�1�ׄ�b�E�G^��.`���!�#A��q�d���3Z���q���0���XS��y�s��Wl����I�_6Sc�=��Ҷ$�Y9�٫�T%��ߙ�&������0p��xK��majuӟ����x�Jj���W�DZ��f #ً�i� n~NX�WZ�Go� BC�G�v��c�I�<��W�����|�AX�S^��������R��eҦ�- ��� �M��A��q�vuz��*��l�����a}�\"��U�K�l�rg�gjTɃi%]Әi�c������y����\ϬD6<�����=�8�f��;ѵ'�����xs�|��wu��Y��*x{���[�����nmoz��dW+F �c�.U�Ǥb����G$�*KU1n%D��������'!{`p�;0�r��A�5�i��A}9H�#k�G߹�V'��8����z���o�8���:�^�~��W��S����`\��#5���#q�x�=���W��O�B���1"=����%�%��}k0����t�=u���p�5]��`>��{TUm�V�Pӹohw�K�V�kѶ�E���e���#��&hlE�)�� �5n= �{�����8-�{�eB��=���r���&i�!�P��amCQҦ�*�`6����IuV�B������Q��/eHL�>�5X�t�d�Q��/�M��}쯔}�@`�jSR.�c倷t��zkR�)o�D����{C�t/�e��N�>�'����zi�:���6t���.=�?hJ��`�5C��U_>��]��A��]�A��ԧ����nl$����o���L[����`@���_�:$�I��D�#�m��J��mW[��Lf��S��5��R,����W`�y�HbU/�t �ș��*˄�p��=L��xT����]%\qIܖ�6�Ϗ3}g�8�m�A��40(b٠j๕�t���T4v���6�������6/��R��JN��'���৫uV��M��>���r �{|�#f�AUu�G�����9 ����#W���d!�� ��Xz�1I�G�+U�����~�̤��I��=$%��D[�U 4{���̃F�?��Q�_�a��K���"���|�nz�'O�5� �J�tT��p�Zwڬ��_$���/7�T���Í7 ��Wz�*�����%R�B����SM+�:j�e~����Dx�:,��,��a�(1�˱SȪ�WU���ӣ쉰7R�vM��'��ڕ��Ξ� ��j������T^w&�9|����LyU�`��#���t�����i�Di *6�`"x�;���S�a)��bA���>�<4�=��H���� �Wc�ʶx��^��2�dj ��U��� I)3p:� �U8��\rfѺHA��I��d �:�Q�� 'Xj<��G�?�YX�!QB�� +#�u.r���;�h��3�P�Fu���p�ߝ�����ݘ=,>�������j;~�[�T6���U��{��B_�E��c͔.��o����x���=��c��j���_XIt�ۃ�Z�<�+�Z�îlط9�Qip(q�d̷�����¦��( O��8����}{�����¤tI{��Y�W�\I�`�`�R�r�y�M��_�(��a�[�n�Z �@A'��K���̳ �}X��DD�"2���1?9�wkׯϞ���HU���E�T�<��&+����2R��@�X<L"s�rb\'5a�.%w�����;A��5�C�,��D `��5���˻����t�d6N7��O�6H���}���Qam0T�|��i�XC�v�f�5��$�Rjk�#`��2���X+�)��Mrz\�|�6���EX�QU%�j^�]|���{z�W�+�s�,��z����%Ʌ͛smbP� ��g�+.P|_��l�汯{߸R�9N|�K�� n�?�!��v0��+Wb�}��~���_eH.N��'\zsR�yG�.Z���k���xgO��-T�����axT��k��J�SI�C(£�& �t$���#���g����Z�$L�=��݅bNbf����=��M��{bV&����j��s��W��b)7`�c�����z|,op�@����Ლ�Gew 0yEj�����̆��6���PnY0U I'=��X0���t#PԅA��(��������dg��`+W@��7�~�}\�'�`�莮;.E6Q����\d�e�AN ��@�9}�)� +W����\ʵ �T㑘��O���wK�}V���݁���t�B`���S��V�;L�kg���m[D�����2͕ɴ +֜��*z�Y��{/��8�xg��T���hf����o��#����MS?U�����V�&)\��Z�s�����Y���l4$�����4_�H���β�P�����r5Q>M������Y�r�P���^�M��,ac^����r�����X���wQc�k�N� ���F*W�k�S ����Gc���ʏ;nB����G�Ꮹߊݤ0�9�D5�>5ˉ�́F�����X y��U��b�c���c3.�q˹T+��� ������!�V��v-�X1�o������A~��Rh,��$�����07�z�-��H"�\_U��x���tŀ�ݭ,��ݟ��� ����Ũ��� Q����Oܹ��S�n�di͆��$A$x��2��n�#�,V��"�1��2ɎP�1�1>�&|e:*x�5QN.0���67�g�Tv���:Xh��P8M�x�E�I��}L��]����8�U��F Ɠ����#qi�����3����V�B>���h��cg�J��o��CY�U}�� ;{/+��j2�"��Ed\�k��ү�q-�Se$��g�٢��� xh��6��7��5�̾����F��\l�m����s_�}���Y�{��V���e���AA�$lk9����B�B[k��ږ�8���[��aNR�u�Ϩ��{�ɗ0��b���@m����%��-/�P1�}�#��lN;� �4�g�'�+@�}5u�`b��'5\֨2��X��N�?�����;,M��v;�I�-��rk߶]�Ń��זm��y�eg�H�������3�4�
Behavioral task
behavioral1
Sample
2d7443ff750e4f0c7007addf34884e740cfd51861b19d9c2292d03006bf2f5c2.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2d7443ff750e4f0c7007addf34884e740cfd51861b19d9c2292d03006bf2f5c2.dll
Resource
win10v2004-20220812-en
General
-
Target
2d7443ff750e4f0c7007addf34884e740cfd51861b19d9c2292d03006bf2f5c2
-
Size
352KB
-
MD5
33f6dd231785540eee7c92ed96b5dce7
-
SHA1
15a36b0d4c3944c8321c10221f3094c4a583b140
-
SHA256
2d7443ff750e4f0c7007addf34884e740cfd51861b19d9c2292d03006bf2f5c2
-
SHA512
1264ceae06a55957a9e17874dc39d1dafe42977a750c9b9741895820267533b62880ced0012c422bf0217539b82375c7f7c3e0a1cc1b8ea3623f05ff1688b50d
-
SSDEEP
6144:hK2d9JtiWVwq/71wPE3GicZB2lIjiYXQOLaODS/+WHI6WU5LYtSZ:M29JXrWiw2KXQOx+FHI6WUitE
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2d7443ff750e4f0c7007addf34884e740cfd51861b19d9c2292d03006bf2f5c2.dll windows x86
0443368e10bf35158aac6f942904a179
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetExitCodeThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
PostMessageA
MessageBoxA
msvcr80
??0exception@std@@QAE@ABQBD@Z
msvcp80
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
shlwapi
StrStrIA
d3dx9_33
D3DXCreateTextureFromFileInMemory
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 336KB - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ