�����ꦑ��d��+��D4Xf�6CFU��0����}����|-��� ?�=�����a�ɿf��y%�9���$���NM�/�&��3@:W1 dS-n�I<���L�!o�`\R9Ex�M���x�;����-�B%/��O���r��U���"B���G�����ś����}���ٖ�ޚ�rx��+��V%R���^����`M��~��N�uԓ�s�yM(@�d��㝎��xs�!aƵy�5ax��$�h&�����_z�|���(���W�3�/����?� �S�g.~��{�� *��.��c$�bV��F;*����!� �'�P�����OJe����jK-��攰1|6�-�/@�Dz�Y&A'=��nNA�����L�<@�ݰ�zj�<�|G-��BU���-�H��-C`�!'��hJ��F�������o���Sp�%�e�@����+�?ia���)����F��k@��3���}V��/��9�1(���7��w���/�>���F��5� nkL/�M�إ.σk���$`K�@(cK#�����Z���S�Y��K3��9��A*qo옛J���6���9_8��L���4d�sg�u|��@Jl���9�D���[�P1H�E2���5~ ˻��n"ȹ1r�ˈI����H�LI�$�OVh�鸗,ذ{�壤|��1J��ϘI���w��4�G�7^wʩ��=����|��������s���H&@r>r}�&�}0���℟Q "�"�~�E]��ڸ�����o�0�ܵ�S�����S�iB�g�u�[��Ƚ�#���0��`����r�T�Iw�N^�P�*��簏M������:o�r.�����Q��p~�x!�?��S��,������|M��mP��n֑�o�ز�?�F��L�N3�ג�#F�qMKB�;C���%Z���z}�K9cL~"����>�РIk2�a�1�o$�����wM[EmZ]����5�2�����U���viDo8�B̑v+,�v:����g�v���S���Ə�s}W�%f殧3�?� s��E��ޝ(4V�H�H�����ӝ�Ү���kK��pIjC����˲�t Q�3��c8꤂�c�LO��SF4��:�l-�K��y6D��d�V[0Vۡ��d����9�oXe��� 7�-��%M�ڝ���� ��!����$��ĵF,������ �� k���j*�Q~�����zX���#�ӷ-���}�1��<�K��N_�?ѝ�JgșA-k�4eZ�*�Jy���k�>Q%e�i� x��',�4,-�)pv-�4�`p͕���M���B��!��_Jf�t#�� P���a��Qw��ł�+^�x�0i ���F�38ame��4T��i{%;Tl��ʛ��z�q�'�W�D� j��Ԏ�Yi��ZT�)m}^y2w���h����+��?5B���z����@n�c��[.g�g'���e�bH(������"�^%�B)�]8�@�r̽��v��|q�ł<J)1v��4^�\RV�u��}�=�N�YEz�ɥ������/#\sK~�=nx�dH^��K��lQ`�߀��ў�$����}�9���-�'����^�q�T�O����7k�b`���,��B�!��O��?��~�*��J�����8�k��3��=>����6gO����6<��c�Y�m�I�K4%~pf�{�pD�x��%`�̵�9i3�'�"ДS7e�'Q�l��O*��/�)�ÈP8N%6@#����9~���vk̘ �U���3�6U$�Lnj�,��Ci�#?��T���w#3��ag ����I1��I����S� ���4��T�o���KC�w��@?x�ŀ9�� �ȫ~"ɭ+~���nj�����n\�������k��ŻKY����G�?�����EI k!�a\'�0�����Sl��4�Dϭ�������� g�? ������q`��c�����v�~g��&�d�o��C�� CS{�k�>_�l����F� @L���vo�㓘νhL{��c���m7��tЩ������� �������e ��B������O�ۘ�}������'�f䇸��Z��X|M�ͶB�X�&��s�M䤱k[���O�z�����S���)�кCLc��p���:����"�����ŕ�2��0�����J�s�1��a��.�e3l����'���*m�z>�M�U��r_��QW �ַ]��bGe��rA��<�h=��g�qM��� k�r2.њ'7z��G��y#��ǚ����������d4����ƛ��J����Y�ӝ���K���R����Dfq{��+��)Q�Ÿ�O��mFyD>H�l1e�M�P���T7�2��{mt�[��e��I&Q=I�7=c;�1R� �g���::{�R��)h�(���G`9�d0��D�xV���1�����Y��z���A�'j��C|��-�U� ����G2����� VT�%ms�<s1��oN`N�J���o�m���Γ�A"6�Q�IȲ}��j���@~Qv��� �\2mQ����(0�Q�t�z��J��ꖙ!f��c�����*�矨�R�w�a��/r�]6�=o�6�Ẏ�#� ��Ђ憍s����u�p\Gy���x^U{y f�F�A��ӈ��������������D����|yϽp`�l��I���� ��5��Az�:����Xv�d~Đ�wb��5��lUYv�3;��a�?`"�j蝀'�i+� �0Rx���9֘<� no�_ީ�<ڳ]���;��G���$���F]X����i��j���Ϭ�q��ʲf7�j+��)��P?%uCQFLx�~`�1� ���>lw�dW��"�.���>�� ���P�8�3�tmd�7$��q�^��m%�rKu��˰7���Æz���%��n5���_����V���GEx�"�z���p�@s�w�r�B 8TZ�"�GZ&��Cmu����8SZj�d%�ߛ��p��0,B=cQЃ����-S�=���08��
Static task
static1
Behavioral task
behavioral1
Sample
6c64849fb5f579e7e711399d5233dbd3.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6c64849fb5f579e7e711399d5233dbd3.dll
Resource
win10v2004-20231222-en
General
-
Target
6c64849fb5f579e7e711399d5233dbd3
-
Size
1.0MB
-
MD5
6c64849fb5f579e7e711399d5233dbd3
-
SHA1
22ca7bc9fa1dc4c31fa58f629884374cc4ec963e
-
SHA256
642f143b4f23135bfebcf6969fd7ded2d830a2ecb9c985712717ff0a1b4316ae
-
SHA512
296be93f5ec85a24e5414081a84b2740abd76742814700dcd7f8e9c45efa9aacc673e2760653765124ec22b3d0d6c8edb09c0b3fd619b02659e48532553a48a3
-
SSDEEP
24576:85igQymmvl0SfxNCRJ6bRAoj4TwD7Txap8YvwmLipvqYokJDYQyOEsT9YlfS:8MSvlzGJmRN4Tw/NaZwTvq9kaSEf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c64849fb5f579e7e711399d5233dbd3
Files
-
6c64849fb5f579e7e711399d5233dbd3.dll windows:4 windows x86 arch:x86
1d9059ffc1f4de71e9d047bdeb860223
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
MulDiv
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuStringA
advapi32
RegCloseKey
oleaut32
SysReAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
SetDIBColorTable
ole32
IsEqualGUID
comctl32
ImageList_BeginDrag
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 381KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 460KB - Virtual size: 459KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ