�u���Ε&�\�Em5@hk-4o!��4�2��[ÎQ�Ϸ3��n���y��gR^��3C^־�M�^;���vsvz����B��|�Ɲ�9r�c(�uo\{�#�~n8N}�����/����c�Z��,�VH.�R���_=(Ӊ�?����R�M���^hJG�~^�wtZq?}L���J���� ͜��+���=<(��s�)�&���~�f�)�t\R*)~9��W��ޱ�c ��s�� ��q�6�'�0[8-�e���a���O��Z�x,��)����b2j�Q'���m����; �ͪ˅CS<'q9�9g8Z��+�I"��8��xh�D��8=�T��u`T���@$�B�����P|�� W��a� $v��k;�oa���S*�ћ曨u����k˦�w��p��1�Jg38��Ĩlu�gPBG�2��7m�07G����k#Ϧ*~q�̓������]ƕA҂cQ�D�����;S2Ak��j���}>���V�k�UX2��>.����=d>�<�2s�6�T��9c���c�O!3�/�̦����=v^G��eD �D��;Y$��N����ڟ��E������p��P� �=Sv����C�����T�%����u7��-S�����C����H%�*��3�S��qg�����*Q�v�����U�^ �J��0���|��j��{zؔ�D��9���K�ׇ惶s���6����z�%[���b�%x��p4��L�r�����g��>��tvʩT�W��F��*� <B&&�����D� ��/��z�KN/VE�0�lh�N���Y��%���zE�������T�LTt]�����7�5�-V������4��pv���y��Qk\"��ҁh�s����H{Q^�7�����* 伝�פ���}�O�w�������\s�76B,��֗�몊�a��b8i��~�$�f�t�ߛ\je���V ��"fU��>�ڦ��������,{AJF�1ۋ�4}$dS����K������.p�����6�� �$&�"����>��!6����`��c,�5��8���̰ #^��Ԑ� B�f����kU�;�A�bk��:���(H��P��ͣ6Dq���.#� �@~bבҊQp4�O���-ΝUHL\C�/��Q�d`�D�'"j^ D���&�y(^���k�H���b�zz�/[�#��>�����U�c��R�t�g��r_�@�V�*5)�О{ݡ�L�^�������2����rD!]�|�e���dZ�L#8��h��";��߿��U9'��F:�St���15Q���h&�9������x@�ߗ�)��m��9��1�J.p�T�e���a�L��EuO�7^+�2�gP;�I���u��xIц���L�6��C��-x�.�&��$ݓ�_�[H{y^KU_+ �K/[��>�am�'a-e��(N����T����p�(�5�H�@|_�����mY�XU[��~��.�?j��>�+i�+��Խ!옇�2������|J5�N��h�̊`��'G��:���P�s����VD����Y�&v��>H'�����N�jG�9�`RB��,�4ymQ������ᮧ�gs $��k!��!k�0ē��u���v���ԙ�&!n��c��*ܖ`���1�3��W�v�B�$�]�8Xb��*�H�_��YDN: 1E1# �]��4,�%v{@X�֩=���J(��ߔ��*�M՞�������J�t�Bap�y��Ipj I� i�,(�]�M_ ��OWGs�F���e��C��2�h ���`-B$�M�jo�V���P-��VS�X������|�n\�2��N 8�'�o���!�� %�=�2����C��0PW�|��]��*���@�a��+�o�����IՇ,����E� 1�u�(�����s$�����5����H��������EZxbD�9�:���0۞��H«��0M���d�����kV�h4Hc���7+&����ղ��uN�iǐY=������ e����?Z�����k �)�/��%>s�1A���i�B� z��+��U�Dx_k�x6��AJ��">R B|�މb��!�_��i��(�3�0bwM �/KN���';���j4j�Ϡ1w�� v)�s���ػ-:z_5����pd:�I�%x�{�(`�=��%����-� q����t���İ��A����j ��� e���A��(o$2��Zx)�u1ߣ�i*̢�9U�u�\5�;�����/�zf���1��K1���@T-��ɎK>3BɁ�k��F�U:&���|�j�)�T�gxAZ�]Ώ3�:)�ݳԔ��2һ���VC�e��9��h*��W=�|z�|z�Ԕ�\���\lfM�NŲ@A�!�����AV)X�/�i������Q�`aC,G��#Y����F`�o��eEPҍFV� ����9����7�#�MPf�t���yW���dAhGu~�����g�4՛�gϖ��6iZ^[ʀ4>;�QHl3��������3t �{aUL*T�����J�P*��+J��\�7fn��O�qq����qo�6ҢS��:N�=�Sa^<��ΰ��?+ɣ�ݘ��+��WyK�y��/5�c�����>��7GÛ���"e�u�3iD�z ���'�\�W=@��%�oX`�Z�� �$3m��ԉ��Nbe:, &����|(!ʖ��>���+��jGÃ�f�vq�7�4��[��`�����ܓ֎#`�s5�gɛ�\kfZ!��>X��h�#�C��)��}V������-=�i���b�����Bq����;���2�:��?34PHM�|g�ŀi̻c$����GD�_�H%z6�#�jN��yG:�"\�+��Un����}h'�Z&x���c�� A+��O�<�k��iWhW�l����n��`6�� X�`����i�-����2��lK�e*�G,���������HgR�? Ss��+�3%�~;𘩘�����-y��C�@t�lqv�:�`��A�(���??1���j�/o���n8�J�-��iX)�J�+^�4��3��0��v�LĄ��$BUU(aD�L>�� �����Q���l8F1N�����
Static task
static1
Behavioral task
behavioral1
Sample
3db280620fed47bf71e3390fa6ba17a6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3db280620fed47bf71e3390fa6ba17a6.dll
Resource
win10v2004-20231215-en
General
-
Target
3db280620fed47bf71e3390fa6ba17a6
-
Size
264KB
-
MD5
3db280620fed47bf71e3390fa6ba17a6
-
SHA1
d1b1434d22e24d10d2f306d2ecbd97f51ce4e116
-
SHA256
bdc04837477b3ce8f046e3fe43b1b5d5a53ae5808854b80e0aa829a9aebbd242
-
SHA512
a89f53fb5cfe720c0ae784544789b3d051edda8b043b4cd12ffae80df42378428d58b9f4f2b301a49dc51e66208fe2f93c42e7153928f0012c5ca08c7e765d30
-
SSDEEP
3072:+VcZlZHfHoqZ9gll9MWDSaLb7wq2AB/bUgisjnBnYUEX3K3PIaMYu8vjlGMdTB7p:H/oqgn9ya0UHXjnlAK64pGMDutVJLWD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3db280620fed47bf71e3390fa6ba17a6
Files
-
3db280620fed47bf71e3390fa6ba17a6.dll windows:4 windows x86 arch:x86
d88feef27730fbccb8eb92e0b79be96d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
RegCloseKey
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
free
shlwapi
StrStrIA
d3dx9_33
D3DXCreateFontA
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tx0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Tx1 Size: - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tx2 Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ