z����\��y����U��8ꮠ6l���YL�[�?�a�=��_�ͭ�c��=���^��� ���{�c]K)����mz�Qa1���uGC������,R�J��� �"T�&fg� �� -�!��H����Q��+�dd�.V�H.�*����=l@ʿ\�� ʘ�{E�Ծi�Spjm�Er��K���^|åw���6��L5q��_7��^l��ᲇ��}Z*+�����I�!��D���2���s�Y(����ɂ�iuqdp����Up���C�Nfȏ�E�Z�ŧ��(������S,���hf�SE�@��zW���r5�c��X��)�w��)f.�"���j���x��jp%��%���7C����cA�e%M��w��R[�Q�� 8G8!��͞o����y���C�O�Hl�>e���~��|�INR����)ʧ���S����#̕ *�9c�ȵ_��f�>=ɳ��S��0�@K��]ď��=��٨�V$�ؓ����ݔ�;-�mK�[�X�n��m�}�Po�N�_R'F���t��>����hJ-0H0#D����HGlg�Hu��! V_��R���<"�t��eCxHq�&�\õn1�����h]�s�T���7&�Ľ��.]F��ӈo��C-{/$�S�XH�?|t��48���'��S�G1�Bb0|Tb��5I���:��Dd.=-��1G��>e$l�+�d[���~�~����%�X(bFL�%�,ۣF�WT�IEN�P��"rR�p��cm`<M��&��:+�����h��,1���&K���#Rӻ��T���+�A�C�q�j��Y:��mw�l�����9�<q���t+��-X��u{��nl\)�������uۃp}�*�����L�CN��ߙ���EW노�,x)~u ��"d���W7N�vŊP�Di u�R�LT�e�������a�J�������P~�"7���hށ�������(�/����G������~fC|�!�[+���A�4J6�����~'+����s ��e����bt^(�X����Nܥ��p� ��a��{|��"��|~���K��c�f�O�cr��1 h��PΣ�@E����RS���w�}��AӒԾNK��v�d��2���J+��y��F>������G��Ck�'DJ5`������#b�c����gS8�l���J��]������0�_r�8n"�f��ɯȴ�f�w NP) ���̓ #�)�s������f�d��1��3�\n�Zn�+�Ml>1����\�<G^��Y�7^T>��v1}�]NSM���)�)����[I�b��e��أ�ҥo�g� ,6����u˺=�5"���>SH������D=[��pA�29J�3��Ŗ����R���C��}G�iBi��; �"��ԠyL���y��l$\ϵ�)]��x�ƏP ��|Q���8��`�K��Q��e4`��rH�>��Z�s�E�p��-�8�7��5Y�&�yrѿ$6+�N�f�[��s�_T��M� `!/7?�s�l"�g��.X�7��_�I�����-�k�M7���vrF}�]O�`-��������>8�sn�W��벙@� �j'��(��7��.�/��y�T�q�ˬh��'��s逊1�>GK�|yExL��>8l�帨�8�x.�����kU>��h�y�����%�ҝ���U��#i�5�|~� �#+��)�P��k�"�6|ǵl�ĨP~��PE��ubd���M��[s��1$b�$-}��z����}���&��pU�eb��6�v+A�ӊ#�(��������jT>%6.ƀ0�\?��տ��ƥν��>�j���s#:ׁv�q���W��W�����2��A�%^<�|����pdi�Eq�C�����,��~MƖ�����1���{�;hn|~Gu҆y�e0������6�l����ҧ�*�f�(��.�}XVΘd%�W{`l/��V� ��3�s)�uX� Gy5��&����]�ׂw4Z��<�!0�z\��oX�2��_�F#�/5Yb���Ny�|�ޗ68j~V����H6�P/�A�~@�*0���بz���c�W+<�^�t�E�����v>��%�b����>ޒ�9�}���s�n&�XR��c*�p%%���4Ь������{���@6Kk��7�a��"F��.څ�,��t�%�,2��ƼT7�Q@�գ3s��2�m+ �s{�"э�\Ub��ɣ�R`���Ū���m'3���������m�s������(������k����cA%�p;��W�.W��d�׀^�q�����f�y���O �oeHz�6N��k̚��Y����$1��&t!j��խ�����A<�K�,�;MjI1�xsl��Q�d1Z9Mv7p��)�[�nS*�__AcM�{aA���9>��\��U~���ˉ��49�MF� ����d��1�̂Q�p��-l[��4��J)�[��ΰ��W@���BY�f��Y��d��!�5�~N��^Ծ�)J,��)٦�Of֣�A{V#G���������tLf���o�wk��>攇��u��.�j�g>�:�%�F�xZ�����R��9�w9+�fw�h�#ԍ��@��*���72X��SF;��/�������ҕp��ˬ9���Y�LZM�a��u��J*E�Ltq�l���Pi���OBɋo���C�jX��3ҵ�b��ǖ)9�X����όy�((�G ��6���q��hC3V8X���SߚG� X/��.����"x�i����`��}y�"������k #��N�U:�cW��Ã���} M�����g������m����D�sM=�TT�y ��[�HSaNƢG���oW<�C,�o�d�6�2�&�vl(ܿ/���4�g����ָ̋��J���w{A~��=F]/�Z� k�\G5R�����g�V������~�y��İy���\^��#�n�;��к7ZT�$~2H�3m%����A��Q=O��Q7<ʓ���Nڻ�����:+i��k��"�b�7<��D���%�1�I�H�@
Static task
static1
Behavioral task
behavioral1
Sample
0ba096bea0df10a6d0f205c4468e0940.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0ba096bea0df10a6d0f205c4468e0940.dll
Resource
win10v2004-20231215-en
General
-
Target
0ba096bea0df10a6d0f205c4468e0940
-
Size
208KB
-
MD5
0ba096bea0df10a6d0f205c4468e0940
-
SHA1
e477d6eac87e84184fc8ea693ba33e9e1f50f296
-
SHA256
f8fa3aa29e860fbad543e23bd7768cd84d55b98a4ed3d6e1c1aeb553c9cc6c3c
-
SHA512
ad50dda2926591b17bc87356ade53051c1e507f5b5f4659a2beff01abbcef073f658449664f3bc9302b2efc7b0d6809f4985091a1e1af10f8b38010561126e8d
-
SSDEEP
6144:Li7BumL2DvBkVI5mPETLnO6wmRICv7gNwd:27Bum8uVTPETzOBmpv7g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ba096bea0df10a6d0f205c4468e0940
Files
-
0ba096bea0df10a6d0f205c4468e0940.dll windows:4 windows x86 arch:x86
9e72c3cc338867876ee2364481b9a74f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ffff.vmp Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ffff.vmp Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ