A ���c��K C��q�}�a0,T�G� ~认;ӵu>�}�h�R,=�Hl�"�SR�}���V����;6D���� g�l�S�z���� ��T���*ɟ��y�;��`�;k�����he��d�~R��r���'R�Ə���-��àJ���r}t�R5e)���UX{e��l�^�[L��H{����0:����>m+L��U��|�d`��'g��N��s����~�[���{����l2<��L�`���;�-�q��w����4�{���4U}V���o�.F�B`~Bs3�N�59 �>{6���Aѡ|w��El+V�Ќ�TW_Ԁٞի������j�Pto5�c��焔79f��g7�s?N�!���\�JH� ���<daO:�� E�w���n�NfH�}��Xc2���Hцb���(>d������/��K�~�L{+��oc�^;�����Hd���N#0wn���_Us��S��xG�U��a7��o�����&��� ����uvs�2���Ѻ�%���C,����BX�.~�º��� e�Y |��Vg_V����Qrb�� �ʼ[1��E�3�$<v�"�a��e��Gzaj�B���%A���� JVM>-Q�À��+&ӡ�B�v� ���jU=slE%uW"���s߸��9��-ݦ�cG@ �G��J�"�*��a� �낿Ҷi�3a2l��DZv*��<��u(���YŰA7�a����IkH�-�T�cB�X���R�a�'��:ұ,,7��fcv��>%^������P�h��0t��^:����@���Q��4�U��l�� q���L�^��̪�˒̷����s��D3M�1<C I��]g�7��׳����<�w����Jz�WN2�\�T~�b/@N3"c�n��]��rQ5�tKo&?7�%5E�4g7�hЌ� 02�6�=u��w���Sqz@�n���b���8����g0��B��1&�p���W�6�]�!$��8���u�����^���tU���J֩ae�����! f��Ҍ���{"��H5���4�\gF*br!��y�B��C$6���s�n~�\���8 v�JI�H�Ec�tCz{�L���,�2ڒј�0�I(����",�P�F:��U���^dA�n�v<��`��u��_Ê�B�1g=�x��Q�iѼ�/ѠKa\q��C�(�!�0��y:�1f�*M��m����C���%P3��i�1�|��7r"�nS�� /�/�~����e��K��yP����x��/��s�Ri� ��{�¤z�Q��F���x���CUs$���z�b��[�ZX�!AZ���9I������� �XiV�(��c�\Y)��N,Y�+��&�� Y��F DP3T�����ݴpΤ�� ai:�/Qp*��&�-���%�cLY���[O�vb��WfgF���MB;,��B�]�T����9�25�dذ�_�w݄|͆��l�j�ݙ���вEy�d�Ͼ�gs>S< ����m�Ͷv�$��B���&<���WNo�$E Dg��DQ ��F�(N�:��k��� �|���a�M!��K�/Z��ۜC�!O�#��r�� )�N�8>��"-�S�����"�Oh��8��^w��u^S�g�v��G�%E��f��H�XZ���!A��Ɣ�̯�|�"�̬}s�]�*���<��F�eYڽ�b~d.��w���?]�P�;�i��(���FŤr�%l�Ad\�5r���ɽ�0h�d�܄�6��N���{��b����A瓁L�f��w͈��M$Y� 5�U*� ���HF�RN^o`�O�0b�R�,����rT����}�tT����V��V���VJ����&,������4!�UR��$?����i�6�Ma1�HBN85��[H���u��k:� C�0��e�B�A^�뗻�t�� "�"W;���B2�Et/�(��J)D~kS�<c=�c�@VYl������O�+��Dlr��纓8 ީ����+T�+�%�K[�G]ɖR�#��e�BT�e[u��hGc�S�7e���y{�U!Sɂ�~A��j�Xײ��?���� ���ZS�%�D�� �"��ͱ��AD/5s� PKW��s�G�2�囧c��B^/鷂:Xb��Bi�I8���e�.0A�]�x��o�P��d�Ih��ԙU1UO ��Y��07��&A'�|�Üꍅh�fg�J�I|#��b���%"7�����[�j7ܭ�>�{ǽ� ���P���>]e-�-I5�Y�3ҭ\�H�Z��99�ԒI��s�y4��O�a4����3\H\+g|p��1eդ���i��o� &�&����z�!�{�J���F����h��cO���ߒ͚���)5� k��Q��g����&����NX H{�3���-p3md�������� g9����m�+~���Y��m$d2�B��;����[CXH6 j[�w��� ��Ɋt� �D�������_ST�Z�)s��1wA'��\�ʹ~7K��ܫ��Y�.'3��P� ~���XN�������u�����ş��� ��B��)$���뛌�"�� `B�3����P.jO�s�Wt �I��ˏ�1�j�:�I~��ڮ��&��� �:�XWtɞH<���+�s;�t�Z{!��` �,ǫ;&�8e�R�����O/7�!�BR�(��S�#����QM�F��o:���vc'���"x��ʿ�`��PV\@δ�*�%.wF_!&h��Y� '� v��g��r�,������,a�űiVl&()� Z������N9��8��Gn{�U�0������\��X���5��OXԼ�����ȫ�������$hTk����6g���d�柁TV�Z�Q����qf!�Fv9�|�����F�w��g�6�`��i�����5��A�ƎV��^�p�^et��3Aa�l�;�K�ѩ��1�� ��BU1��f�@os�$�����_,��c�3KG�\e'��z�>�*y���+Qc�R;l\�.B��ϟن���9��a)�n�A�S��V�TL�H�f�u{����^?%va��s}��������Y
Static task
static1
Behavioral task
behavioral1
Sample
5486daf94466e882911b5bbde7fc8a77.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5486daf94466e882911b5bbde7fc8a77.dll
Resource
win10v2004-20231222-en
General
-
Target
5486daf94466e882911b5bbde7fc8a77
-
Size
626KB
-
MD5
5486daf94466e882911b5bbde7fc8a77
-
SHA1
b72f153ed6862d0fa20b064f57178e986e8adbbf
-
SHA256
6fe777cd76436a677c9af9862b4f146b288314ec494ede1326444f3ac6848131
-
SHA512
fb1a5f3d2cc7374870f2ba9f183e6263b23d020231f154051b6d733238d65c9e0d5d417b19a691edf85a6c0c5a03f07886876ded5e8bfc4c6611c09aa2f3face
-
SSDEEP
12288:b8/3QQNdejuFf1NlEfYawgSXwvEu/IdhNGQ/y8BTkEgers9:O31RvNyYaHSXwvEu8hY8BTk+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5486daf94466e882911b5bbde7fc8a77
Files
-
5486daf94466e882911b5bbde7fc8a77.dll windows:5 windows x86 arch:x86
058bb1f2dcc7f9a4c2fdd23557fdd2ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
keybd_event
gdi32
DeleteObject
advapi32
RegOpenKeyA
shell32
ShellExecuteA
msvcr90
_lock
msvcp90
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
d3d9
Direct3DCreate9
winmm
sndPlaySoundA
wininet
InternetOpenA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 249KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 623KB - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ