+�K\� Q���ti#�X�La�>]<]�Z[����J�Z6�(��M�G��-��=��� �N�V6�kV�}/�*����tKu с冪�Ĭj��³�����@�B�Ô��pQ�2��9`��@[�^A��g��v�RC/�����P�K�q������?��$r�N�IB�Q��65�G��@���Y����D�ObB?�M�^��r0c6���y��7�K���>֪O9ͼhw��������ot��8A<u��i)��F 祄T���F�~gT��o)�H��)�Tڃɏ���|'�����R,ٰU���y�#���.�:��r:Z�VA�ǡ]_�?q ;�~0���w��M�h=�&���J"��Dp��(�D;_Nd��n o��FF��#�^���wN��n�%�d7�މr1Klidy|�ogB$�.���0t��z��&Q�?=������)�ԟ� �h�BR���KJD��7�%ؒH����N�}����&o�Y�gb����y*>��l�]z4��ni���'���3�gU*��m�AR9��7��PR�"<Mr"Bc�"� k�[�{�$���~?q�*��4l:�a���Se�]0��Ѿ��'`���*x*]���*)D������Z�tZ�"�N�ˢNҰ�T�]�W�I�Nc9�H�bpc(vH�-����䉑�����0kcbќ��hGO|(ζ�q��ϲ6sEA�����A���S/�嘰��D{wY�����>���(��o�QX��.���k���Ώ�|���O��������y���|�-K ��M��� :�qPOڑ�^y�i��r��Nq�7�������Ƹ�Ѧk��e=�zf�ٴ�x�p��ʅ��s��1z��П���ц ����������k�X�'6�=�y)�y|����RC�l��)2k�4��:f����*��x���Ȳ��ޝ,/�&x�v6>��r�i����j�:��T�3�������������<��2!�*���|�D�H?$^8���>Am�s�@��縉<��ϓ�ݻ�ңG3y�,�?�iɭ�� �C��X�T2T ��g��D8�Aؾ���ۅ�k�*��I�S�_Z���&E�n���m����1V�1��v��5T�FѾs���z:�Yf�9�$o y�j�$U��1WHzRR�'������_�~��u��uB%�Ĵ������7e��Mr^��D���踟�c��� 4����ń}� 6lsU�|�^6�cf�i�H'ĚDW�Mq���W���y�V7Q�ȃߡ����x e���> MƂ[��*��f��BK$�,v�= �4��v(^^V����@�m�$�%4�R0 P.v�R��oڻ�o���jL����sQ�w��=�Qyk���D%[���.��'��ڟt�T���ܫ2���Hؼ*ɦ6X*}G���%R�[g����w�z�a�Sk��� �|��{���4���uĥX��2^a��,�����}���� N���5#1�doN9M�.� ����f���]�0l3c?*lq>Z�zwn�3Z;�63�p�Bm����p����K���4�8����X��T�w��e7Im=��P�c�QIu�"+�$4x���[)�)Z��G�K�-��u,�����o��a2��k�K�m������q��H�Vp�ՐM����Y���� �)s's(�E���;���q��3L��D��h�21�boy�]���$��H����-UG�u]PXtEs.���� ��2뒱�7J�!2v�}֜�����?0 d��C_������ ��'��'~���,��Om �Z��~B|�Z�����"f�����;��^��գ��( ?zo#|�<�<<�%��\�b���C�n�X�݉��X�v�\C�]j��gԠ�A�=��2�$�e]�n�m�4���`Z��{TM�(����������m�����J 3O���⥳bJ����r��1�� ����P�j1���f���Q��Yq>�_{�c�������iJgNg�F�5�^ߔY6��S�4����/��bC �_�����: �����dW���@naxpN\�ۛ.����?������--�I���v�Q��`i�Y��h�Qa���x^�YLr\��_��N�L��3 u�Ǻ��l����_3�����4e���9��d�GI�䩄\^�3���Zl����l�y�!k���L� T����I*��{�Z��-��P$���Zq��^#�A ���d�HX�@�5dlp�������]˄#�}��>��Ix͖�}b+5�e�\Z ��x������1�?|n�B��%�hy��"����uN��������cX��:�O��W����5��� k�X��VX'����O�$�/N��a�5��T�@���t�� A~�W"�Ϛ�F:-a��_���g��퍥9����)j��ɪ �����ϰ���%Ӫ�3sIS��þ��Q���qr� �p�='#�p�p������=��O�����I�H�!ZhB�����k�=Q�%����Ac�H����mSW��^�]�� �^]t�T�[��2<�>��d�e�l����C/u����XIʯ�>_K���,n<$=�������G}��~v4���)�0���\�v�.z�5<�j�I �&5��a.4|��=b�d�T��Q��t�P(V����(�J��f�#L���:R����;3��~LE������-�_:o�U��NG�?7W�ڢ��I�@ ��`2-�*�=gY�y����Ź+����ʾ�3x�P���,��B�c�H�"l�P4&���� ��Ş>uڼ�ZF�9�C �r\��=��3G��Ð_J�_)8��S5q�������t7�s���+։R$�"."pf���*�s*RA��sA%�,��7Q����_7L��G� �g�W�_Ͼ�es�d4�� e����I�%,����@tO�u���rDk��%³g(ZA�`EQs�v%���oI���J�H���ܢ��q���R��a0nPT����R\9���xS_V[f��Rz_0�m�݈�Ƞ|9�/����_����Ɗ�
Behavioral task
behavioral1
Sample
d1fcdbb059698146680387dd994c3ff4938e36b0844642c5ce39f98b706d4c95.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d1fcdbb059698146680387dd994c3ff4938e36b0844642c5ce39f98b706d4c95.dll
Resource
win10v2004-20221111-en
General
-
Target
d1fcdbb059698146680387dd994c3ff4938e36b0844642c5ce39f98b706d4c95
-
Size
431KB
-
MD5
66e2090a1d5346518e49e5ee1e8cde6e
-
SHA1
044ed5f2ca211bd48856462f6babb90d49254e92
-
SHA256
d1fcdbb059698146680387dd994c3ff4938e36b0844642c5ce39f98b706d4c95
-
SHA512
00017c2fcc868578bcb0421c1d5e05de164c991d62a408cdf15cd2c919812d6229046c4daf0331fb1bf9bf38a6ff9ac34e5ad69d6c6c34ad485bdd12ac7909f0
-
SSDEEP
12288:oarYnb49QiKJoP468xYF1O/R0QW5CSpryA9t4C2zH+:dN9QiGoPb8KuaQUryAoHq
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
d1fcdbb059698146680387dd994c3ff4938e36b0844642c5ce39f98b706d4c95.dll windows x86
1135943828c1ae0862329a65fd0b568c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
gdi32
SetTextAlign
advapi32
CryptCreateHash
shell32
ShellExecuteA
wininet
InternetOpenA
Exports
Exports
Sections
.textbss Size: - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 429KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ