52f6909695c8cd37f6943dbb9a2ae0f1a4b2e511470967dcd11.dll
Resource
win10v2004-20221111-en
General
-
Target
1904c80b2518d52f6909695c8cd37f6943dbb9a2ae0f1a4b2e511470967dcd11
-
Size
1.7MB
-
MD5
7d5329eca047da849ece41f7593622b9
-
SHA1
c3935faee5a8c9f90a8632b79424232838074b44
-
SHA256
1904c80b2518d52f6909695c8cd37f6943dbb9a2ae0f1a4b2e511470967dcd11
-
SHA512
b63a7002ca7bbbfc1899bf4be2a61ebec4315a0fe6b7a338e027f0139cdf56652f7f64f8908669e5031d9728a579a9a5a45161df451e3405fa8e0eb24143a400
-
SSDEEP
49152:X4i6UfYwW4I/TLgUqIBHPWGBCH5QvmhOg:l6UQJ3qIpPrBIqOQg
Malware Config
Signatures
Files
-
1904c80b2518d52f6909695c8cd37f6943dbb9a2ae0f1a4b2e511470967dcd11.dll windows x86
2b9929383eeffb91cbb944c338c3ae35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
mouse_event
gdi32
CreateDIBSection
advapi32
RegOpenKeyA
shell32
ShellExecuteA
msvcr100
fwrite
msvcp100
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
d3d9
Direct3DCreate9
winmm
sndPlaySoundA
wininet
InternetOpenA
ws2_32
gethostbyname
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ