�N���ۉ(�9W��40��H�Q}E�{�a�ҷu=�W\7�0�`����K?���I���V������7�R���zET�5�߫8�;�,G�����U-��hlH����]fSf�X��Ђ��I��6�hJ��ݤ����G����] i��-�05o���5��Euly�t��B�t@��J����5m�g}���-0�������$Æ��H8��ф�M������n����4����L���B�E�R�`F��~�YnE�g����N�������%g!�$�*X��4h�F� ��T����4��ښ~$����j_��ց؇�(d]�������Cˤ�Ba�P��zJ 4�穠�HP�fߥ�`M��&��2,���Y�I/E�ЁX��)z�ۿ����x�t������M�`����5$�Yw���^�.����m��D�:ڒ3��{������J�(�6��|�U����1�����s��_p��J0c��h܀t(�Q���=Gˢ���P���-�o�Kj��y���:$��:�L�u\��V"^����t�\L�H5|�U��:��zɧl�A�١__�K��Bν���a�f���n����C_�%?�l������i����%C�.%}f a#h`,O��8�C�M灊=�"�g杁�c�T�������&�A}��_>I~����L�Z.���O��&�#Q1sn^�ˁ��ϲ%\wn����[|��9�������;�����������gcvo٥�YA#jϽ� � ��j@�-2�;H�Y���$v7�ƞ��s�J�t�Bzit� ��,�F0�A�W�!�ct���; �~��0�ċ� ��3�K�א�/�������`�њ٪���.:�=����5a~������ʡV�~���Vw�j%�7���5���r� ���-�B��1�Xa�q<�@�۩�<����h�y�d݇�܃�~�iN���W-�2���*ƕ�����ݻ�N�gi'��U'��Q��������Q����/P>Ƭp���DƸ�8b�b!35am�:T��x߈qȇHv)y�T����^kzg��v� ��[}L~�!�n�o� I�b,<�9�M��Р(V��j����Y�L0Pv3G xE�̆�ˑ4��6$ޘ�{�]:f��f�[J���Vu�~_ĺg{�_�T���s�4UΌ�vg��=�r.�s��BfN|K��rT>�z� o>���Y���(�F{�$(�����`.v�,J�P���N�:h�Mժ�̎\�˚�dR@�� ;�n�.�������4Nt)U��k������9Ѩe8�� �OE�w?2�+�a(H���b¼��÷��!,����;�9��"_�勵+�������������x#1���ިI�qQ����\���Y��M����������֓h��3h�{�jg��b[�X�]�E�����u<$L=�j��"�p���`Fd7�bt��I:�U)ٸ�A���{����d���uæ%F�#4Z찆��lP��QP�S<z����E}a��u36Y�x��?�����G��7�;����t}:�y�72���7C�?ֱ�����������(|7R�h������G�+����!#ֽ�?U�ET483���� ���Й�5CQ,�y9�>-�d�Zm!� .�{'9��!�5�2����x���4NRI��x�d8P+Y�}���V8��2�qdX 7t��E���o�-b��q��.�����N�� �VL"�~ �p(w{�4��h_w�Ň��a]A5X- ��S��CͰ:��q�{Z0t����}�[1��p�4��"�h��Mڞ5�<� ��k���nx��dzaD�a��O6̓�/g���Rr���<�]"�J ��^S��JV.���G_�����4N��B�>�t�q�Y�y9]������� K���K����^��V��ή��3�#�N�`*̆��>�|o ����/�Sf�ӽ5ˌ�rc��m�w�#�7�������J���X��_���u[z���t�.mȼ+!�Ϙ��m�M��{k������s��KF�Y�"�mVq�ŷ�~=R�����g�'?�����&�Lv���nz�����@5��έ��k�_�\SF�Ʈ�JeDC' i�����H�V�;�i5V7�i� vވ�k���%LQZ*'o���J-t�2�>"����u\N�]f&KZ�*H ��-�b�_*��E�9�w�g�El[T�+4rբ���/��2Od�7��f�փ�?�<}��qqe 0���>3:�+T�+���+gz� ��x����8g�O7�5��U���?e��A�"���>������!��:A��~8���I��c� �c��Q<e�BH��t���:8i4R�+p��V�BJ�|�����Ѝi��bD�J#��a=$������7��W��Y)�:�Vׇ�d�n:E ,���x�DT��Tc�Eb�DNbCj�N�/�T�U��u� 滃�q>*��T�1���,�B>��%7'�R�XԍLƧ`�N�ȶ�"�m�l]NI`�J @E�a);��g�Z�V��q��GLBz�gV #��D����=<���C3$��hA�`7�J0�s� �`���D|� IۿܟmV���_Û ���0k�?��+WH�䣲�/@�n��Ƌ3�7�Uo�'�_0�h�^����J�U�a���*!S$<�hc2<�O"����+G�N&}x�(K��� �d���Sv���5�����[.����T�*7�����_qt �Vg���bA���d�.��{LǶ��Ҭ�hΗ���/))1Z�Z{����(J[�%˄��f ��"�!�j�%���xȎ�}�)���� }�aP0�d�t�1 v�{]�jWV���Z��=; jh����'GJO�̣���.a$jUc�|��(���y�$(8��@��*�������.jj=�{�F���>��N�L�/�����/�{�~���:5��B��-� #x�(��hI4./Ʒ猂f�ؠ�.�\���Q��N�����Ox��A�)5ypКiإ�D�%G�Ș�ݴ�8{\�W>�A<��J~ŗR�D`$AH]Ӻ �S��1�4�7~e
Static task
static1
Behavioral task
behavioral1
Sample
testingdll.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
testingdll.exe
Resource
win10v2004-20230220-en
General
-
Target
testingdll.dll
-
Size
11.6MB
-
MD5
5b4825bd223cc0cf525053ea967ef378
-
SHA1
769310ef58a85c903b1cedfbc2f7254bd65b5659
-
SHA256
5c87c11f872957c998599af57a92861d5a7f44eb951db91277b426ac122aad7e
-
SHA512
cd1d8a2dd6cd5f21ff3026a204df9fe9c5663ec50d52deab79330813c893beb516a7d6a099cc19a7fb2ca8c16b726a1976f5d3602afd6792730334b2235c1563
-
SSDEEP
196608:XVbD6jINCmusY247Q1bVpCLehzFOw/qU5RuXTF6k9hwlR0/f++RQDJKbItaW:XxD6joCmAX01bDEegUT64S+70/f++ao
Malware Config
Signatures
Files
-
testingdll.dll.exe windows x86
d6348b22d141747b6a0c59d7ae1fb153
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
CharUpperBuffW
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
wininet
InternetOpenA
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.retard0 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.retard1 Size: 5.6MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmpdmp Size: 512B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ