Q�-��~��� SW�*� )�Sl��͓��Gd<�;W���C�߹�}�s�5y�`9�w\ы��u�,?�wZ��C�;U������S�͔w�������5y�%�G8��6�uYspz��N˹�0����r%\���S1��W8��|)G�Z������f]#��∨A�O�p�l��~��^���A�&O{P^3�� �p�o��t�m;���00��{5�`T��._?`8�ӁU����+(�� ��Z� $0 �;����It��r��,����q�E��3��f���E��}�e��J�J�-����yB��]J�C�p�ٮܐ-AJ�x����Vno^�1րq8� E�p}>|Q�_�2x��up���<�>m͵.�Z��Ϻ� �6���nv�.�������Ҙ~��q��n�מPIJ�H�����.�U�Uf_E@��+M�gXP0 W��� ��ER8Qq.?y��2��W�q���2�d+J���m��m!~CDa�U7I:���951x�}7eu+�1�]�ݧŕ,�,h�(�HbN�����!ǟB�[���fĬm�l���(�I�<f�WOk��>���^���:dE��5�!�q�n5��S�!*���ތ=���dMDVMtYfu���^��$8g%B^�-N��,� sٸn|�Z�%����y��N�:����?<����D[Q�"!i6������H�H�%qɘ-;R�S���xbi���D��z�^B}+��.��<���}}za��a��O���16<8T0r��[��:�^������W�$����D����T ������X���\<�����z������ܟ����gS3w�Ė���}[ ��Ž��t>���2�۵�v6�xG2�1Q�l�u4���6� oz�0��u r�i�W���=�t��1"�2A4���7�I�����r�۰�����G���X,I2�$*�lbn[�����A�R]m�Z�. y��6^�5=n�Ȏ�a ?�>����#T��,���z�K���:cݩf�����<����M?��X���$.�[D�����?G��MX�/�GBD%�!���������Iw�ѣ�Y�`K��U8�IʳPcij�����y,6��b���7hW��ע=���ݏ�����{���T�\�fƵ����1����l�)@�_���|eZ�W�IF�5� >���0?�,��~)�����&�q�1��:�jM������x[8=��)%��ߐ�+w6z,�P�m4�>�֧U��������ubQ��6"n��w����&$�HRud���5��������;/�X�t�v�y���<b^|���PƄ��%���N�Q>���~ec|������?Fv\k�%��j���QE���w&�"�xpc*'e�م����� y���}&��kj�^�t}�li�^�W��� �D��۶����\舡cԄ<z>���U���^�6��x6�*�֖aY8q�'4�Z�6z2%��in��r�ӄG2��毹b$B�W}=�u��"�E0�7�:�����Z�(x�����B�Z�j{_��W¨V��S\��t���z�2����&/�kMO��3�-���X5<�һS�t�G8�Mb�1��������]zg*�N+≷Um��)��?֊C���f#v�)�%fɫ#j�=Z�S��xn���f �1)ɐBl����'��\S0�>�1�NԾ�,C,�gܺړ`"���0�!�<ET�|��z��I�[�?�d7�����c(����N�i^���!k�r�� s�J��X�PU´��t{~g�d�?��;+9�AR�QoQ#�� $���@��=E�{��������Q��̈H���N���c�Un�.}�,Jt�e����F��TI����-{�7ʓԋ�yEK�9�6�C���c��ش)����,�v��I������X�Y}ڠLX,K�&[��@i�C�}��xo\C��R�8������:���큻�=��G7��&:�� B6G�9�������"d���ꂡZ�R!zU��k� ���c��2HWfy>�ۄ���rQ��Q����ݙ��.}`RO:w��E�+���t�.1�>xSܜ���C�����\�=h�.f�O�É"/������dq+����Z�s��A��P6�d�P�X PK�����%P�S6�D{ȯ� ���T|>��i �����u�P���LN� ��0�r)���-�����k�/�9��[P&����^,#� 9��:4]�쿁�g�J�j�(���tpf֢�����(���%�+hQ��z�I$XZ}G��s�r���n�D��<��x�>g�<N����w��^C~�S*r�P2��$��N1��a�س�/_ah�/���*��y�/���͘��&;��[n�K�� ��Un����V������Y���<�Rc���P��ߋ�!��m;i���%4o�f�\Ax�7��������l&��� g��:�3�K�!)���/��K\Y-m��s(T&�_�gBy�����8�S�]���t�Ñ26ꌄ�a�G�����]��o�k�*<��Uh{��q�_�����c�|UU�qK]]>:���0ݱ�z-��Y���;8Sࢿ&K�kT���=�/mz( ���6a'�7���H����1~TH:+�2�c;]n=��!� �o�C�8 �P�+Q=/x��+[� �>w��uX�`x�Zl��#�/UyEH�=�a��1|�J1o��tT���-t���� �U�v�n�4�ד��@SŹ��M7d�nN�������V�"��H��&˰�e��*s�Ȍ�3>��D�_��L[R\#�57}&�"G� _����`�,w[2��=���/�5ې��%�d�%�/5?G�g�t���p3��>�C����k�u�C��� ���FHF��ƥ0��U��M_��sC��@��lBB�Ϗ�SM�f�������t���%":0�`�RV����Z�S0f���ӄᶅ1�-E��c���W�(�8;"[�y���[xٻ�]/� w�A�/i�?�haee�M��"��
Static task
static1
Behavioral task
behavioral1
Sample
136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe.dll
Resource
win10v2004-20230703-en
General
-
Target
136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe
-
Size
5.2MB
-
MD5
11391f98db1801d6ad85222da2accae8
-
SHA1
6fb30cf018dfdc2ca7f4e037fb50709e1ebc8455
-
SHA256
136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe
-
SHA512
9cd36c4ff6e66378c8f55d4d16073c7212784fe18eab29b42928ec52fb68cffd3bf4dba867ca1974887303b796ef3fdc78446a2bd62c5c6d1f1d55247e2e21c4
-
SSDEEP
98304:EtXDmIG19dM/uQMAZihNeKMXy7zoNbGGQLn1D41t:EVqfc/DaNwJ0L1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe
Files
-
136ac7ce6483da558c079a82da396821912a0f37d4196991336f6f983917eebe.dll windows x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
Size: - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
*/0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
*/1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ