]�V�D�� � �<�V�_���([K�@�w]1�H=RC2��9I��G�h�֨ɤY�r�ǫ��Y¼,,�Zbu�e���PX��r� ��ֆ�a0����8��;�{�Q]ˏ�%��1�܄��He8�6��X'dKڴ��]H�_�4+ I�n �Z��0~#;��6��l��'�V~�E��r⯎W������`�����ߚ����������>�k�Rt�A�a��mdQ�Ud�䐪��/�c���;�'��O��U*7Q��N�M5҈�b��67�)�hT5B�ơ�FTd4�_Gߧr/Ӻ�jB��k�d���#mj|P\��Q�Z���n��E}g�?�kL�K�ܓ�r��������bXs�(�*?�9��ȌE� �ZA ,"�@��f܆)#vd&@�x"���o �!ϷaU.KP��A��6l<Aq�ӡh�����Z�ܔL ��L\��Y��{�.��7b?�ā����r�L�{X�`>�}d����� ^rÒ����q��;�S���.�L1Q���h]�H�*�z]M��S�(��a�x֎�_^�i� �غgiP5�^V�b�X���s#Rw�������|����R��[�_�'�n&��ZiD.lβ�<� 9-�Ō<�zB�~T9�o����w��5���5��������n�6.ӅËK$�I�s����a����8�*�״��|�ږ6�s0 \�*�n} �E�9\el�{C�\7k�t�< ��r�(w�g�ƙ)��k��o�_�INY9�":FJ�u$��e��w��9����h��;��<PK7w���E�ڣv�������^�$��rߪ��6��Y1��������-]�w�`ubM(S�\T���p�� H/ ���GHv�Ύ�K�L�T!Ö�%�VV��3���0;�r �h��:��i�o����+��ƍH+��HLE�Q�za�~;P�=&#��'m����gʆ�ơ����vp7�� ��v(m%�j�7�av�RK %�!��s���"+؟����T}�S�Lw5��Di��-|�A�����0��nQL�Z�x���;4�<8��c��`�����a�W�-9_ŵ�3��H�u�KS��{�9#�/Z̜��i�������o�<���]�8�$��r=���^P�0e���u�H� "��N�1���9c ���������ot�3��BQ�t�_�M2\��A�&����{`���:�9D�h�b s���>L֯>�.Qw�Q�=��r 7����셾�FpW9������s>Ûg��l��3� 3��]���o.H89"���%1YbVU�1-k���?���a��J�� >�54��7�2�yw�T\�l|P�u�\�A`����j%��t�����N' bR�P��O����U�w���q�a8�3$d��}2}B��@5L�T�oJ�,$y��c%6$K����j.b�I��p�r�ދ�2Ǧ���n���&OL�Ϙ�@�b���T`�KVz���ê��oF\�H�X`9��;��ȣ�#ħ���%鳘w������ ��䣎�-[uM'��s��C����G�$���V���ĥx��ط0�%DF���1h�;@�&���-#���F��ٗ�qe��5b�G�ݛF(�}u��������blw��w�R;�S~��W�gyv�/��\����6b����#� �G��cz �g�R8�Z�C��Y�h}�������i9����@=ֳj��O2)�j���.�����0��!�J������Ԥsy处���d�)��[#��t���di+��R{?��&�iY,�a�V�DZn���$!�A �=�RX�l6'"��(�Ͽ/�y�@�ё3���8z�J�7���j�x���lEŃ�������ve��j�V%��S��Qv=���f�s���u���8���� |��$�9}����]XJO�[c;ձ�U8���ۏW@���T�:9���ip�3� ��n�,����ŋ!@�&Ç\[��M{_)E�&J~�r ��^���"�A�̄ǧ��.���5-�z����h$�@�O��z��@�㰔�_��_a?�m�]��4HE����R{�7q]ğ[ ���5��a\��|��J1�h�Їr�bJ�»5h�=<M�ɾ�d��M�v����p� ��WX�w�O�?���g 5�'��`s$�w��v���F��-�ں8_���E�4��]lk���ٛӭ�����>�)�������5�����|���e����]"��8_ќ'R"[w��yw��cZ�j�k������5�B�Φ�H[��$tO;x��m���&�=j�^�bo�:�߄�ޣl�ܿ��74�;Y��)��bo��h'�=c�������1)C�'�E"z ݼ#�LBb�u��!3��Q$�u��a�1qn%W|B�f�G���t�UP��� �N��Xf�����>�шV'D���/��������7�%K>�m�� ��C���?��{�L�Jb�6 pw!�iv���I��5��l���#�����ݸW�;��'����ܱ����@8�oh%Z�<���Ox��<FK������L���,e��hB�h�0�tX������9UC7Q�T��I��O��G�ڏ��?�g�q}���x[̽�'����p���.�X�# yLc;&o�3��KY��W�k� ��W��v<Z+��r��N �(���������Ka�AY�������<Ul]�DnT�أ����Rr�AZa'��+s�#�V��b�Ԝ���5[�p��_=%����q-��Q���|`�Q���-��p���W\�����|�O�s��͡�L��{P�H�%Gs��"�f���s��r�C�u/�狩c�%�����}ON��S@4sW��0|Ӥ�a/o���r��@�<�ok�I���{Q'|yɽ�Z�m�{��)=�rm)D�Z���6�����*<�yT����������y"e�X��Uq�:�����֯X�>�TJ�N�5�-��#p����$�q���%푶��v|Zd4�"�V�b\���m�b��ۚ�|:��H���_:/�w .ʃ���<D������R�E�}
Behavioral task
behavioral1
Sample
f4567c7f720e39af65d0be67d3bec8d121432d2901721d1d1d7fa1eade28c61f.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f4567c7f720e39af65d0be67d3bec8d121432d2901721d1d1d7fa1eade28c61f.dll
Resource
win10v2004-20220812-en
General
-
Target
f4567c7f720e39af65d0be67d3bec8d121432d2901721d1d1d7fa1eade28c61f
-
Size
664KB
-
MD5
53b1ea31178c4f335c8e19bc05f26958
-
SHA1
2de9da0b8273953a72a4eec4b5cffb8780174278
-
SHA256
f4567c7f720e39af65d0be67d3bec8d121432d2901721d1d1d7fa1eade28c61f
-
SHA512
73c609034449d38cbb2a75fc8b6b73d6d3cbd8e21df3526688566ca6feea3af8dac57afdb93f41c8a159f4ab99600dd18348c498495a8aa3fb7d3df1dabbb30e
-
SSDEEP
12288:9yuTJg0hwb2HuZ1EbfbyEne/fbUe97Z8LD9jWE8Cr95U3Fxx9zS:LT1CGGfbrlZuNWorYVxXzS
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
f4567c7f720e39af65d0be67d3bec8d121432d2901721d1d1d7fa1eade28c61f.dll windows x86
1d9f5ca0d27894305da347a1f801f652
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyState
MessageBoxA
Exports
Exports
Sections
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 249KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 652KB - Virtual size: 651KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ