h��V�X�����g����d%�k0��K}�|d]FWԃ�Y(P+و��R|��j�k�AZ��Q='b_�l����*Y����� ���W�&��U��o�cMҍ��� ���x,D��u�0lک)`R���/+6�\���V�!QĹC M*���|�A�R�(f6I�(��wHz��r>�~�-=��y����p����L�0Z�خ�՜:���^0��e�V�]R����PZiz ~.y�+KG��n���X�P�Jԋ#�z*�����q���&'j���PE�� 3@�>I~�L�7:������r)������7���Ge���8�Y�kl��#�cAi0oU��V e�<���MX|�)Xڋ�BmC4JZ�V�Q߰]�f����0X���Jk_�� ��^�����FK�`Uu;7�+����e���em���Wqa�}��������NRIۓه.�Vy,��*8�����y��[e�dDZ�[�H���$��>�`�9�5���ř���LQ_<����U ���]DL��ạj0w���@$�I�ؓ��m�n�4�lP,�Xf�7��B�eHM��g1Ҙo;�ѥ�:Ae�:�q:^������f � �f1�:� �t%����.H�����(Cr�$|��F���'B��ׂ-���<��A�7�]��I������0�5 ֊����;�I�0$8$`���a���r�o֣(��m�%bX��*�Soӈ���L�#�=��D��b�+�ݨ�q ���9{=��+��*��d��5���F\�eOp��ҫO>mk/������=ߖ���D�*᭷/����0F�n��C��7��WScS�-_)�D�|k��/@D�wᛩ_���?{_�5��G��j�b����+����4�[S��1_E�ۭ��/�����E��/4�|.�OZ]�i]��M��M+���>%4�6*�a�ԬK� ������ob� q�,�]�MHW3I�>o��b��ƓȵE`��Ga&�ܘ "C�n�����R��oQ]|�?���^�ѯ�O�RY�H������S�[W�?�����H�����L���YA�%AWȑ_��F��%AU�������g~��2J�}���A�Ac��Ad�&�$����_hRPe��IP /����/��vã�'�h�ȸ�,.xuD8�N�.��d��7u.m�����B�A��#<=(�}yz�L!����SK̢Y���o�6|��.�6SJ|��I��_N�4���S6:A�߂y���o��2���竷J��R����j���A�� �A�֯�Ui���ZI�Gu��x9�j�ܹ�[Ѝʑ�SM����P_ߘ_G������[H-,��eApo<ŧ���Em���oF���ݐ)���<�J2��4QMh@��g�+���5t�&�%{�J돆F.�S�¾%�F��)�{�p+=d!�İ��z�-�kHm�sk8`0�8���t~x-�FO�3`��|��h�����(r?�I!|�Ʋ���J�&�.m���c�iq���{�OFdS�m4�H@&����\�M$�8M��gu+�*f-`��J��ĩ���ŏ�Omfs��К��Wْ�~�\��BC�GP�W����u�H!�T�K�*��s�7���Z��2O�r�=��(�&����_Gꄢ*U��U2@{�8�FHD�@)���1r�[?�I��rS���ъW�Yn9h�^�,�VU�v��hA;)�!�*�O�F�>[Xo^}Ϻ~���B�DGဏ@�5ތ+��+�O�/Lmv�4=�)9T�5�lS�����v�t��'��Um��>&e[\�4Y慕t{Y�Sl���{�O����A��ֻ�h�����(��Z�B��ed��K�hq X�>�R�_r��K=��y�kV��/�<Zj���X����"�Є��jX+A����r�3���U�*~�����#o�\��J�� ݕ᪭dq��3h�6�0�������߈´+!�W+�BilGf�pi���ǜ��k %�%�*'7zq�Ϳ������P��kdšaJSl)���yf m���� d#O�.Q��z�z$��~�s2a y�L7�L.����u/��'�!���Y���6�鉎?������+�ީ"Q%�&�G�7� y�2��GD��`z5����G,1�u$��&4���(Ε�vl{T�dm�S �n�P���}�N�k\�S����SQz��]*������ծ�Iu72��܁�D����e��rM��5�()�����ꮔ�r��x���zQFw�| ��[.��A�Cl&JQ�S΅�U��!��hi�m]����L�`�9:����ox�9u���H���X"!�1��Zdz�s��� "^��o�A����"�����[d6�ØHe�^� iQ��b݈�Ő�+���.?����wϘ�Vw(���Aj�oӏ�|��s�9P��g�'|���(���. Fi���.�L��e�㞐t�:vutFn����s�Wĭly���.p�$�^�B@���ߝ�YZP�:���lѕ�l�ql 58�, ?����c��rg�Am�1����I�%{Qh96��v�H�W�ж����<��H4��Z��xGf]Ȃ>����;�6����ԹV2�o�aa�E�l��kG���� @�q�c�9�C~���T ��D�P1bhR���=V����T�� ��e�j�-�(��̺W����5��)�߳�N7��T�v�L&�������yD0�ψY��*6��o��g����Dت����S�zE��/��2��S~ß�v�[��<C�Vbg=��5)���c� �~�W֑�ER�\{x�3=C�>�/�og9κ�tގ�6���.�|� ��%�P��5�3MH�H�u�,Z� ��+(��HP�n0�TZ��ꏺ֮H��*xt�!�m�]�2O��JT�پ�(��^l��pH��H���2X�.�6��m.��nܞ����BpD�pJ|v/��+]�[*�p.��P�sX3rSc�7gXD����ȌV�md�^�\0�ZgČ���1��7t��Nz���9p�.�b?�� ���"*��n/�g��cⳳ��z����;D(|f�lE8���
Static task
static1
Behavioral task
behavioral1
Sample
4a10c8fc000034327aff82493bb388d2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a10c8fc000034327aff82493bb388d2.dll
Resource
win10v2004-20231215-en
General
-
Target
4a10c8fc000034327aff82493bb388d2
-
Size
141KB
-
MD5
4a10c8fc000034327aff82493bb388d2
-
SHA1
c57dc939da5c69bc8d21f0a5a965d5a19b97f07c
-
SHA256
7979d06b66e81495ff9ebe13f0352064ec1d89eebb4db1c9bad22ce5599c9526
-
SHA512
fa9f6e65c48ca37880dc8aeb6b67d708d374d59fadfc8002354656e5c4fef54d3c287b8177cd809dfb0b85ddf206f56f9e1eeb949c77b945aace090c2c4dead8
-
SSDEEP
3072:iNU0F1ut8uT54hRyrH0WwBMZQoVIdV1jL/:QU0F1u+uanhBMZe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a10c8fc000034327aff82493bb388d2
Files
-
4a10c8fc000034327aff82493bb388d2.dll windows:5 windows x86 arch:x86
077efa99aeef85ec192fad0ee144d524
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
UnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowW
msvcr90
memcpy
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 458B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ