R�����4ir�B�P͡��2�j�Q������J�2�u��):�s�jCV� �`v(��,���rN��=u��ɶl_p� _S�e�Nܗ���@���VJ��e�|��o�zv�/Z�ܗ���{'����*9LU�p5��d���^p�C�����^lKf�m}\�����_�W�tN�&?hy��A������h�gv㏥�E��˹�#qZ�p��喬�h���bh|1n��o�K���K(�W�'�p����q����!�E�~�`�y�%���g�N��D�����h���BJ��j�V9R����*�`r�Ȁ�� ����Vg���k���p���(3��.w��V8�x���xr�A��"��4.��لXe^-��pD�� �M\`|�Y�ie�Cߨ ������i6d�oAd�Eq8�&6C��|X�é82ݳ�Y�ڰ4m74���4�����ǒ<���Y`j�6��j����Jq-�G���6Qd�Ә�+Q����Ğ��\Ѱ�jB�g������k&4T�ñ恆7z��yʇ�S����+c���-��8���ԋ����"i�EYJ�ry�_��{��R�%��K�+ߤK��0����-X���Ώ����w����NR>m=ɫ������J���FE;e�~����dp��%��(>�e�u��zW�xͣ9���5[E��qղ.ê��ӌh�%k�~�)��oڹՔ%�5���]ǜ���q�*&bIo�O�i ��PS���ZV}�+�`�c�佻>Ł�j�?z*�����F��yf����{?:t���"��b�y3�����Rm�m�`%�s����`A~O<�y��d�̂��������z�� �Ī�H��]$`[��ZW���lD�^��&q�o�)˚wNP� j���m��+W��v�@���O�ī��*옽�o���˺zϔ��c�#��3+���ٍR�_p1��PX��'�\r�h /�{������@S�PC�G�k1# !��w���ʣ��#Q�N<��9�L`y� K����v��1+��]m����1�A�@���f���É.���J���W�TWB[�.�ꞛ���1^f ���ű�op�w�rJ�F�e��f�2OGtQ�� \�(��E&�6��!Bm|����!)�X4#4�4A.�����(��Ԁ���-D��Ų�9�E��5����53,<^��gs�r������2d�0��G�->L�� �u��H�I?��ɚF������� r:��� ��Z�G��洊����b,C8��j�s^_Jf6t/g��]���g\O��T��^L9�����[��LG4R�.��q�B4ڍh�ͬ��V5���cn���s�o�.�J��V)�*�K: Y�ýn��x�Y�~C,����� ˑdQ�tjW��� lav�@T����`�̽ �ʷ�V�ڭO�[�&^C���tu@~�3Y-`���g�|Źq�!���p�KH�7`�C�ԀJ!r�Tj�'2��4���媠b C橋�cB(�ʚy,#�ĊW���V����<�d�����lJ/�� o��)�b�IX5�2�&į�q�w4�BG�-��ޜ�����{��`�U��-�}3WCIGq�I��Tʆ��b�����vG��:����"�'�&?AU�8G��RZo� D���(����]�{Z�hm�J�_�{�B������)���9܌;����ca��s�ʲWYR>18�I�3����VS�Urt���.uJcQ�o�47��-�0r�q�rus���[}�4S(ҩ�]��TL��=�es�TsR{.�/���Tc�|�%xG*������e�]x���&�J�6�<����Ҽ����*�j,E -����k���x�����8Ş�:¿I30�&W�l��n� Lc�S��� ���z �wCZ�Wf�Xa;��ơ�W�9�8t�8�[Ř��7��X�֯}0�%��ǣ��,������ʨ���t0�=V�^�L����̿N����\v )>)�M�y��!�A����j"��d�V��^gM������#F0�ɩ_��.�h;���WP�q�ZL���K�x`(��ٟԷ$m>@���9ղ�%fD9�"��o2��Z�q�(a�B�{�֢��І��Z����V3t\��oMvaprQ���.E�3�ܭ-?�I�����r�S[�Ue���^2�x� �*��uƊ�z}Ga���v��]9!2��p�5�D���̬<%p�!OW�b��GH���й̾��X}�6B��c�A�68�,�h�vJ�����R���o9�a��N\�q��gݶdM/�u@u)��-[���.��H�������,�?#���"$�T(a����x����k!;h��f�F��QJqV4ЮU�&+�+�������f|�PD?�V������S���/���0�p��eU�5��7|\Xҍ�p&�$Ez0���o��'5+}rG� j�E*?cos�Kf4��s�<��}�h�����e�(�v��0ɭ�Ϲ���!1����m|�l$�N����bk9�Q���YDQ8�cv����izr嬢���m�P��vI�K���þY��wu�Oo�T�E����p����G�"U��x�R#���M�X#��,���nl�$*FΥo��W"0|8S6J�C���A?=�n/���K�z#�Z�/e�x%Y�X!��POX�!E��`@�IJ^�b��?ɬ�KZ�n�bz398f������ ���y fg{�����A���s����܋N;�p�3�B�C�G��U�w�@��s9ӭr�i@%�����������C���<�$���F��$C\�Sq���n*�w=b{�kFxmw> w\�b��E;�@��ȶ�&�@"��ǔ��u�:c�b�7&-�����o�u��Y,��N\%�� û����D�]L�������r����/�_�Cn&]�#�r)���+����Y#jO��t6���ѪK'\)���<�|�~�Y�1� Yi���-��N�����H,� �&P[捸4���<�#�} Y��ti�1����� '�
Static task
static1
Behavioral task
behavioral1
Sample
b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007.dll
Resource
win10v2004-20230703-en
General
-
Target
b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007
-
Size
5.2MB
-
MD5
a0821838ece4ffb1d8ecdf109eac68b8
-
SHA1
80893c806bbff5f860df1fcf183d58c4949811b4
-
SHA256
b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007
-
SHA512
6d463fa7c35a4d748ddead73b68e391a3048bc107e2e4460bf193af6630619789dea425ef5fe573814fc9ae1e074a3784151cd117b8ef89ffb04f41719fecf00
-
SSDEEP
98304:AKAmIVibMsfrh2dahcCgvOSNTaug2mz/ErEe4KoaYOeTRDZ80iFdgK:AK7GibM3dahcnvxW3bErTQaY3RVeFdgK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007
Files
-
b984ccc1bfeaa74738e1e6ecc4a6b0439233a310bb359d4fa8c9b71c976b3007.dll windows x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
Size: - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
*/0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
*/1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ