��c��3���aFa��v֮�i�h�v�ރ��C [��2uˀ�-��$ je���n�=���ş����;�Í��nWcg00NQ˽89� l�� �v�*M�L,bj����Τj��5ƙ��̌ ���qb�r����u��x�̟�j֖M|�l�p�i�D"���X(u���R�G��u�~�^9�X�/HO��;����J�8�����f���T�8��Uu^[��EM����9hE������U)����3F �(M�d\��NQW��ZR*]V����mDe���~D���䟦��<}ddeA�h}\�?�Y���ů��R�5S�b�uD����9��-q :���6��K�2A���{��p���M�O{�_JI`�R3g��y�u��U���p��5�����f��^�^���؍A�|���m���د3�Q�����[}��HAO���Zn&F܇�މDEָ���fl4�tۺ���v�c�A �8�_����3��52��%[TJ��� ���Vv��U���!�"2B/�� C��4�2� �0-R���r�Qqs+lйÏ TVBs`�>]��<�@��T"��������g�ddy��%4#�e4=��)�~�fhKa�8��rY�����{���^��{��P�NJa�5#)D�N)��-{��=��r`�)�ã&��b�]�U4֭>��h�e��D���r���=�760��� ���9Q��U�0�bz4+{fo<F/S�F �����b�|h�@fu�*۴�z��%�l����r$%D`�)���v���6)� S� U���oS7`SR���_L� Ч��40ǟ�:�E9�p�� �=�C�J���ߣP�<>� �y�d������?�}�RE���r�5�й�ƕ� v*A�z��.6�=��e�������6�<g���P�*�ֽ�x6(s�W�}�\ٮ��0�z�/is�./t ��Y�]v�g}U��㹸��q؊��ZB:.I��#�p�F�|�dg�S �&���V����oi�03�AD�"� ¿�-�CT�n7������(�(�"��*24��?����*٪��Ʉ����f���������4.�&�k��e��{K �����suL�h�`ٵ�J��}������7�7J�ge���L���*�V��/�,��v��O>}�N�����۬p�i4W�oò@�rP���=F\���e��Á,��Z��]e���,w�:�b2����X�c�� �()z���ry�����^��['}c��O%�U��;�[<=*Gb��a{���쌾RM�h�\������� �L��B��ʬ�� � R��ހWO;����i" ��q��&z���A�A갶��V�h�t��<T�K��|L�����<�<S�3h�y �?2��T���P� 5���Y�G}7��������n�e��}���-/]l��̾+��"��5E��H���%�~�7��Jy��p3�`0�EW��.F�~p]���t�I��\���^� n���D2.mD;����}�&M��:L�P��n��;���*I�u0s��j��f��/_�g��\��A�����oA�H}�Ӟ�U����~ :gB��n���e[�2I����s����҄g�I�3[�CTB�����C�s����P�iWaW�/�ud��s��w�|,��qtCy����A&4H�����'y���r��)�I&�K���\ ���c�m�"��Mh��dc%��w�5:Q��]�����\&�h�Sɑ�P��ZuYV���A���<LЉ���m��ޖ�Tz�v��&^V��;��o��#-�/6wi�(K7[C��;wgU�.hGW���yع����b8����P.��c��wL2�%mxU� \x���;�N�sE�E�D��=x��͛�0��M\?��5U�BVS���`�o�`;��7�sH�i\�n�%-v� ��vbc|D�`@1I�z��C�'(����T�E�a����� ;j�)0�obr��##,#3��bb�6l]��8ӿ-�=f����F��g����pӀ\;�a�K�[��H��I]/��f6]�6c8��z�N�b�"�/�^�C��$��H E�N�Z���Yw:}%X�]��J@�l����;�R��� 1:1�@�α�$g*��U�BC��g��r2���S��3A��+1Խ���lBHh��\͆9h5�E��<����b�S��Y��G���nDU;zv��*~���I��:L�K��b��8��+��R�iy��E���<H�oUa ����(> �K��n�%��*4l �}6���I8��˗���<��!��a�$w�������g���]����>���Xl5I���U�}0� �4F;�|\W(lD3��dv� 1D��� !�q����TFwj�LK>��T�pxk�g����g��y��]����Ԉ_�?.�{o�����Q(=�dg�3#�T��<����A�8����g�wL� �jc��yZ��A��,g�!'x��U�?�z�[<]����ڲ����]5}�?�F���A�� �E0���M��t��$ܾ�V8��������k���YeI���,ŽV��UuE�xn��j�΄ܬ����{���u�@��Aa�w�{���N^G��=J�־�oAM�����q�¸��o�Q�?��nO� ��@������ʴ��{ z�"�A���q�>QXTx��(�e�#�Y����{��z�T�bO��#袳c��k����mt=��h/���@��o���ZyF��E2An�kb�>D�[�*R��`��Fΰ�3��3��Z���OĆ��D�� Qw���&��vɱ7[���F����H�j��3b��F�}��y�[���`���s*�k���b3����h�ˇ��!�cB��#����lH?3�8������%�V`��~���$Iϱe�w:�!�2�=;���-�ƽ���<�`F!���ڦ�X �h� L�;�Ÿ��抿�X :�>��n��@�a���e�W���7��xP���٥�ڞܯG\3)�ŵ�
Static task
static1
Behavioral task
behavioral1
Sample
7dbb5fe883cd9d35d5b5a0c02193a6b86fda311a1d490309197cbfb7b7b3ec68.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7dbb5fe883cd9d35d5b5a0c02193a6b86fda311a1d490309197cbfb7b7b3ec68.dll
Resource
win10v2004-20230221-en
General
-
Target
7dbb5fe883cd9d35d5b5a0c02193a6b86fda311a1d490309197cbfb7b7b3ec68
-
Size
5.8MB
-
MD5
373abe4cfeb6a58cd7d8ec50118f356f
-
SHA1
43615ab2a19531ace9fd4269ee264c148d26659e
-
SHA256
7dbb5fe883cd9d35d5b5a0c02193a6b86fda311a1d490309197cbfb7b7b3ec68
-
SHA512
bb549a9ae90556900c9849f60aecb19cc424a5ff8cbc46a9884e435134f802c35dd900039719d9afc00f60706aeab6cbfc610129c50499021190f5a4132b7ca6
-
SSDEEP
98304:vsxl5oS3mQFmiaRc4BOqcRxBV/36xvaJc+OnRv7cqnnrUhJgmv8J/gp71CwcbTZ6:q59miaRc4B3cRZMJnGkn4kmv85grd0wz
Malware Config
Signatures
Files
-
7dbb5fe883cd9d35d5b5a0c02193a6b86fda311a1d490309197cbfb7b7b3ec68.dll windows x86
5919c05a0e1454ceb3ac88e6fbe0c9e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeGetTime
kernel32
GetModuleFileNameW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
ntohl
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ