n+��\�Դd+�X�65�8(�ڟ� ]�Ӛ��'wBĕGz� ����sy]<�F�B�G�S�;/o��Vf/����p�Du�(���)�U���ꥅ�c0��_�u��ߢ$�I�=�2�r���)�"��}��%W��R��Qs<a�&M��]��s��i�A�*u �����/{��mE���h�sCޗ�0K�+U�X8�����gW��,Յ��K��=�D�Dь7ܗPmwIQ��X¤�'][{��d� K�����Y�kV�(�vj^���!��>1��zJq�F1q�Hsu���o��P`�M��'j1{��7;���N���gk����^���Zɹ�m��x�WM�?���t�{��X� ����V��R�t�6Ц;���oO7������[�f�o`����6�/�%������9�e�'�мI�5G�l��S�Ւޞ#p\68�4q�B�1��Ƿ������5hWV�{�I�g1�Y+ȷ��W`�X*i�dv.�:-�C$��V����UwB�z�����G��cUB��[�dP�G�zч%�&�Q0%�ԁ,]�~m� q���r1 �p�����A���~$��{���Ζ&���x:��Z 9��ٜP�_zS��K�#���^�^Ub�B��b��E��2����`�xa�:B�sa�d�k���8��.t[mŢnl��V�B�����Ԕ�;Z�5X��2�l���RZ��/��P�{Sk9a��0Ԭ0/^9tzw/���CEY��lï��|~�� �~�;|t�ɵ�ʍD����cX��1wV�7]r!�0RȖ )���0�G�?�mS��ȑ,�H�tM����*H.�Jծ�ߨ)��� �.�0C��5���AbgB�3���|)�GD��.F��[�x�O~8���+��~�֭$��|s̚�P�9�.Z����Ȫ�G>V&��O�sHؗ���)�e���S ����;J$oy�fQ^ء9�2���/��z��}[�'m:-��V�W&�P�m�C��m�O�-�0# N�����1�9��,p���*iK t�w��Dݑ�+�r�4�����gdYw�bzK餂�D��"������4�Is�o5�3��sb��#d���d�m���e����l�`��/m@M@VI�^&Q�;Zƴq�J�,ڔM�������: ��Ք��fY��}d����%�Ls-n+T[���¹:*ک�Y&�@ ��tV�yg��7������[���==���[g��� $l\;����'Ӳw�m0�%7���Ud�B�A��ՍҢ��nJ�������|���]�뱇����%9��jM����p<g�����=m7����ߑg1��M��I�<�Qٝ���(��J��'�C>+[j8�j��3�)P3����b��֯�����مh:���J˳'7ƞe<��L�t&��<��p�} xp�6�{c��='���9�-�v>��udB�q#/��|�������z�L��QC�� e� ^S.j�W�\J�f�����{�}�L}�Lj����`�������dj%�6ҧ }���4E~�)~��\���a��RO�h��<�<6�P��x�9���?��\�%�!L��R�S��rv�l�Ҥ��I����&���5����2���d�U'�jaf`Fo�����/�-�G賚ز�SQ��.�����^Q>�jJ��B'�X$�U����,���Zx�Y'���g�l�.���M�Pt��XX���>�6�����Ȍ�=����[ �>���o��h ��d�HQ(��A�j�fI�K:��w�v2�D�z4�-�G��v1d�,e�lϜ:�������|��̠ܸ��Y�t���l�ݔ�7+�gVSU,t���#Dl����*��T��o�1�K�+A:��N]�<4��Q��D��+{�&���J��K� (�����U�YI��r��w�^��S�����w�� ���W�6�t� ��I�Ш�����|t�>0�}4a����=�P���) 5t4z�q������x�r��c|���"9�z���@i��AS�m�o�������qB2�X}�^{�����E6�yK��0�� �C�"T����V�j�#��r��n�n�-�c�<�F�6�=&�*{� M$�<����X��#�9%BI^�&�[omЪ���o�����]^�v�⩤�p�"T4�5#b|�S7_��G�SE�'R�:�+� U���� �Va�ge�|Ҁ�f�6O�5X �͍�%.4g� ?��?�Z������V"g{]�"�B�Z��Eİ�J����?XJx���d�˩�E��ҵ4�xxAU��3���y�����5QZ^�d�T�V��՞��������w���k�Z8m����@5�4c#�4�"�c�D�����5�RT���(R6�7m1�ճ~��f#����쟞��csn�D2��*��ȭ�,ؽ�V}��*%��;.�H��_)�[GfJ ��1)�tL����s�m�����Il� #�})deB��4G�k f#�X�"JX�7~2��eb�b��U �.kv�d)R]�|�궤4�({�'�ҕ!��z����U��%��f�]����Z�gu[|_b�L�ؐ����U�,�@q���ǐ:��3�!�����>�_��k��ѩƶ�'�"���E,�%�8ր�'����FI��l����A.�&M���8�5_�_l�1�0�qKy�g��~�#ViǼ��T� b�EiUT;KA�=��d������uz�wʁ��4��;Һ�Y�*E�q��������̡��� ���nFu\�WA�L>Q��)��a_��K숙>[;� ��+n=n��J�������+^��,��e��{?��Y�vY���^��9��K��x�}n�)�?�B���y���퇳c��鞄������Ž(d���~o��{��0�Z��.�0�$�*������|lStPnTг��{L���~��-�ʡ۽���N���ۼ�E=�;n��*:�w1� "�^v�/��U'�笯T8��0�i�B~��ѧq�S.�qu�A�!��+ A�M��
Static task
static1
General
-
Target
air.dll
-
Size
6.8MB
-
MD5
0bc54da6bea006373aa6dc931a97a405
-
SHA1
8f8ececedbb606e57f3a423a1756779ad2fd27a8
-
SHA256
7a0244aef196c535276e08dad4a6def5c784d367ca339dde619a62130d09143d
-
SHA512
b23767dce1ad36283d64228194ebf29127d413b5f4d61114c36ea15bcd43fa3235ec6f2f22776e42a25c19fd0f061247827a1f900398ff0c92e1f58588a2503f
-
SSDEEP
98304:hJyit3NfZoe4kXpsFtcYVsREG+B1HJkQVxly3J2hMeXyYoxn7GLH98xoMQIcl7:Cc31ZtszOREhB5eUx43AhMUtL84l
Malware Config
Signatures
Files
-
air.dll.dll windows x86
Password: 123
20908bfdb1da40f773d3358ee70f6768
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CallWindowProcA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptReleaseContext
shell32
SHGetFolderPathA
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
imm32
ImmReleaseContext
xinput1_3
ord2
ws2_32
WSACleanup
d3dx9_43
D3DXCreateTextureFromFileInMemory
winmm
PlaySoundA
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-utility-l1-1-0
abs
api-ms-win-crt-convert-l1-1-0
atoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 554KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ