A��d�bם�~����xvɟ��@�Lɨ��Asv��� ���I�tHy;P+Jҹä�}Lqն#��k<ݶ7�W;B��[<{��>��}��]��p ��$Q�3H����g�H\���!�I�8�?43��(�s�M���4ӻ����c��� �屏K�M\�� ��ج'=3=�*2�7iZ�Y��P�x�`pV(���&�� z�E��m�Y�֊3r�O6ӯ+�3��s��G�J��Z�с��S$q�����sY�����!fX�yE[�u1k��G�#�K�����y"&Of~���W�3��0���7i�w�D[���S%_���y��f�>LA��V ��6��JO�1T~���"Z��98a,��˸�i#�U�q��~��("�z�%j��p��.��uP�`YP����o��q"=`���k`#�ܣk��:*�,{C�K/I���l���A��0"�vz���L�Q,Du��=� X�o� ���ch��������U�v�5�YiR}�kU�-φ��`���}��gYB.�i���S��d�#_�� �:[�x�t[�aK�m��%�q�*�r?;�F��bwM�}�FW��O�3�H�+d��Y�j�ja��������E�1�pFV��c8`@1;>�6b4d�=����= Q�^��=~\-cPf�E���� �F4���vJe�E�BF���/�).�Pc"����r|�v~>�k#��N���Yl��hr�ȿ������$+���g ����5+���8B�Y��� l�H�f�W��Bg�w2�<�טb��H 0p��g<�������C�i7�?*��.M���pg9�тXG���X�r�x�0S��D*�+�!�g{���M���8X%�2�����{r��Q�����{�� ��2Va ��L����6��iC��E�0�n�b�w�N!��I�\E�!ӑS�d�?}"ƶP��i�� ��ϊ��5;�3t��:��|,��o2i!�"�;$!�9�������#�'��-֒�0T��H��/�Ͼy������<%;��p5�"UC�Ά_�r�\�b�ۉ�6���Q�����1�F�흖�o�O�����j��*�j�5N��̧���P��/G���>XqI��E����/Z�i߆��Ѓ����F<�&ae9a��J '��S,�J�"$5bq<���B�O)i �M�-%���!����^ra���J&�0��E���p�[-�D"�iB�x��H��ib����(i� *�z�VzL�y7���}�aj�51�9<(���s���z6����?�!�S7k�7�`�q���$�)��{.`\��z,�&P�Շu����&�KK!�%� �Og[H��E��&����3��fL&�`�.<}�>�b���;[�b��Hh+��4��-y��к�{v�_И���<ȹ�$�I�)���ɗ� 2���x�D<V�o#�����2�D>"�<��O�8^�K7�&�!\����x�VyuF:Ī�YR!9�.-Ĺb�Q�sN�f��L��3�t��,0�u��#ྥ���9�9����������!.�L~�A���m�մf�:��p戮�+��'��"� ?����X�����ک����`�4��$:�v��X^t6�]�TԒ��Go��B$�jq��gPu����Ω���(�SP���>�dS�����1��C~%?��������� Iǂ������s/�e�آ��6�l�]��4o�N���D���_-Z���ER�^�AG��$��ϪW���,]?�98�"�ev�c�=��z�)4�H\���]���R��Y�2��$/�[ 8!��Kf4hܰ�������t�1G'H�����mztڤ�:�>��I����7s��q�bo�,���So��� ����(��$+s�b���]� 'x���=f���Q�0um�E�jN�Zo���n�e���'��Io��ƒ��l��]�:AE]h�-Ҕgo�ƛ���e��Bd2�E��b����C ���B��Evս�_:������Z�ãPå��h�:�۩��r*�n���� �'�ΒX�����s��b(�O�k��}j 9toF��&#瑶AL3yo�� 0�G�X�t�. ��a*�p�R}aEHz�t+�0Ʊ��:\�C��e������eT���!��N<[v���~��4l3ݬ|����� ���X᧘����ѩ�i0�桀C0���]"�����/����U�#?��'��q��rC��9������ξ ���4�>+���Is��T]V,�����q�ˬOEK/<N�U�����Y��w�ֱ�E��[~��x��Ɉ����֤��6ӳ��۱�=j��4�����]j]L+��3 �H8k'��@^��N.x��E�R�S�.>��G;a�pS˙/��϶�:.`����>ܤvVsB�In��itx�sx&)){x��d���B+�����\�7����(�6Vu��?B�_IE��e$ʆ�K��}]���^��I���&9����n�7"�����樽����m����z'�Ƶ>�U��m�G����ckD\�K'Jthz�/S .�_ζ0;�BX,�E<j����?ltB��:w���3�ハ�B�d�ZCӾ�i�Ÿh��bȼ)jl�Ҵ�f�mM[�{�Ʀ��t{':�R�W���li1-i����[�ƺ�bZBx�l߯%�d�C�X�~�XJ��-���Պ�C�uq{@g>�v���Ma�_fDR�w��Vw���p�c����xG�Z��}�[�b���C����z��+-��i끐�=��lKR*@Rf����k C=d ���$��%�������� P�\E��m .s��i��7�@hw}Y!P�e�r�dk�o��d��W��Iba8J������F??s�Iq|���)0dq��E��w��/����?��Oc��n�g[ �5K��g/g�sp����� �AKo��ITtXc��_|�+c)̻��v7LC�'=y�7bZ.�F�>��'�bkN(O��+�����)���x�2meXh#-u>����&y'Ծp�x2���6��F��a]%~��C�~+ۏ��|Fp8 ��Sb�
Behavioral task
behavioral1
Sample
f4a4c3fa10a21be684ce609035718a8062a98657c321b5c5990d85504c236c8d.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f4a4c3fa10a21be684ce609035718a8062a98657c321b5c5990d85504c236c8d.dll
Resource
win10v2004-20220812-en
General
-
Target
f4a4c3fa10a21be684ce609035718a8062a98657c321b5c5990d85504c236c8d
-
Size
109KB
-
MD5
eb5c74fc983574ed7fcb815aa6fa50cf
-
SHA1
5ee62da757d55d6af55db1b38c921b26e37e1124
-
SHA256
f4a4c3fa10a21be684ce609035718a8062a98657c321b5c5990d85504c236c8d
-
SHA512
9731326912e3d6102b99e78f98905556f8308d2f2974b6d914aac8d25c2db8253682f961facaf1435d6305d62937ba96f26f4de2e1ab8659e9b7b6dd3469674a
-
SSDEEP
3072:KTip84NJyNkQb4jYbIr7zpZyyGXpAEUr+m9I2ZwBtNxFbg2d6B:KTipRXYMHzpZ7oAdr+m9I4SVJg
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
f4a4c3fa10a21be684ce609035718a8062a98657c321b5c5990d85504c236c8d.dll windows x86
022dc32a47a9869eebed88c2d06ab564
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegCloseKey
wininet
InternetReadFile
wsock32
htons
Exports
Exports
Sections
CODE Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ