��9��p'>�!#k��Q�c��?��"��P�4�����7B�<�u��ڰ�z�6'!�>+z���2fm�[��� �O��J�J����.�m�Gt&fjy���zm��H��a���k���ʏ�����{u�қm�����a��ڪ��A���b�)% ���&�oQ�0UDn�~�: ����r�����p��H�#L|;qĻ�xQ����U�p�^���}/k��wm r��K5�>�ig&[�[����}�y_�|��}����`PVڐ� *7�Nbi,��se+[���6�X^ſD�~�о|O���t�Յ�9}a���7u��L o,�yz� �'��K %\�{ �t\��6��H�K��g�F%]�S4�&�ٔ=v3�z!chB߸3��,C���f��k��O���&�u߃�|� ��30(O�#�6T��V�@��q{��9���u7��iuo��[8`'LxC�[����=�a��4����1�MWJΰ`*�p��j���Al��dV�L���,m�R1g�/(�#x%�%J�9�O&�Uy^g"E1�)XԐA�Kw�R��L���T��!�#?L������Q8��6K^D"�b%���e?��ڪ�f{{՟��°��G���`<R��Kt+��\�C���'?�[�<wC���� 1ƍށ��g�X8�7O��#=|��� {�qf)!����͓�� �ۯߟ��ToI����3�����l+iS�1�����ƅ�Wx��i�a�"w�t4����;;$ ��ZG�� ����\�I�p� �0`%r���p���C�?���'/C�Ȭ1|s#� U�k�0�����h���0cz-�I�\n�8bۉ�� ��~%� \������,����nv�>�x��e,,���:�'�xpP������!��]{�����=J�J�n�Z�g�Zw��P.(�{h����GE�sT\7(ydj�s8�RyG�̊yI���ysNvKA�dk)W:0���G��@ǿ:�קhՕ=G?�Ӛ- �x���iM{a��w��6��:��Ԝd�� ��~�) .��G���͍]T����>ǝ!�� ���C�-���YZ��z��ȩ��X��P�nb�7��x� ��#il`ͦ���7[�h�����(ĥ��I�,��M���ƚRق �v�&?����<�nj5��k��x=�!(����$� {���q�V��"�q ��ȍ֎_��>��+���zKrL>��. ���g�k���~��]�ks��IS��aŊϾ����}���`B���i��y�^RW��m�iNC9�F��wh9t,#��%��Nn����2`-_����R� ��q��_E ��};Hךh�u���[���X�!�9��k������[P�v�sB�,̤߰��L� w/��#��y\p[=�g�Aܥy���Sl�#K���� �(�.���Z�,�����Z�:o4�ᷪZ��)��d�x3@��t��;����v��g��b�� �E1B�y��ӣ�F)G3oBVP���b#҆�C��y�BSf�0(��՞��3ED�����W�/pY}b_���P�h,˽��a�۴��d]0sނ �E*� �h���q�3���z룮(�u��_y_����=��]���Q_���Q��*tu7��u�8��r�}ֿ��:�= M'��~A�"��\�|�P7\�d���? �'��- �m�M��z��K����f�Tz��\R�ȃ���+u�>*y�����$�*��.�j�����c��Β��v�HL՚uK�JS��-������g���ng!�n�=������ί���"�I���vY�A���4E����_���x�7Xu)&B��y��s�ut��C�8x�i>�CR�R1�F��uh�٨�,��a�=LW�6V��@~������o'~h�y��#ހ�u�9ʆd+4MC9�?�x۠���*��={��lt�.���06����AC:<�v�����*��:���ˤ�a2DO����%]Ĝ�`{B�2����F���+ui��[G'�r��� ��S��c��4��#%���>���^ȉ�����|�?R�).��9�p� ���:��0p��%42;�0��^��N�e�\9A=t\��]�!�ZTG��ߗ c�n���2T�B{�yS�e�&������^`U��{� �N�mZ�c�/M ��!��CR>�(~�6�ǐbP�`4M���\���4'��&U7J� !�[M���V�"3f���vKOG�A����_��~B݁�<��Tx�p�/MoE.����ܾ�zIm?�SΕ�+��.�:��i��,#�Q�ڂ��u�P<�O��U���� l��mY>�3�ڮǻ��)�a����h{�Ǧ�N^��rg�D�q���'��Z�{�yu�vq"M�15�.���uE%l��ȉ�P@���D+�n���b&Mr���5��� 2���8Hf��W8�j,R�M�3����ꪞjUDN�Ŗå*�� ��c�^�}�~�!{��k���X��Iྣ��R,'���樖���n�v�!LS�5���?�X*�[m�{��q�����α����pF��nQ��� +%�v�.=���e����@B_��X�V��CC�I�������[x�G��ah/�]b�.�.�^ΞD\_�����K|R��p���ׇZ���&s�� ��B�r〜e��)Box��R?XP�VG�b�����E�n�=6_���0L�1 �o�M'��²�~��M�뙃SKBƭPn���%S4�c���Oظ�݂���~�rE���$Y�����Dr���̱C�dY�K��n��叄�M^M�k������4�ٟ����}+a�O�մ�@X� �!�O�w�xyMx������Ӑ�����m/f�^�����*8�N��1�"��AE��n� ϟ�a���9�"�o��܈K��V���`�5�A����������!Q>��]\ׄV;�d�dI�8߁��r@S�K�����>����ɿىh����?dע�G{S�u���אA��0��v�hp߇�Y9�nv�����V������?� w���Cm7�YVpY���[��A̙9aL�c�e�
Static task
static1
Behavioral task
behavioral1
Sample
905140_HdcZilDGt2.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
905140_HdcZilDGt2.exe
Resource
win10v2004-20230621-en
General
-
Target
905140_HdcZilDGt2.exe
-
Size
11.4MB
-
MD5
59f2772de7b005f1563d41d886a5de29
-
SHA1
7da4abd16cc695c815a98d0a38594c8fe8343275
-
SHA256
6f46be185084a2013d5242704e554ddf6769f878c2ee63408946ce9bfa6b0289
-
SHA512
e328514bc3f778a42e1d9fbead45e3065f45c9d05495953e11c87b5fb0a3ad797dd7f9c3b737374642e89318a34c869a06d0a914a356db3fc291afce48ace314
-
SSDEEP
196608:GfSAUH4StpJRXxHa8qds/X0iJ/EixW2QIzynj9+ICV69qfOefkQYDyouzOpsoq:btpJYds/kM/bxzQSqRhCV6cWsDYJjsX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 905140_HdcZilDGt2.exe
Files
-
905140_HdcZilDGt2.exe.exe windows x86
143fe290a34c4f88c2ba1ce40f2f385b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
CharUpperBuffW
gdi32
GetDeviceCaps
shell32
ord64
ole32
OleUninitialize
shlwapi
PathGetDriveNumberA
dwmapi
DwmExtendFrameIntoClientArea
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ws2_32
WSAStartup
advapi32
CryptDestroyHash
oleaut32
SafeArrayGetLBound
ntdll
RtlGetVersion
crypt32
CertCloseStore
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Dys0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Dys1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Dys2 Size: 11.4MB - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ