��a@�K�Q��@pM`f�����S��y�JZ=���~�"������<�H�>Yr%wΒl ���J������TP��"����Vk1���go��("�;_>Sho�r� ;$��/�m��0�N�ܺq�v�M�M��-�c�p'8ET��x���n�FY�(�aD�����:k���^�t�v2��� � �z�~���h��(�PV�v� ��&4*)����cVy٬�DR�T�Ev .Y�3�? 1j_�������(�@��A܅�/��O��/�8��1��Ky��ݶ�I���� �����ۦ[0r��x}�:��*�y�(���ڏ �ӊd��HR�����z*I���ŔS`�w)n�d�"�7��l#)��oߘ��~�HSQ�fجY���QT[_w����B��������/+/;��+}�~�`�/k���Q��%~b�H.�nx���~��q`qʨV�ڬ,mN��\���֜��u�)�5�d�W�4t��d���Vu�9�>�Rݹ�2�%@���xϧe��vV��[IF*�=���{���E���r9����0'��m҈{&�'����W�V����&0�e�u��~�i}a�Q��,+�@�S�$�NײT?�������{���8.O��l���[�����&>�=L� R��ȅ�$�;�J+�*��>�� �y ��ϖ` $���v�i���i#�{��J.��;��Zs��|p�鄳�\j��˥_��g�f�@��1hH��K����{4֟+}Q�:�����i�SA����M���!�(�tpCN>�~�����陿��λ��ԛ:>Ѳ�@'X�W'��Շ����@���ҲG�Y�YtOvCL��NW!�yal�r��_T`�X �縣�!���� ���#����xc�Yֲ�7�'���'�{��ߚ�@3�g�)9qg`��p)���Ǧ�m���͓�[�V3���= r0>��ƛ��^�R��.�� |�͔j/چ�Ɠ(��=Q�7OB�ĆD��� ɝ��: ��5��>�Ad+ڲ��l�����Xޠ�}�'��2m��N]���Fx��{g����r�3�8��g}$<M�N����(�LKN|>b�ک�̨?�Pu���ɢ�}�"/.j�ӽ�E������\C��G����|t�����uݐ���2f�������-�$-�d5���������)����$�9�H�j_���v� ڍ�TB�_s�����_���&�=�@S.��?{���z��ˣ5�1������y�9�۔1��]!�,A#ȲȀ/ݾ�4E�������x�zY�n�B��Y����e�6v�e��pU�v$�-Ŗ#|?�?�`�~��pjֈ kd����Si�n�ߎ��Z3��|_iMm6����8R��jL����l`v��th��<����U �y!�9�\ ���Zﮝ��0��Q^.P��C���C�l��VMc%#� �R;K��&�e�>��`Dz*�錭�MmV�Ó����5��v`TT�lЖ�O�M�v��N��ё�6{^+Ąv�����on�f>�����Js�4���*=ۼH�£E�M�o6�Ї���9��~]�~QjG��N؋,K1��zd�0{�n-���`�ɊA��0�i�EUN�ʒWz@f���}%�3/i)�L��(�x�_�S��.O{��֤G�����#f�V�r�4e� �қމ���F9���m���t���/ ,O�?F0�G�[��ǻ�tq�����&����U�R������*��'���*+�x�p�oD�b��5ݺ�j��}V��\`��%��ʑ<|�f�+�ò`�G��۶gi�0��V"Q<9v����be��������ս�y3Iɳ�����"U>_h�F�5�|�?��5̍9�!�� 2��.�3�]J�M-;�}��Ҥ����W"�z��j�cLyOq�|�qr���9 I�ԣ�c��o��a'<��)�*||^�������]���Cj҂�8����=�����W�lR:��Yt-���Ћ��흵�r��y/����앨E��������f;鏭�d���8=j�� ��Q��3�Z�:[����%߾����]�;/�FSWp'J���i%����Cw��&���ZF�K;�@]��� ��~�^�� P�X!���ت��m�xp��"����Ū�93Vp�1��\��܆�E�d��ٿ���*��j�/uCn�_�,��}M��mj�5�7 �zx~��t��f�Ļ�`��%w�m�Y���0�8�pe�t�T�xtAF��aYgafqZ��������Y����Y.^O�O�V��F˂S�E4K��1�u��r����E%b=��I�]m�Κ-���&c���c��]1������3�Eٟ��g�����6�Te8�:"D{��r���(�����V��Z}��Kl�:���}�jTD�������n}��х�!Gcy���I�gP�2�L9Q˺r�Ǎ �;�!�����xfg�R���,w�||2r2|�{|*�M���A�)+��&���7�c�#ܽ�jH�xy�����K���,�������7�Z'��qih2�D?,�~Ƿ�j����g�1��rG�ۈ3P�<Z���H��h�ֳdn� ����v�]���9� �P�HF0�������>~��G)����=���˙�h�C�#�$�*��3��e�|%�u�=�»����ٓ�#a�T���� �bm�C,��Uy�u�~p��)S��������EsH�psv�I���0R��汿�jʚ����k%�R�@���"�U�D�&o�;�%��t3֠�oI���6�|eC��}�FSsG袖dE��U#)P����K����m�ď� ����,�u�2U�����8k�iyY^}�"�o;�)�<k�7s�����DO�Y������ ���U|��з�Ć��`A���U�\.�/C��R���U���t'*D�����g�o�w~w��[�bˇ��Z?�5���%�^�c�����zY��E�+�9����®�Tj" �/�����Rn�N]��6��=�
Behavioral task
behavioral1
Sample
57db75cf4043f3ba319b1ce57f3458c5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
57db75cf4043f3ba319b1ce57f3458c5.dll
Resource
win10v2004-20231215-en
General
-
Target
57db75cf4043f3ba319b1ce57f3458c5
-
Size
230KB
-
MD5
57db75cf4043f3ba319b1ce57f3458c5
-
SHA1
6064ceea8364cfc6ea655258ebdea8fc8ebb9042
-
SHA256
096921fad75e5a137ac592c40468f33848a3ec86defe3a5866ea9ccc0ea3b2d6
-
SHA512
6bdad353298242f5fbb1564e8efb5ffc37fdc1fbe55e83145707966d8af6cfbcc47a213e5d18cc8a8854d5cacb33f146cac643951688f65fefb702005599d964
-
SSDEEP
6144:sfjnJZJ5MWrZ2AIl2uoTjSdqY2JQaaGmNm/o:sfjLJuWrZ2AUEjSdqY2Jw/8g
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57db75cf4043f3ba319b1ce57f3458c5
Files
-
57db75cf4043f3ba319b1ce57f3458c5.dll windows:5 windows x86 arch:x86
999dc19b7700cb81d47269252d79b021
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
MessageBoxA
gdi32
CreateFontA
shell32
ShellExecuteA
advapi32
RegOpenKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 227KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ