�?�C�;qd8`S>���N�=��}��1�P��#���9�˿t'%�v�����fv�kdk��ݸ8t�R��*��>"�ޅ����D����� p���J�I_��HC��13�9�0�!�闒����I5������%�鳛�pm]1-&�BQ���_Y=9`.dy���Mm���PN���H��f��j\���4�����s���v�w�=\�}��o94���v l��R݄Oӏ�7��'�)��q3��<=2����~-�)fZ��B�A~uv�6#�J~ĭ`_H�`�ctM9{Ҹ��Qy��u3&����f3�]Gس�&1���5cK�E/Nh>�쉆��P:I��HQ=n��������Q�<���傥�NO���t�*� ���"�W{]�c�~(c#KO�����?��k/N;��D�E�B�ӣ�f��}���hԏ8ժ�_R���ӐUA�Ș{��4�w-��u�3�ޒu���#�ROq3���<�'n��b���O4gEO⓴='�O���}�&ï��=�/�m�!�>n���bCo��%�`U!D�Sq��`���\��?e���c =��D�F�Ȅ^)Aۂ�����d�cr2Ӹ������eB�`"0 r�~�S~k3!>/$5��rY����M������<s�/9�0e=^� + Jcm czs�dv �oYH.������ɛOՉ��т���m�T���X�1/4�F�l���*x�V(m58Gq�3�g�G��j?�ΨSZ�m#4<������5���+o?I�_�&��_�Gk(ܮ'I�2�����)�/�OuR��{.�'���4_$I��'=Ο���?qm{�gC<�������H���O4��_D�3��[6�$"tYS)�/.M����|<����m���h(�������m�8#s�j��H�y��Tq���|���!VV�����?��q�$�F��qk�����#��a�^I����������C(!*�:c[K�x�5���x�����`�h�T��`��M�C�yl�i�k�3��Gv��ﶋK�"����3��*�z�lA@�9�ȏAo)��G��*�y��_U<=�jl����VͰm��J�0�t��}t�a�e�o�u�i�9��#=���k���GI��N|��&�_Hz��G�vXm��IV�� U+J�MJG�|�Uf���s{Dul1(f�}�{�2����;��ܸ]c�N���~�P��O8�e�������e��� H�w���88���[x�z�EUf\��r��+{����� �P��B-�,.��%���P5]�ȫ��J���*��d ���!X(��<K�8�!`�p%m�{�,j4 ���|.��c��\q��eP�6�&����+�Rh�������H�L�YO g�����rm�˸9���>�_�س�t�ۢ�·(�� X�/p�'���M��9l�# �jL�>jiT�-:*��b�*?�)kU>xʫ>Hh����ږ���O�ݑ�4)�o ��Q��$B�T*�τ���G@�0��:�ڤ�Q��2��ֲ���U���D��,�k4�M��u$�����R�p��i���s/Y[��»�!�w�IL�P���|�? Kkظi@?����vND3�23�D|�n�gR_���,"tqo�h5�i�����z{29�D����#+���5��R[�{�ځ��=�B�e�Ÿ�<P:�%��"��,"�S#�ߺ���aSf�[��zv��Ƚi3<����Ve�gM�i�6=����N�]��~����,O�n&��� ,�(��O:G��k���<��� B&�� �W��GnG�5���B8��A��1�/��X@04�)���8Ĕ�5Tt��E���'=���O�ˢ(}i�����1�>���.�õ)��rs�h��ـ��tA�p�NV ���V�1�@��J��V�d���s��6O�ZQ�S��w/Y�St3�E\�<l��0�������� M=7�U'����F�j�ءv�jn�+V{j[�onᵹΗ��r�=��w��zi_!mVg��J��$5��H��ΰ��W �4-�<ag#�\��V%���:�ܕd�c���[Kz+�A0tf���*DȊ�&(�&�����!��L|��Z��e��0j�@q����-��\��� �L��8X �î� ��(�$U�#�Q�� �y��?iH�����5����?(��49ǥfX��M�f2z6>�����͞��%x�rB�u�u�1�"?O5)A �a���Y�˧O| 5�f�X�qټ?|G��6��{Ů<��=�2Q�7P���|ws�P��{��ˢУ��C� �f���B���9����v�P�ڲ�v/M��MA(�b��v�g@T�ڮ+ �ϨF<�v )D8C����n�<�"�1*� ��W�[�1Nl� 3�{ͫQ�ԫ�<��������n����]*;�ʉ�X��RJ�y��>���a|*�K?���]���(��n nO�������o����2E6��5U������uO���ne��?9桛���_��^��+�=��p-��``@��;h�J�LjY@��b�H��� �,���v�9J�e��@c^iK�x���v�r'�E��sA�?Y&2�I���I�/�!���R��p3�/�Nu�2v�%_am�wXԩ�����<���(jW��?j�S���[����<x"+o(��3�1�d���4�4�}c�~ �O�UH�!Gf;s:ұ}��*�0�ӫ�q^,�o���%�#���+�����?7oQ�*���Vrl]���C�����en�鈵3ʗ����U)�o�.�%"�g�C���'���H�A����qs��8Q��_�s뙖� �G2�l�\ĚR��o��g�X��$� {uHqP���[t��-R�:G��������5n� ���7 �0P�hm�ü�:�:S'S��)�?it�'�"Jy�.�b�����nN`T�t�jBaԨʘEfvB��wnE�L_u��R�e��k��Z������g�Y��P����J��? J�����/V<�(�1�~m,8���^,��?�m���P�P;�Y� z�i��d*�|lu�"){
Static task
static1
Behavioral task
behavioral1
Sample
259db3ac2bf82eaa0d7767dd35860cb8.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
259db3ac2bf82eaa0d7767dd35860cb8.dll
Resource
win10v2004-20231215-en
General
-
Target
259db3ac2bf82eaa0d7767dd35860cb8
-
Size
569KB
-
MD5
259db3ac2bf82eaa0d7767dd35860cb8
-
SHA1
3755d96843b76d90590abd58a5a0a5784c7d8eae
-
SHA256
e135656d6b7ef7505f5570f934dd8bf8426e6590a0fdaf9d7d96b9ab5443601e
-
SHA512
9296c4769f587327731759e02a7363297356242939d3495cf097c9430d371459da96d51cb735217cb60188f33f4541cc23f861a713494d5118abc4e5231fc53c
-
SSDEEP
12288:ze5EaX2NnIe2g/lD7hI/aWS6ec/rZ01++TQvupjBd8TkJiwaPiW:C+aXwnIe2Yi/aWS6eKiTQ4BmTsaq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 259db3ac2bf82eaa0d7767dd35860cb8
Files
-
259db3ac2bf82eaa0d7767dd35860cb8.dll windows:5 windows x86 arch:x86
4839b2976a396e1e600da95e0769a2aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
MessageBoxA
gdi32
SetMapMode
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcr90
_initterm
msvcp90
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
winmm
sndPlaySoundA
wininet
InternetReadFile
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.asp0 Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.asp1 Size: - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp2 Size: 566KB - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ