�#&�@g����-�G����"._�0z�n����Y��4JT�XH�u�;Z�#"0���{�|\.gi���p =f�c|Ȑ�D&�HD��D2x����?T�xߔ�����F��w�v��h?�͕��0 ���f> O��0l���)���'�\������KrP�#�[��\���_7�L��Ό@�=����� ��ǂ;���`wZ�Q�=;/k(�9�:8o�([uB��e�'֕<���rdk�D����V�4xN9d��y�j{'鰇َ�,�>)�k�v�8�Qf]#u�ى�Ri�kE�/�F����v��;7�B������J�?>zwM��WT/je�*~��^�I�=ӵ���}��=�F��ǣ!�J��fL?���33��l��ɇ�+�$��A�:�|�S���io�{���H����5�,4ӛ�����J�V`�= ��+o*|��Wt�_���Cy�x�<�qWZ�u��cd��*�bg��f�����)w~s�7MΦ�i_��M�L�#qTS�w��`����U�hZ��K�e�s�7 ���T�=x�j�N���T�&�s|��`Qt���� �5��g`�<����pd����� ����n�$�uC��"�e%ЪO���cL��%)�`]�~���T��dSݻ�n-Ԙyu0�*��9�%%�w���y��PQ��?s7�S��+������+��Ȗ�M���M��3�[Tv{�F��it_�>�r�Y_N����q�S����J���灭�^Sdx�"�N�}����v�y�3^�Dn�ar���1�}γ��-�BJ�dx�U�������d}��wm47|��e*��Wi,�������O��,Ɏ��V2�k؍��AEӏluO Ѥ�D��XX^<�k訍x���j���Ėx$n1ͪ)���N��� �Ń�I�����F�9�Z�2ޟ����~B=9�8����Zg�3D���}o��e ň�S ��t�Q��ki$8\�r+���[f����9.3.���^��n?9 V�-�/`ܪ)����I��.��ۨ�'{x��%����s?r���|��Jş��'�1]~��:�ِj�� wȄ���<[��I�+�l�J=\wz�Wn�� <�� /߳Z��O7 ��rE�a17h�=ZsO��_���u:Ѓ0��f?�8�_�n�h�1���wt��{���t���I����Ѧ�8��M����v�Y�D�Tm�� RBN!�J �fĂ���u���t\F�9�����zsT��[�ρ|�koQ+k��&��q�4�}��3(��O ,����b.䔱�v"Y�<�ƒEF,A�4M�� �%�{�r����H�TK2'�����(��؝�'c2N�)jQ$�����D!�u���5�V��3��iNa�amT���!�/�l1���F��P����&��s�K\;��-�Q� �ӷ�r�$z~�$a��� ��2�M��f�����{��5�7�V�����1�������=�.[����ʖ�,�4?���T��U� 4��x��7�<PC�$8�����B�3Z'� ���.X���ӯ���~v-���B�����yw"��8���~=q��db�]'�UPUL�n�^���%tU��S�%� Z�d��K;�'Zr�P���6����>�}�e"O�D-So�x�gX��#� a��� �MԌr|���K�jA:ٱPq�����{~@x>�XJq�,�oc���G ,��F������F�����+��F|ؙxJ�|���T�;�P�`ʜ��f��H9T����3���_�����OH��>�t���`�����#M����~|\�ȿ5���*�m�v������8f��Η;� Ŧ���7�8,/���**�gF��ɔ�p�]in�V���5=f�3��.`6մ�H�y���e�1C � ~˛���5I�B�]I.p��_��2���@ہb}g,���$���Ss,� �&7{�,;�V�pƍ���L�Er��+Q��� �S/�0�+�˷��e��4�1�AQ)���pQh$8ۍ.��C����;��K��ɽ���*!�>M6�]D�#X�H���+[�l��s����F���ȼ�h�=��<lf��t��-�$#w�@�A���IڙSP^�u�N�9<틶MF�ch�`kG?�Q�|�]�ӗ�U���W/t���B�X���i2F�[�g�܋�+��$���Tj�UV|?Þ�d���i�ÙIs<N1�//hS��kp[lb\���z4�{+M�|Q����J��G:mOWۗ*��w��<�wQ�&C��/(�8؏�Uc�_�?ۻ��j8�F�A�D�G�?�ge�v=������uf��oo "=���>���@sn�T�����l�õ9#�d��?1}wU{�Yv�*O}��DO:8T$��_O�(��x[���O�L,��/j�a�������DЪ1�9�zbU\5S�w��J��O1��C�T,3�+O��\騞� dj� ��G����kL����&OK;��j�\��$n��m҃�S�+(��A�6{=�T�r�ʁ� gK<~�PS��oD�Gc���Ѡ�h�*.��,.�L�)'���{8QSۙQ�7كH�l~p6�S��� N��p;ϛh�K� a,%(�I������4�<V�����c�0�c4�%��w���t��E�G���Wv�HJ&f"s&T惴$�b;-�����==���v���i���]�Xy;�߲i�)�7��~�a�C����E'���' f�` WS��9-�&��uI0��ȋo\ �;�u�}������^zQw��s|D��A���f�>��¼�^�J H�3���4��d�3փ}���"'6b��Bfy�)�k��U�'�.�,������ *�����3`� ��9a�������W����F�`k�\��(���M���̨�<����6y%�y����i�l�Bc�9�J���a��)�'%�BdQxW��4��oꊸ��SU1�!�z��]��>�����/:\�aJ�ת�>�j@�����Ӫ#?�0���b�ˤ����w\��hZ����p<y��|S
Static task
static1
Behavioral task
behavioral1
Sample
f14c96c4931f69376f5e669d0107a4646142568ab0a8b708a46e55f4ed004d6b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f14c96c4931f69376f5e669d0107a4646142568ab0a8b708a46e55f4ed004d6b.dll
Resource
win10v2004-20220812-en
General
-
Target
f14c96c4931f69376f5e669d0107a4646142568ab0a8b708a46e55f4ed004d6b
-
Size
554KB
-
MD5
87e428140cf33aa40199c0dbc3f6c8b7
-
SHA1
c4050d20aa682515bcadafd8166eceae52dd54bc
-
SHA256
f14c96c4931f69376f5e669d0107a4646142568ab0a8b708a46e55f4ed004d6b
-
SHA512
3df3622730befce5096d546393d80b28b01ba3b041f77597ce96c49b1e2cc747f2433ce012baa992612d8f505d9a22ea1f8da4b55bf53e38219a0065c3e3fb5e
-
SSDEEP
12288:yOqnc6ZU4+iKLLF430z5/UpNWGPt95yA20YynZgONuq1n9:yOqn0iyLF430z5srkL0Z9J9
Malware Config
Signatures
Files
-
f14c96c4931f69376f5e669d0107a4646142568ab0a8b708a46e55f4ed004d6b.dll windows x86
924b49bb33a434f060f3239d97f42899
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
ws2_32
shutdown
Exports
Exports
Sections
.text Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.W3KING0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.W3KING1 Size: - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.W3KING2 Size: 551KB - Virtual size: 550KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ