`y��G2��9�Y�����љӌ��ꨑ��()�|�wb�p�v.ւn~X���:wǎ���u紩��v�\���~��L��>d�p��<�����WT�a �� �����~7�R��@X����P!��ߩ����ǜ�spBS;��WO�Gξ��p��x��\y��F�D��������Y�L��ϨnF����Y�eb�% �6Nһ��=u����U��EXy����}�����Ҫ$�8��-iZ����뀅�˧�h��Z�ښ�� wg�Y�Z҇+��{����8�ȡ���`��xjj�����[�Z��lq�~nRa���})������9��[�:ݹ�����#��U��f�m{��/&�2\����Ǘo`&���߇dW����G�WsӔɉ��p��5��WV��j|�~�_��x�u��M�$����>�+�~S#���m���b��4.��n���c����U�7��}������t����<7�ޠ�����u�B�B*d妵��f���� J����Ĩ�^������аF[��YH*�_Q�G��,f���6��e=�Z+4)�� ���fo�7�qrи�:v]V�s����77��v}Y�;Vt:����Pk-N��п��[Xz��������t�k��9?J�>x{'Z����a���<�ÔZ�o���j�l$Ԑ�` �+mk}~N��DP���:o���(���O�P�a.*W� �Xu�� ���uF{-Y�|ݍ�q�.ko�����S�T�0��G���CM���.4yd;���O�1�".�q�v�C?zMƭ��⩌ق����G��:��P��S�$�鹚[��C�C�MĻ�5�9�/�Z��Ϗ,��LnᴭE����7~�����s����:��%�Wp�Խ�|M�da��z�[p��(��d����� VQ�PT]&V�7�zy�b��rR;Y����!dfq�s78| �Q�p� �#��|ܜ/��%���?����[p����Κ�etvyua�������h���p��?E�;Vaކa�lע �瓋l6�x���+�v�̶�ݩ����4q��E)��?P�q�c i�-��z��q�or`��)U��.'������?�L|��y��Q�ǵL<�����F�����Q?����^�3���F,�3K#�ʉz� �d3��T��.������n��^�a�U�>����+m���`��d=?'�҂��J����S*-5=׃�u��p��5ª�J�*�WZ���c�|��rxۄ���S1?6B�A�]l��l�u�h:���^��a�-�j�x]���L��&2sX���j/o��`td3CQ~$�tK��j��]�4&̅�jO�����U�գmR�~�W��V\�����N�9� �Ӧ�/����P�ET�������&S�{�3����ў<�#b� �Jg�����m=ZĂQgRxy�N�w1��z�K��ke���xn}�Ŗʁ�Pm4c�t4`L'T1*�r�����g3f=Ti���`�c�'?�<L;���?*��:�b����REs����Quѽ�8�p{���=��(�ǚy�jlF�a�[��4�N ��(��7�I<��ge��1w�d��I?2p}�|��[<�*S`K4g��e�7�^VV�jJ����6�.T|R�t���5W���!8k�� 0-R�ۺ&����+��e���@}[���P�vգ��K���LY��?m2_��1���$��D�h7e�l�ڔx�Q���dd�AH���r4*<�.���ћ�ظ�>�o n5��a��6��U����2d��b�;�����&��94�"�Ÿ��.��d�����@��������ʫ�ZIT�~��-/q6'ׂ����fBZ vW�8�ڥ�U{�厧_n����k@���y'�e;h��Ie���G8<���Gf��S?Ζ�]J�����Y��Ӻ�h�*��A���k!Bů�;����c>pKC�<�R���2;���A�o����T�0�4��:�Q�������O]Ab]����#n�O|}�穂�k�m�� �j�)���� �T ��䡅��iڜ�M��QY(�\|?�"0;�tuc8U����R�딲�m��=��:�P�^�ga1�6m�r;2V>aȰ�fp�,h��h�h��9-�N$!���������r>�M�B�{�J��̱j�XN ��v�D4�S��yB����ش�B��$�ru�X)gV�+�#ċ����&mڶ#�"���%�>����43�_�H��*s#M݄�]�T" �9\�ܾN��s��4ӂ+`�.� ����t��3�x쓘+5}�و��ԋ��\���pu0=����,�je�"c 8q��6+6ٟ3��d�S��z�X�F!��4��L������{���Z�hƁ��PqA���RſB/��zx�&Y�SW��BCݑj�:2c�!I�$�Aχsvծ���o:ak�;�kQ0C������"'E������z�]8�1c>�}RU=�08�Y҄��svx�$������0��f��o���%�����&5>c&ӤU�j;�T�Ŷ0�/�.�J������y�����f�|���<Z�kS $c�(�}bOY��g|gh�����z0�lW�� i�m����x�r�*d�H��<9�N��̞�"��E��F^%�`�1�ۻG9�vR��Aq���=�)=�\�!p� ���az~���H��0�b+��̮Y��|J�1�y%)�9S��c@�E�ǂ�M��Mo���*tK���*ȯ����zB?�tѹ��J�s)N3�q+9�ǚB��kn>�3í���V1iR/� ��B��C4 ۃ�+����τb�|ΜTD�&�����j�q@`�*��(ՁyWY"�x�Ͼ�#��u�����jF^�� "U^��Zm�A���ȁ�H�l��D�mDm<�9��p�$�aC����~k�y��I�N�:�N�N���)d'J�0t��-�Qɗ������7��x���>��omt&3��T�x���1��Fl���2 ���2����v��FP�1��������J�O'��mk�-0� qd��N�~);3��V.����F�f�
Behavioral task
behavioral1
Sample
7637acbf9aeacf520b1005732c8859bd0914b934d0b16eb7c9ba9113b55425e1.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7637acbf9aeacf520b1005732c8859bd0914b934d0b16eb7c9ba9113b55425e1.dll
Resource
win10v2004-20220812-en
General
-
Target
7637acbf9aeacf520b1005732c8859bd0914b934d0b16eb7c9ba9113b55425e1
-
Size
355KB
-
MD5
ec22345897bda1b789033b8e6d3c70e8
-
SHA1
1caf0d4ca91805568de87ccdacba5cad2b3469f1
-
SHA256
7637acbf9aeacf520b1005732c8859bd0914b934d0b16eb7c9ba9113b55425e1
-
SHA512
7f9d9f3907c0df142392a2af28dfd56edf4020824ac10988382a074760357e8a18725a8152081e5c883d8a15bde74d7bad249be7c44f86d13ead633ac39f9cb9
-
SSDEEP
6144:crCO0lXWYiXsw7ZZJRagDic7BI6b7PTvJwNhhcq4mL37RgTk3nCV/+79HV7CCbg2:XO0lXWi6ZXRHictecYRgA3nCVm79YR3
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7637acbf9aeacf520b1005732c8859bd0914b934d0b16eb7c9ba9113b55425e1.dll windows x86
0894fb155bbef18defe908566d9cede8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetMappedFileNameW
user32
LoadCursorA
MessageBoxA
ws2_32
gethostbyname
advapi32
OpenProcessToken
shell32
ShellExecuteA
gdi32
StretchBlt
wininet
InternetOpenUrlA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
kernel32
GetCPInfo
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 351KB - Virtual size: 351KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ