�]Fb�fw�����M�� ������r�8����Q�9��ɓ�����ȗ�dFS_H4N;��T��^�3�j��̇_��7�"��P��C�6�tX���8T�I�ټ%���l�e��{+��SW�� 8�y��B� ٔA�ځ��v�e¥�*f��c��;0�![�T���|�f�q��{���������vc\z\l�'b��H�y�q�4���g���g��6������K�ԯ kM%�ũH #ϻ�W��<\ӎV���5kD࢚\�Ԋ������5����mȴ��%�����F�����қ�����%c⛜Nv�@&El>��� sd�� u��E�zS�O�^I_)�����o��|��qa�T� P:�_�b��k�3���l�u�R�崱۳n���$�C )�����u̧��W�>�� ��%˛�7�M#^�Jg�&�ƝR�m�3�� %���[X��?� x��$2�T�H�^�@�%�g�TTG�z6�t2Ӫ��ܟ�`B��W���,r�$_H�������%�W�;�˸5��wo�v;�*��`��0����� J F,���{XM��D)��-0KA�ܻ����=Y�Y��E���R8a��[�d=\�y�K�G�{O�cs�Z�u�c��o��6�qT��*,� .B�5j鳄�իjd�7\@箑��d�$�R��V;+6������������im{�����c]�QuYfBO�xX�5��|�yr$�;�ɩ�$X3R9�M5�ӄj<�4��_��-�K���Szj�͇�2t�:�!|��~��P�8I �m6V�H��} ���Q k��5��y�����i͋<)Vʃ�𥖮y�(]���"��p��d������f��i� �s�&}�su� ���j R�y>�4RP�XF�#�ѷOo�����t.�vi�ze�(��U�r��Q���m�p�"⣦��ϴw�wVn�jJ7�A�?CMxSV��B���5q����/gS,5�E6�q��<�ebJ�M^��8+[HW/�Pl�U*\[YN���.t�Y���*��|��� ���Znj��7���~��feA�z*�`��s�Sk�Q�7��;wq�VU�,����Ѽ�F�/�3gӪ��X�� f�{~��u�%x!q�����h���1=j��PI����p������u�4r��l�C��g �Vc�\j�"���3mm�g[!.1�!Z��h:��wJ�41u������;5��BIs���~�}eS��1���u6h��d�3����_��fj����I��7w�vylX�-��Y�ȼ�$�[oc��!,�"t� ����VPku {�6�뫞��j z�G�����&�I�/����F���0����ir|���^�'����M�A:d��Eo��#��*h�� �x�# �CS���G;<8���յ5k�ˠ�=�F�U�舻Ĩd1�N.��}�(�$z3dT�E�[9��6=� �qsϑ}|X���ˬAͧ���ہM���;��/^D��a�<nz���s�io(��Q%�@�V�k�� ����v��d�ֈ�����X�Wv��S���Z<)s٨ h���&��^��h�p439�߄lNڿ�v/�m������f;�����,�ǿF�D��s��YrO��9���&NR5x r�QweǠ7VU�������D!��HVqx��V�'���Y"�`��u�t�] zj`��g'� ]�D ��/�r���D[�g-��`�KS�3�"Yg�ڣotn^��30A�4RO���@�i��e���I�!�Д��y��q���yak�sB_k��?�X^��� ���R��$a�#�Ja��Z���rM�ҷ'�qV F�����w �N�0m��q�lSʗ�p�X�AK��A�> ��?� =�9�yM�' � �5c�/G��%O��Pylx��G���!�Sl��Z�������_ ��#6kz��?��ƚl>�mߴz*�2��W��^�` O8^��T<�Ι�*���W�����{~<�>�Q��;����`V�4�Q��F{/f\k�z��}���gH�\�\:��O�����G�DZ�&��M4l����"3�� ���3��E� 4 ��#w���p��=֣�r���K>�W��Pߛ�΄���I���Ɠ���`<ܞK95d�Ih���ǽ�w�~0���3��"o~ܣmUX�z��Rf�g�ի�BL��&����yY����W������D�e���g����cl�= �*�df�v�(�iz�dy �τ� ugL���DI`��Li���v�y�)����� yb��N('�F$����る(,�Ùo�n�4���"�M�ANm�z��r��:���v>Q���H���kbH�Gρ(ɥ����gO���@�ƨ)�oqu�~}WM;�Q�-(EM��$~�`QrU��C���[yG^�)���ց�јy}��"�(X����5=@ �"���^���\��=pS�D���,wy����h�B[�0��5 h����_Kcd���F�������| +�E�}��(�^��374������!b�3�A��O��}/��9���k�'���x�#��>��Z`;jׁ"Lt��pi;T�PPh�*�}�� �_�Vt} s���>ou�$�?�[zRmKׂ�A���@�`MQ��e�Z�~�`�ԝ�R}���H5+�u<��"u���Guo4C�L�� ��z��&a���X��Rn_WsG����a�"��n��~���Q2i�"oN�E�\����.4�Efe�YF�����F����v��Vj����R�Y�VO�p���m9P����E��Q5j�x?���Q�-��x�-G>�@�!�s�~��K�$�����ыq`��~M��IN�Be�����* o����0I��_\�4q�䬕9٫�)��n����W+�z�d�9Z��S�D��u:X����֗I�NGSu��=U�N��EA�)�4'�x�"�,e|�i8A���0 :��EB�U�H�pJ�����Po�4����l�9�$6�큟���?;;݃{�<�H%�:H155M���Κ���}�|�� �Oeg����牯�}�2XFeKg�7mV��Ҿ�#L?U��
Static task
static1
Behavioral task
behavioral1
Sample
3a443fe1304c1f043c7cd8ec418e9524.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a443fe1304c1f043c7cd8ec418e9524.dll
Resource
win10v2004-20231222-en
General
-
Target
3a443fe1304c1f043c7cd8ec418e9524
-
Size
140KB
-
MD5
3a443fe1304c1f043c7cd8ec418e9524
-
SHA1
9e8753d23564adfe63ab756a82a94cdc8f3359da
-
SHA256
e7f5a24041e205be843b13f7c45088662afcdcc87611d04d7f595a2dca9c0e2a
-
SHA512
348d6e2133734f74e18b7c9484c82d375e8b0167e2a90d504488b85fe73101e98c52229262139d63922a756208460c5439eb09bc0dbc276665b41717a44a26a1
-
SSDEEP
3072:u/gQEAx3dQieYQLs/koZ4TkhI71W2SCRQMn5+FWY:GgQVPQtM/ha1W2HRJng
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a443fe1304c1f043c7cd8ec418e9524
Files
-
3a443fe1304c1f043c7cd8ec418e9524.dll windows:4 windows x86 arch:x86
f192c3add4bf9eeb03bc99c04e2d34c6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord825
msvcrt
_initterm
kernel32
GetFileAttributesA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
ws2_32
connect
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TL95270 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TL95271 Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TL95272 Size: 124KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ