��I~���{<RW���sҒ��S$�_��oq;dd��H�;�Қ�'?��/2�! �Z�o2c�3(�E'����+#�)�Fo�_ѴF��0w��C�kѸ��Z���3���؍c��g��3�ݻ<���&�����Z`�AP�tC$ ��]�r�pb)E���ˣ�3?��H��q��� ������Ϻ��c��0k�p�5�Շn^i ���@�9��_8G��Mu�%*���oL/��.�jG�lٻ��x I���ք�����J��ў�B����J�݈ �_��ߨ����^F��������'9F���T�炨<j����/6?bX&�����T���j�@ �9y22������-[R�'���mF&�7VHR����$�?GM��0��+1��_�v��Tk���2R�[����BY����z���Xl z����ìt���(Ƶ�:-�*T-I@��h����d uZX����O�.`ݴ���e����bR�r��@F1�+�߬7���,�4� e��j̑�ƨ�Luԉ l���Mo�{\e�� ��R�����n37����}�t��V�����g'y�?wSA��x�{���T \����,���q��%H�$��,EJ�������T^1�{�?�N�ĭ�W ���$>�uT��Nޏ�2���6�+e���6��]ov��[V��آj������H�rj�E*�hV�96����O����MF)��/_��?����}^F�@\&�H�/}���I�x�0=͟l����%�S<�}�J��d��ܤ��e���ur)=�k1sI��z�P[�U�\\�L%M�O�y�cd���]3r����^���'c�p�*D��l�p��\�ܮ��h}��2����1`-CZ��W�ƾ~���(g�#[^�*Zw�4=m+͞�.+�ei�z��6R�>K�A^���<�� `�|���"��Bp@��"��H��=����Y5��Ți��JY����E��� �����tU����k��״�ȡ;��%�b�>�*yF���hG�G0o������F ��>I��������]��dۜ���0 �6!��ɜ�" e���Y���s�D��^��e�*��ε�2���ի��oV`�?���^�\����GY�C�xl����0Ϋ�y��� ��3ֆ�*��o���nH���V7I��m��>ĝJ��V�ss��dI�P�R/<'Ɨ���n���IWy�t<��FEd�cv���7X%k��)���zϬv �O���"���D9�7!�)[��^��:�6Z xؑ���3zPq�~�!m��>��͓\�5v[)�}��e_A���gw��e�Պ�de;i��@�Τ�e�о� �8E���5�"���0 �������!�E�B(�חLm��A�}��� �=�!�W�i����m9��a�C�N�=r���X��������ӽ}W%ciD��fa!�^�����TT �⭌����^��6f�|*K=�ܯl���E��Ô����K1#(�#�C�̡,�/�y�E����!$�d��p�w0#m ���ٔH��P#����?C �X�� ��4�#}��2��H�'������/��9a�#��F�I���[U�p��̢�s�sף#��~�;Vbn�[K��t>Q^�����3@x07�����͠��(Pf ��ϥc̿�z�a��<TvcB��Q?雤3�������!�9?\种�ҙl�9�8U��uE�ķvM�I�\�Mr`��)b��ݮtN�o��\+��w����rA�(����0>�Ȣ '-n���VAb�E���sB ^'���z�"�MyW�lH�d� �L|!��A���Cu}O�@i��"�a�BO��� ��n�P��j��1�Q���\��� ���}�)�w��N����ܯ��"�P��T`���� �+��M ELas�V�5 547V�>LW'Οn7�=���M��%i�ڏ���6t8o���P�ջ����`RH\�*���-+�K��ͨ�u��S�h��kD�@��Y�ɤN�F�9*�遀u��F���8������uY���!������҂T��`��ƺ%�C��L�+`��n�07��X�wNv �;�h�{++�3����d�ٳ��Y�T������=�]��T����Zd7.P�u����/�xr��j ����?��EC��'I�Ԣ���̯);�.� ��Rwl�x��~����*����)�ٷ(RU(�h\��'��)g��O��Dp�ˬzuX7� oԩ8�Mt ���M�l���2��w�ҭLn� �: -l��?_<R��Cs �-B��%�:0"�D��4"<b�c�z���'�C=�9�����>i�e��۫���[��j�>�?�*l��5�ߑ�"'�@z��|��|�Aܙ���@2 H+���������) 1\��w��;0צ�y����6SCڱ'� �������x��(eU��ļ�tƬ| *��ї$Re�����n5���Ţ��[�����w����L�t�Z���{�@��a�0�d w���8�#�B/uF5*2�2�=����d�������Ckn�yoa����i�ʓ�,��U �y/���5�}N�T���c�j���o��Btr�[����%OKy��/q=�� ��?9���;x~���A\ĭ�w�{l'��� �~�����f��қ�A;R����JpU7)���R�D�(��̓}ڶ�k�6:������w�M�a�A �f� �M��E�[�#�{��$�ˬ�j�͏��b%I\irw/��z�D�ti�X���}��Y����gi-7@k:�9��`��YV12i��M�x���ed�a���HK/@�9�C� ��g�vꀋ?�C����)��� 0��o��ki�X��J����1��z�q�է��h;-�p"�A>�J hm7�{N�_>F`rP�ʠ"�����X�X��ԗ؞7���y���w�/˓� ��V�x�Ft�{>�ٲ�Gal���0���N�� hHx=(o��;�,|^�)o�~3�vA��?��Q� n�)y�/�pt�*0;fFv��
Static task
static1
Behavioral task
behavioral1
Sample
196290e7f5568a6d272958065046422b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
196290e7f5568a6d272958065046422b.dll
Resource
win10v2004-20231215-en
General
-
Target
196290e7f5568a6d272958065046422b
-
Size
588KB
-
MD5
196290e7f5568a6d272958065046422b
-
SHA1
93f49080c9299b73449e9d0f962f4a5f71f713fa
-
SHA256
e626409a2c4221b0094112650d99d41039ab4acb18e4ac88276b8ac8705cb389
-
SHA512
fb04dda5fc7e033bd17ba3c5cf327536b9f76c1c97aad6d83820f76060a05f5825718358bc6273e05bfc31aa9bef9b13352d99251107ec7398374cdd718fb40f
-
SSDEEP
12288:InJVz3gmHFstT8uW8TBAszqpBM5DyxXiFuUI253O:IDQEiguby7mlyZRR2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 196290e7f5568a6d272958065046422b
Files
-
196290e7f5568a6d272958065046422b.dll windows:4 windows x86 arch:x86
d2541651c265514bff46abcdf9be0062
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
sndPlaySoundA
kernel32
RtlUnwind
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
gdi32
Escape
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shlwapi
PathFindExtensionA
oleaut32
VariantChangeType
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.$0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.$1 Size: - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$2 Size: 568KB - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ