,���D#�Z�s(o�0�wt��D<���2��X��zB2�������F;��ŏ��}lQ3�������$;��L)����Ua���Pj¢��bl{�Wb��ش�pS�_4�1�Ҫ5�!h���A���$��Ĉ���i�1��X�(B�.]���2�gk;���� l��9�a���Wk��O����ʥug�FZ��s6���Ur��>9��ϰ��T����a>�K�IP-�)���~f�ټ�'wKp��"G��ۛ2U�1h$FȈ� n��#��� LUd�}a��o���&��qz_m��=M�6����9'6[�6�`|���ɪj��[�%2:4������@��8���t�~��fڹu#���������Gj�,ܐ�S\�r� ���x旬��sb#>��x�7���eL���< Džc���k���r��d5u �S�e�!g�gzL�Uי�ht�OW����ĊsQ���W���t�Y��i e®b�+��m_� :���-Ȕ7��a��/C��,\���j�V]aE÷*�/���}����(@X�'�w�/'x��O�36��E���A�p��,y6/P������#�/��`Y]t�K_&ł}ص�دü̹�� tjDB���%8a���[�ofs��m�Q$��c�,��A���rhM� X�J��j*��ryz<��,b��o,��eN�ks�H�������ب��*��Izj��s����i>����6C}T����.<809g��A����S�,� _k ��1Ձ���a+�n-��/E�Ji�[�o �2_��.i`��!vX�b��Cw����T8�;Nc��eϿfx��6� ��lU�`���)���W4�K.{�~�4��Y�X��v��L�����9yѿs�G��o�[�nf��H�h�B���Q4l�+"�c��vN�ġ��w���[�˝FG��jEI��!��Q�Ўx"1=Q�� �������T������s%^9�Ou�d���f~�`.�,�Ǒ}J}��μq�|C�ք!)̹2��'8f��������U�l���y�ʛ ~�ƴ?���h�^&wL��Ba�y)g�5��K�nV��b zw��%��z�����i[V�W�$�ի�M��a��,�泭"ő�`���h��e�$�2�����G����\s�����x���]�j=�[�0C;^���[��Ը�!U>*9�w��o Ķ��� �*����׀�R���3��/�ZAb�H3r�ck�>-g��` �|u�i�BHq�~c__��䙆7�H�Y>�O�_=��sW\7��s�;�S�G��F��yy ��~un]���J_W%��.����ҹ� ��+{K�Ka�h����`����~�R� �����af�es��&l��Ļ푍�O� f��2ᑣ�%w@1�H�tvZO���k�g$���:��jm�!��*IV4L |�B�s+��j�c�U��-�����UF���u���|�Ɉ��"M�(d��� ��{g6�Q]��O ;�(w���|"��ݟ����5���H��L+0T�.�Ҭr�iah���9�NMm��il{��y��qQn����y��F I�P\����3(6z ��7���]z�8�b��S��c�_^ކI�vG����E��+���k��}�6���u-�C�V��F�Y��h���u�*Kra����dڶ���S�F�a��Hc�+i����ٯ)^#���!.:�ϲ�H���^�z�i��$t����W���uWY���N�$��EF9&�C�~���(�:c�B2������� �Ŧ���$�vrJu�6e$ؿݪre��̛��_��Z�݃=������4m/e%��6�y0 �|��H GoXC�~��u-n`����I��-��:� ���6Q����(�P�8E"a�q��dzY~�N�Wt�Vߗj���+]�f���Ò���4(�p7��Lj�� ��u��y��<Y�[�ɘ��`�?����ކ�}R+qA�M@����9�B=�yؗ__�1y�+X�E�����h�o�~�ۗ ���с�Є(���ċ���1��7m���T89m(��}�j�/��/D�����/���"VZ�ѱc��$Wo���a�l���A�~���(b��N�j����șF��f<�A�T"9��j��P+'1͑���i3�x���h�S}�}��ev,��^Q.�jR%sU�j阁��bSѸ����M��a_�h=X��z����C��f�[8R�G._~�ʩ��'�{�yW��w�7b��A��2�z�����/5�u�]ud���h�dl� �Q0�n�6���u!f;ꃈ�!=�=D���]���GkttFH=�����HQE�`^�24��QS1%S��%����Wx|��Y8P�}TƠF�� a'q�e�7S�z��h�`k�3N`��E9�2���.|B.<w���F�3&� �'�Ub��ύ`�����Mu����Q/Q1�Q��goҗۣ|z���~e,�svfd�~�e���p��p�`\E'�X�����O�<w�YN1[����O�|5��pqG_��9�f�+S��Y_E�TH�X4�hVY��o�k�H�K����l��@�^~ Smw�S��E6�>-�@}�����L y��O@���N�Y���(���f���f����x,��eC4=���c����0��#W2���������c��[i�U����+�2�A�o����wP2�+��eE�Q,#�z�/`�F�}.y� j ,g_Ƹ~%���ƨy���G���n�Y=��\���+8�������S�� A;OYt}�8����+،~�Ӆ��|�Z��SX<�ݓq�Nj�D�_N�;l�t�?_MX��5�&��hw@�t������w�k�0M�>w��e��eN���>����+����裓��#]�*�>kݦC����-������l�6Voeb���}��� ��b�'���Y�3���/�5��2߈,䝺��Z��R��3AS�m��N~��Ę��ܞUj!jL�2n(���A���~hd鱠c���]zόkڷy*2��P��P��&�lc���-�}]��C�
Static task
static1
Behavioral task
behavioral1
Sample
6571ae5748c66c3414cd436cebe125cf8f61e160989334d70d8190c74f5bb5a3.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6571ae5748c66c3414cd436cebe125cf8f61e160989334d70d8190c74f5bb5a3.dll
Resource
win10v2004-20220812-en
General
-
Target
6571ae5748c66c3414cd436cebe125cf8f61e160989334d70d8190c74f5bb5a3
-
Size
935KB
-
MD5
a827dba375728d5c37a8b06fbd7a7a68
-
SHA1
6325568e77e8d3f122fd3e481be2c0d6cce273af
-
SHA256
6571ae5748c66c3414cd436cebe125cf8f61e160989334d70d8190c74f5bb5a3
-
SHA512
64e27b0df951966243d626fa425a3c07ffdb3533e48587f475e73cbaf776c9e5f79e58956d4ee4589d4f6730101bb34e19812b2ef1d1f54241845d12b1e0e84c
-
SSDEEP
24576:YU5HwveQ0yzxpZFxSlpRLrcRdPvbKsNaspGLVY2:YhYy3PcjglpWLT
Malware Config
Signatures
Files
-
6571ae5748c66c3414cd436cebe125cf8f61e160989334d70d8190c74f5bb5a3.dll windows x86
cdf3e79e5df7e8a9ddafc4cf3c4ba378
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDiskFreeSpaceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WinHelpA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
version
GetFileVersionInfoA
gdi32
LPtoDP
ole32
CoInitialize
comctl32
ImageList_GetBkColor
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 378KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 348KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ