)��G �'c��G�|��m�5K/N��+���j�������jE%*j�f�.��w�eh����Ma'p8F��{,=d������M|K��S{ ��h4o�"���֏쓲m:L��fWU����M��^K��X����=T��WO��h�h$V����#}g������jP#�̃�����T�I2��Oa���C���Ym����*Ӗ�-�l��i���YT|p����c�,VxAt��� ��� �ɱ����'�o�z^̛u��+l��ܽ�1y��]��Rj�G��B���|9�l��.Iv s2�R�3�d~e�5/T65<�G�1���6�CP��s���}��Q(w~�JD�����9;�p��@m|����h!v33 �V����o�<m����4��_s��e���n��9�y������K�V�Y�ź��>Ĥ(�U ��׀�K�~�~�a�Π�R#�eK�S}g%��T��,nLp�k6��Ր�3�(.ef��5;��&h��6m�J���z.c_e�B~��hbݗe���G�T:� ��� \�R��@h?��e-���!����d���o��,�m�(�$͗�YE&��z�3qu��$�_�|䜺�_�����*I%-��:��@��)E��B�b�5�#~�`��PE�8ޗG�G������X���ȨD����cB�*6���:�%G����>������ e�k&[�Le�%CE�ż��uQ_��C����Dg{�.�R��@d��/;Ht�����S���|���mG���o]yn�\pf�����@���&(EPnS��Wji$ꕱ )��w�s�m����\8�� �?K��#����3�x����D�S����ij�E�;j�8� ��I�e�~.�H˧����a�FM�S= �C�_�˫0?ס%�[^���P`C�ɡ����u��}�[&��9ntl:��a�����~��J!ӻBUq�j�z���쓚�G�.!�����KC~���`N?l�eǂa��%���a-L�. JY��!�x�c֫�f�S � j։�ts�gv�$�6��d'��A��F��V�pf0V�.�n�j����4��#+6T�����c�A��E�g�I�X�u���4���\T��ڒ�+<���xއ�Ej����y��g�g�l�������5ş*G䜠5hQ�������=��E?+�Yk%;����"�YJ�U���=9���j�'��8U�5n"DP�c����f�� �\�Pi���/`�< ^ZE:v��"�X�';� 6_:��V�~�������B��F9 ������������} ��n@��1&�.)G��� ��?����ބ��o9��'�- d������|�S���&�����"1�Q��~��n��x@mu��m�\7 <��R�ɦ�O$��s����ط�^�y���h�P���m�����MQ$zy����~j$j�O)���6g��"�*�g��W��eh��oq+ ��@:ir�#\}`��� �.� ��,Pcos:���������+1�rZ {����fn�6/��B#w� �C�ȸ~��lw҅)��a|�` :��Vg� d_Dr�� ����.>����ۡ0g:��ۃ�:fN�V�@ PX��SA2�f�I�������N����̹����"[��Ĥ��w��4]����lV#�֨WTC}a��x���Q�)�o��#�D��7�������Ⱥ�A���v���!�F`�^-c�7I�����v�xw�JWd7���7�����>p��N�8�_)̃µxqV>I��8ٗ�ˀ> ��"rܽv�$�Ur�4�vl0����<�Raj�)jM����> ��#����YV�����`|�u<9��-ʇ�-�= ði�8��v�x t�N�����DF�z���}�on�<NBI����%�� w��`�����"�������:3����9����G���ʝ�^&��I�#ݎf���+����a*�t4�un�J��I�������aZ���{Ec�OQ%�q��O���Q�n�Ǜt��R�<��+�698ڛ������Ew�ho��kE� �����s�:���� ��˚խ������ ^(���齷����q!tx����빐o��A0�P{ZF&0�o� �6�8���^#|])�s�l���,Z��)`���?�$�ʆK/�U��D�L���~Ed��g����]ו��W����͉f8�B�E� �}2K��m�I��ZZC��\�n�\83�J��h+����ϑV8�s�2aW�K7��r��!7�_5����B�)��Z���4���q���/`7���Õ��#4`/��b��q����.�H�������@�`�{���.��o*@����C�����ű�k�H�ϱ��I4��S>���u�hnt9Q�e���`ΐ;�5���v���Ę���F��̥'��F�cӑTUo�n���\�8YҦ#�l��_���T@�pX��&DX�b�A�oN�P�V7�%����a�Cb�����:ɟ�H�6�2��G�� �I�0uϾA��5���r�g�AIK���1�We'yn� #��I�ȼ���¡~Ǡ���Z�i8�FKGxFx��mH��l/��I�~�5�mU�-Qtp�9���'l�>��߱M���W�3��(��sD��l�0F!��3���1�g0,t^5.��'�����^��^%�Uy`R�+oq�H?'�/��Y�E,w����v7c��ˏB�d\X�%77^Y�����GyeI����%%)�v��;,ȢFE�両ޑ� 6-]3J�w�,+ocs���e����8�~��FC�z���Q��m�f��=lZ��a]�pV��,`ub��L���1�'�>]+�۲���Ot�T�<'�uэ�z�֒i�".�d`�J�R��Lܰ�]I�{�<ܥ� �甼>�.�Jd"��.w��z���Ecb �ހup*��{�ة�%kD2͋���}g��)�����:���f���1�i����G�^�P{L1?g DzOL�d4�q8�▋e**?�<Z�/,����.�+��@�Z*�r���7G�G
Static task
static1
Behavioral task
behavioral1
Sample
578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55.dll
Resource
win10v2004-20230703-en
General
-
Target
578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55
-
Size
5.3MB
-
MD5
b1adddf62298abb32d516c4e85ff98d8
-
SHA1
3109afbb2043d66404188af5a9f723be2e85a464
-
SHA256
578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55
-
SHA512
7c58a32ae6ce9c7cc5fac6eaa0db818b663ff74a316a9199c7b29130adde7af207b1f48268f0db924401e9d02a765c164f0f638f10650f3e7df02cc937b99aa6
-
SSDEEP
98304:HYpcg2OJU28ncMsS8NfI5PBheVA+gp3BYgcBJ8hdI9P7faX7q1fr:HYeUJWcM5CfQPR+gp3BYfBJ8hKfarQf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55
Files
-
578d5f86b2610e8c553b07db5a0e2f8ac6f6482fda117ea7f64a9d4fdf119e55.dll windows x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.9H9L9T9 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9H9L9T9 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ