*��zU�<�T`wb�;�0�KIz��cQ^Ԃ�#��r�j�z(m� ����F~���P������~�S�c��0 ��(j��]�[|#ߢ��=�Uԉ��[AQ�ʇ8puĪM�8,�P69���ῑ�c�To�RN#9U��z�3/��p��d�QN�>�����h�����q�������h�gO�R@(����%es(yV�����K���ᙚX�VB��<� �U :��8������EI���r��f�c�Iq���|�3�)��jX��)xB�%A��ж9�E�c |#0�V��U�R�f�S�^�e:+ZS���1#K�`]\:��)�Q6��W5u)�6BX�@���|l�e�K;m��9��鵸<X��� �� ��V�ӹ��h��"��&���]�?c��\"PF�A4�JI;�Nr�.1�L��x�@�{v`0.{��o�"�<Oe��<����Ȭ�6p?��� �>Njڤ���q�T���e��ԣ��8��aF@��#R3�#ՌR O�w�h��l�n��vc�u�Bb7�f1h���z��)�������&VHmř���dWԃI�t2#����]�D t��B�X>�dm��q�R@<|(���P>L�KW&���.��P3i\�����6gl��G�����/ɖ d[>x��Z��]u�?��>O���F�$�G�D���G�}�h�ஈ� ���gJ�g�q|C�����_C�����OL�4���u�Z۶H���$a����� ���*����R���ȃ �+&qx;\�6�MGz�J�{�ŃɁQqp����`�̆��%��gnM+���'�tIV[�3�`���sHoI�ʃ����>h��|�I���� �b�^G:k��Ӊl;]6����-&��0�l+'��T��9O}�/B�N�7:>�V�d-��B� -/vY�5�aC�j���h�c��;��~�*( +ҙ�!����S�=B�e&Ļ�y+tđ> B�O�.t�q��$ZD�:�v�c�"�+E������� ��1�!d����[j �]nF���d��z?�4���MY��)��y ��ekO3qJ��=�bq�!/��XA�� ���}{�\�h��_��0�]�չ���}��9�ͯ��. ��Vқ��I�����0Ө����V�7����AD��U٣O_�:��KrL�{�HX�}��N<�����"�U��� ]��$�Gͬ�E˛�C�b��ծ���ޡ��Z��o����)�c燍���*�Q%l<̽��I������V�Oj��f�o��R��zD��By���'��Mw���.rRD���@���"�LoC�l�ȝ���X�X<!e;�M��_�5�C�l8�YX}����X�E�͔BM-�ą���8�KH#lh��$w��ߝu�s�����n 6�G�t�U�u ao#�:o�D�o>È�c[�i>b'ᑺ?�ϩ�F|�GV&��i�ʏ��.(5qP1*�?�c(��Zw����L���1w'xi ��c�E~��8�@�^������� ��x]P�C_h��E���P���39F�<�'Y�jF�:��Pp�# Dw�ֵ��������|�H��D�wl��If�V��.��� ��P�u�BCi�*��r��2H���:q�w;=Y���UMc*�LV'n3��l�2}�Wm�[�3G������:�ه"��0,� ���fߌN�����$u$�<�}����E>�]�Y��9e*�GT�\o,>�厒 2G�h�< �?9�"1nm8�����da0���E�uB���L�[�c�K�5�(~+�_s��\_�1����0��+V�T%Y������uʐ!Y2$��M���� ��1?�|&���bi ��Ľw��]{�jg�����zg!i��U {��9z�ug۪�w,h���SP�?�{��Ү"�'�!�x9���H4���'g�������,yM�C>6���e�E��o��9?�ck�uE/uo��]�7����bA�Z�5����(��x�0���M��&���t����!=�4vX�Z�?D��,�GNc~�U�Bk�p�L��g�=�ny���º:l�����n�xƔy��V�'�A�������\"��Qf)���N�!�V�|� �s��~��]����I���Oĥg���e���u���G�?I��Z��";���鋆KHa.~�A?\�N��E�������#��W�c%A����x�����������]Pܪ`��o�ܐkBl��� �Y�w�a�I$��.%������h��k���E�S��d�p�- ޖ/�߮|�|r��wG%�,s;;�f,q �0+$Fw+kb�PŚc�''ț�j���5��kڧ�z�ۨ��R*�8�u?�@���dp.�R������ !)(�Y�����Qe�K.pZ�'�� �8W�9DcL�A�|��ꌌ|^Y}��q�7)ti�85 �.�>�� ��K<ȥl�:$&o���HV6�=ōU��2�Uv��E�5I{��N4�� {Dh�D��X��y�H���o�%0���Jg܊�8I$���3�a�8;G��r�dG-�C�B��ٱ�� 7��3�'�����,0ò~���N1?��� Ϛ���������z���Ɇ��4]���eAz�V�������������-�W� �{��8��Y�H�������V�WZn,A����((��(|����l�+�*�v�Y��\>5kz�4�9i���ܫ4��Pْ����=��,�Q?��9�O�Fg�7>G6JCoMg�� ^��h��F!�p2��w�Jv0��O������bd��,,K�co�S��# q5(�`��?��Ԓ4)�Iʉ����n�g ��� كg]T?����~�4�-�]�-���X-���$Eld��g I�<����h,�l{��-���z�!�NH�{���M�P��A�����:��g�o��ɉ(��~3��4V�fz5mRGt���}����˃HW��LN�PN����Iտ8 ���id�86�sQ��`�!�t�?f�����d����4ܵE����c8���2�������\�`�gⅲV�8g2G�d��|�b�K7�&�z�G��V�[ �Ӓ=uI����5}`yT��
Behavioral task
behavioral1
Sample
03f24c641687be97877bcc209aceadee.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03f24c641687be97877bcc209aceadee.dll
Resource
win10v2004-20231215-en
General
-
Target
03f24c641687be97877bcc209aceadee
-
Size
509KB
-
MD5
03f24c641687be97877bcc209aceadee
-
SHA1
fd14c16ef0a7870b45c1bd23431ebe7ca3736b69
-
SHA256
e837d69451547a9903d71b0b9e1d23741466d69657b86db10ce20ff2be0797d5
-
SHA512
45d0002eb16ca0d802a01887533fe63cf94b49e266596745f3a0eb4917e3e34c6aabfe63c00dfbfc1c6327e297a9d221b4b467809e26d99cc33b4262889f53e6
-
SSDEEP
12288:D/yXFAU6ldlGYACqm5b5tv7GWupG75xi6GZRk4x:DIFAU0d4YAzqn7GrpCxdwRk0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03f24c641687be97877bcc209aceadee
Files
-
03f24c641687be97877bcc209aceadee.dll windows:5 windows x86 arch:x86
db41aa5ad4626fcd29e5d0d0d1924ed5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
gdi32
SetTextAlign
advapi32
RegQueryValueExA
d3d9
Direct3DCreate9
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 1002KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 886KB - Virtual size: 886KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ