����30s����9 �~Y]M���-">Jbo���yHXI��]Ɇ�����E������#X��/W�o`���5��q�UG�t�K��9-)֑Cjs�:���n�� m2+���?�¨�Q4��c^�4Q٠xm����[����$Dw��V�A��&Lt횗���Ub������ɶh��zwF載#�Nm �����;@s��>I��p��� �Y� ��e�D��4�MM z���>�N��������ې!`! 꾫�k�Sݖ֜��~�"T%�v�����ʘ����>�����������o ����Q�߂Qw��;�V!V�����Qዧ��� CLЈ$Q��dz[Y��ƫ���Q�@b̻#}f��N����� ]�pm�"����c��FP��P����;̑'M3��=��0�_w�����/1���\Wn2��(UBT4��m�Y�K 7��������6ӊ�����R&o�s,���������h>!��M^������`�.p%�����5�����!C[����B��w�������^f���D�t�@�S� �4�[�z���F7��.�6����br���l[._9n��n�%��(�����T�f��V�|�C8�=�B����#����@����I�Ý^U-�p�/�䶉�d����3�a�O���p��PQE����̟�e�8�P�Ґs��E/O���9R>0�2{�(�����"���Q/�����/-���Gi���u�f��F/�,p�����XZ$G)e���Ci�N_��d�ߔ��Z\�YI��e�Ļ�!ky����L0O���h��3"��4�(s�3���T��j�љ�ʤ���:{C�:糾��f3nԺ��=\ESs+"���u�4�n�1%� R��D�">\�8; 㧄�|.��J�8���H��&emOl��ͺW��C5cv�� +C���L���X�I����;�p#��z��e����g��-����v�傊XiHQR<����9��VM�f�Dk��|����*^�Y[���*��.��Y��0���T=��4QtS�cd�t LK��(���$o�:�ҳ�d���3�Եg$Yh�pV�ԮyuF���+C4�Z .��|�Q}=#uOq������Y�16�?�rH��^W�%ax��^��� xx��O��1j�����c��8>��:�=��W*��v������f4K1�aؿ���4T�An2C���������6�Ȩ�ҵ~N_S^/�϶������l� 1��x�����)�5~����U:�K��aXU�TS|�Lx$~��63�����V�ܐ@�/��K����7�4�4�)�(Dܕ8�ؠ |�7��ޭ8�nfC��ǃ51,���(Ö*g�?F?�y�N�3B�g��].$E�raWk��6�]U��fD��ӫ�߀��;�9��x�l�2> ��A���-e�� <�9�b�3�%�=�쎰�Ë�5��T�g�`T��`�a�5{|��d_�(���90��>F���P釱��E�����4n<�`q��T�$o�������E�qr�:jN�i��l �)�;O�8n��Vb28��1� >^��*c���?;��Ou(��,��y��p��4Sd�:p��`.�g(Ut(c�����Y�-��Kc B�ڸٔ�%���[&[TWug3���¦����+D;} ����������܋��lN����z$D�,��x�8Jn��D��6�qh��"�3��X`��)�X$@��l=����g��>mz�5��6v�����bB�M�րho)#QOE=�I�������`&��i9�.�o5�eg�P�f��CS������;�qX{ ����FC�ݴ.t�N�m�H�f�x�k_�_�Њ�̕��^��Ӻ �O-��d��[��)���u �%���zl��3d ���-�+�7�.��H{�P�<;�U\�]CCԘ �}��̿��\��v���J��Go2ܥ�{C#���ڪ��O��"�ֳtA�=�����b�x��m���v���[k����XŬU�6<����`ޅ�����jZR��N�[3՝x�+�OA�%�7M�cO�7b;�[�H)k��?d �Y�9�aQ� �6�JM��%U��0<�>�y���.��:f�.�9i���u6:�e�6�*'����fu��`.A�"�Im�&vڼB�zw����,���覡�o̾Jt"�M^�Y�η��S�p�-핐� �� �bafpJ�C��z�ө�#���O]�ea���NͰ���6q�&�[�퐘�Ԇ�K@g�yL�������J+���iv����w,ij�6`╢��<S�9�"�7F"������co%�A��H�+�7j;`���c��A��x����X��R��?����6�:j�-M�������b�2&V�A��� �4���JB{�d��%x�[�2zq/�2i��s��jK��t����Q�`^��-Au��#tq�Ť�e�����\��)Z��J=G����r�/4#i@ �D�8�p���3ͦ�v^F���1������/�եROS0Ӹ'�����~� �7�;%�_��xہ_�`���!߲yHR!m�l|��1�A�KՈ�Y�ڪ��IJ�fwJ�4zb�ڙ*F�b�ݠ���2����H ���֖����%�d��%0�F�����u���-�id.K��Ihmۿ�F���H�`�LG �L���muc���0��$Vggl��ZA�T�-#�o�+��AV����G[��{�0B#̴�vmi;7���D]� ��ЮH�zi���w3�aSMI��i�β��3������ �x��.�2��+�� W^#���2�_s8g����>^�e��Y�ڡ�d*��ŗI���[Q��*�OņQz�#�9 >C�@�R6 ojO[���"*lIX��V�?XӶ������9��~��"i)[��a��%�=���tW�c�� Ty��D�%3��Ckᾴ� �>�6���̐�o?�~OoP��B���{���n>��*�.Q����ZW!:+���� ">ٯ�V�Q�f�v�̪ң�w:mN��tY��
Static task
static1
Behavioral task
behavioral1
Sample
e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398dll.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398dll.dll
Resource
win10v2004-20231222-en
General
-
Target
e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398dll.exe
-
Size
2.3MB
-
MD5
342fac31eb0f331f558114a0385f9b40
-
SHA1
d523d2874ee9aab6a79cd3177c914c890d228a93
-
SHA256
e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398
-
SHA512
71977728620e556d4b46ad6bed9ae3f8b01198279d7ef762183129595a535f66d4baaf92c9e950bad1516b67d579a83928f2ecbd1a3527a2ae113119cc12e774
-
SSDEEP
49152:MJAK1ZZZiOU1TdUvs476EX1ebIUthcjI/o2aAriazk//Z2lN9F:SZZZiO2dd06EX1QijI/Nh33f9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398dll.exe
Files
-
e7feb941ec0838dac58cf9cd48699ac60252001dc98ebd09f357cb14985d6398dll.exe.dll windows:5 windows x86 arch:x86
af3362105ab7c06db8a1cc6e766be251
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aM1% Size: - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
q>(i Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1L>r Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
U52U Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ