��DN�g�lN&���~^2��}��Ƣ������Mr��5��]� �r�xH�K�i�R������Y5�b�U��U&p�5sO��$]�T&F�'4�%OG$!�#L{P��ϲ"��x� "�G��g�9��*ρѳ���?RP�K�����Sa#��7�d�G����I����:h=�e��Y��d8������J�Z4������H6䗯&���^so'Y�-���;�ި���I�g).��Z��i"9��Q� �As|���L�F' - ��nGHϒ��,�NX���Ӥ{ff�z�-��T�g����$��X���,Y^��I)���TD����D��!{ǂ��M?Qog.����,㖯}ֽ�/���$���ٖ��[l,��2梅Z��E|VG�z kެ�������.wy"?��+~�=�#�y�9OX��� uԥ��/�����ym*��8.�{�U�j���h��� ���q�DZ{J�C��������dbx,�(,ڶ�U���Ƙ�m��m ���� �I4�T &�BO����b&��ݤY����Bl����Wj���]����G+{|���# JZ�<�wgg%���IO'c�E��£N/,���(G����2D��(̱NԸu�(4W��mY ��8 d)l��T�b�:�����B���_�)U�=pA+UW^��xdF��x>~��q�C��[,͓U�KO8$��ljhU��~�1��ݳî~�ƕ���\�,�������DV��(c��Fj����wI�dy�D���8$ߐ�x���QY�� ��������]�+"d�w��@G� c)&4��L��w>���ܐ�9�t�_o<}Xh [������.!��������g`�P��~Xg�[����f2��°v>�w9���&��r�?l�K�?{._�N�j����.�����"ʇ��p��f�`i��?5&�e��m[o�g��T���\�������73rs�l�Ԩe�r�����=��(S����LۯD�=���r�����$U��\�I3���Rr��Ԧ��d�F�P\+�RCS .W8�X�4��� D`�M �P�V�90����8����vީO�LO�ȴ~DE�3֢�`W�&����j��n�)�^&��R}3��w�b�s��c�}��o/��S� �p���t?�R�\��#���'2��{;)�8�pw2���~e[H[(��y{��ß^c�*[f�;�"����b�މ��͝�B�܅0�w��m%3� i`J�3%�i���vm����4�(ʓ�>�!�j�e��ʩ"�����d9p|]K���4���� ��ܙ"X������ �� �K�|��P0����)���afL�m&��K�Q�U�D�3VM��H �/��R `n��9�����n���� 99��w���U ���pc�3> �~�[�0��4��Y'Wsz�>2t�w&y�����i�Y���{��ؔ������KAQ��@��$t�D*(9H��b�uy�qKv_��0����>G����+���߃}}���@L�k��.�D�҈�H��k"53�6�:�Yk�@�#��5�����me�9=�3H�x�&��W���C�p�����G|�c�WH;����܇��N�r�-��ܟ�=o�>�~�e����������J����&�&ÏCl�Ӱu~��X����(���Z�k��Y���S�j���]r�A��i�{�0[�����))��hR,�$?��kq��՛c��;�y7��2� �� ���@1Ƥ���� �����[Zi�c/�����S.Us(�C��+�犌�MS���x�9;0�\�;H�$C����dA�Ӗ�H�y��_^R���ݶ��C�%�e߿at�`=I|g�����"�wEQ��A�{n����˜3?C�3��xu�F+b�_�;{����-䠷.$��|�]�bm��h�B�с3U�[��5R�z�(x�+8G�l�hx늞~��L���,��h:�K��4����ͬ� @�6E"w ��Ah�+m�CZ����$�k��god�zN��8�ɬΰO >�|6[w�.�.� (�m��mC 6T�=^�nO�v���Zy�'D�����rhL"K����}g�#�;��.�\�f�P x���L?,��Y���M��×^��md�{��@��}��H����7�$�.�M��V���{p�wM��e�@�����9U�w����W�}�o��bi� ����V�����&ݡ��i�B��\�j!b����葇��#�'y�q)tJ�9�:X����ǝ��mf�Z5M;%sکkZ��v�߫_���k��ś9�f�@px��∰��@@M6X���4C��y��18���M�}_������cܼ�żGA*��p�!�%�N�{�i���k��������n��� ������qMjN����d��� �w� 9^d��`���]�ǧM���9�'��>d�;�����}����~{G�A�a�vo��f�0ɸ���c��(���&�<<3Kif�.�/0�ģ�"��}}�x�Kl@y����h�W�JFs�x��y �� V�n����DI�����"1�vv��m���1:�2�ϧ8�\�1Wo�s� �ޥ�:x���?�p^ou{e�}Cq�5(��b�l�)&��Wxy�y��:aqIIC|ϕ�Ea2��z�v�1>|�o�}��Z���"ER͕�H�-�a�}M3�"�NI��Ow�X8�¦���d�)�2�l!�B�N�����˘x/���9����-;�r��-p�q��y]���_�ZWS* ||V�g�ɕbibIZe���J��u�d`�ps=�b q�A`t�*��9�>b3F@w�0�2[�E��6�z�zm�����8��s��4o��}�ѷ Ζy-�+K��%�66����}A7�)�v�4I�z� �~2� �������.��HB�������� V"��7E����U7k�������{�v�A��(Y�/ڎN ��l@:�,5�ې��P ��;� %0�~b0$��:Z���5�X.����#D�- QP����'��`J�_Lh�M�'/�J$D��k�l�n\C�lF�iN��d���j
Static task
static1
Behavioral task
behavioral1
Sample
570291e53855b1e2ad2b84c49cf5086e.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
570291e53855b1e2ad2b84c49cf5086e.dll
Resource
win10v2004-20231222-en
General
-
Target
570291e53855b1e2ad2b84c49cf5086e
-
Size
208KB
-
MD5
570291e53855b1e2ad2b84c49cf5086e
-
SHA1
4a6ccdedbff211a4c565e45739b7c672a4602b01
-
SHA256
e5739a2cdda7b6cc124e61ef158f1cf2bf80c4fb48081266f2b629db8f58b66c
-
SHA512
18bf76b066595012f6b0ee2106626cc49eac00a16e6a8df41f613297ca9a785cead91785a3db96142b36184fee163fbe2a95743def711495f9fd48699440bc1c
-
SSDEEP
6144:Aby2gZCVEQJSkSWv/TRmODhbPFb+Gs5aa1UIPu:Abyd8VEQk3WXTAODhbZ65rb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 570291e53855b1e2ad2b84c49cf5086e
Files
-
570291e53855b1e2ad2b84c49cf5086e.dll windows:4 windows x86 arch:x86
4b337f296dd9fd7ef135c32c625f0a42
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
winmm
timeSetEvent
Exports
Exports
Sections
.text Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1234 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1234 Size: 192KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ