�[`"�3s���x?I�l���Ud]ɑ�1�nh��J5U�3:�2O��tF0�.�ޒᓾG?ɫ�[$$~��3���yV�d@Z���]o'�B'�NJ�gJ>�9����MX��f���f�*��,����f�X��*������d�$�.����:K�b���*j[��GQm�MmB�-�8kD��_Ti��� �־�CA�a�ڱPT �?L(Y)��of����¡�?k�c1qv� ���f���sa�/[L/2�Uz�6��)�Y/��N⋲�r�*d��ẖm?�,��Ͽ7����b6)N���HA��e������oY$���L�4����"*v����ŮbX���KR�U^P?��i�Gמd4�X #}"R��4��[��#)�1��<U$�:%�{;�"9 =rW�9�ɐ�����75��,��[^��1�]s�����t���0��.fw��7��)���16�V�ă�O�Ծ�vN��B��l<�L$��-����T@���z:�$��@tAˍ� ��~q�جcaH���1���b� � ���5�D�� ���yNFZ����:'���x��� �����ki����-'Bnܩd����X�E%��JZ�]����ӓI��h|>@��9�����tY��\���l��������f�t��8�w�2�`M�V9�:�� ?2�Z��jd����傰\�-���O͙b�M �|���9���{"��U�1UF�Q�]T��ZXi��� �.(�2�����?��*E#ijU��C�P��V�wz@*M��9M��P[���Ȟ�7'V��h�,��J��n�_9����qB�������5(i����ꈡz����ev�2>r� ^/�*z���~�c�]�k63��$*H������b���o2-�Et����A�+X�2����:���0��?so��gx��9�f�~7�`w�.��<��p�4&A��f�?3�D���E����J��r�?p��R�`� ��Ӈ�WJr�|;'ehܺ�7��E� �g�8�8:FE��x��]Xku�7L�ʌ���l����.I�,ZFRؓnh2f�UBC�<���@����5�'��sQ��*�]f�g�c�YyAv�ˢ� ���f���W�w��!�wU��n�:R}o�a�9�D7@7"M��Y��'@��.:M�Ive�Q0 ʴT��s�h�d�u|6��r� \Sr1���A�}K��4)=[���u�.DŽ�{� Vy�����d������}}L&��v��)<䋁����{_����U�=�S��]O��c>*�/Vf�O������I[+SU�9�V��m�|�Qr�{��$���L�*[�r��A���z���+������dx��aX�����鎌�Υ��]�-[��F���o���F�7@�k�].�m!���5�]�j�Q8�� H��Z���b[I��f���a�ú`��?�-�n����e��b���!����%�W�#�RL&���xd�l�l[y�3��W�D�A"�R�]^n� 52��&���>�u|��h���AB�$���2QB4!����1@����͕p��=�0$���|h�"II͚��քoh�.�&_$Byt�)%��#p���ܜfG�a��h��?�n ���Kx�����_�$�ܖ�kP��p/��O�����\����)Y��d}��wVY���_ׂ��&tc���۶�7�/�wmz����W�Y;K�S�.3xc�~b7VY�?P��D�搛&DM�����]���5���&��?��ý=�D$e�8�\`Bwj����Div�Տ�~��e�r��ΙD�ɣ�[��0���Z��Ɍ=?<N8�)o��k�U���m�Ogv�0�����@�Yj��o��!��\��D�r�;�@_�w9�|��,ie=�� T/�`��̶P����rMwv`S��t�ab-�}�x��7��`#&���!���k��CR��@���9�eh�k!��nU�_�> �"��2+��Z�4d��C���g���j=;��輙�hF�i�������<f�����].���`2��H(�(�ԙ��0��,��Χ/�ُ�� f����+帔滸},����%T���|�:*��?a�;C'��[ݐ�3�6�C1֫��7��+�.@F�G��e1ՉE����;Z��|����ճ���lw!HSJ�r݀KZ�C���,����8���k�R�&b��� �#��,�J�U�a�����Zw���F{u`�g�ἕk�ph�=�>]!��~���� �'@�ΙyU9<x��~���"D>��Bw����u��z�+��9rj��furݝۗ�y�Ct`f7��̹�@��b�Y���� M�Z�KR�vNJ���/������t�i�C��V«�[�{1�1�]JxrU<�F�km�a�:=����Z� `���)�9��R%�@ ��yPN^ò2���2#QlD�ܷB��_��ǂ*��04�LB�^EMJ��)*�����{^��Եƾ_����/�Af8����j?�~��RRS��gaC=H/�\~�(�f�n�K8@��Q��;��'q$K���x��Es6%���N��y(�K�����4s3.Z�$�� =Q7��S���hՖ���,U�d��G�Ŗpޒ���1'�>0�`��*D�y S�CD��i3�T��H�:y�H�p��OTY�f.Ob�y� v�&F00�Z�"��b�PÞtx��?���?��]ɏ������{(��s=dZ�`�� ���رB�ۓ��=��#4tb)����;8t��Ą����� &���pl�x5�ELA��\�����=\�����;)S��+�98�w�R��4�nU S���>r�$A�B�U�!���"����%Q����@O�AW�P=�&zhym�~A��--x\pDJs�� ��Qc�l�]�4�s��mIM�jt*����T�R�r^��ԅv��e�-��GY���>EM� '��<7�L�b��%q�#_C�ip�ĭD��k[����I�誁q\氹x7G2�L�H�\8[��ㆎp�5e}����X��̂��pC��\J��Bѵ����~�]�������t��M��w��;���%��c���NU�����s���.�т
Behavioral task
behavioral1
Sample
63c85d44350634c4bc4b218cfd10a1ae.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
63c85d44350634c4bc4b218cfd10a1ae.dll
Resource
win10v2004-20231222-en
General
-
Target
63c85d44350634c4bc4b218cfd10a1ae
-
Size
523KB
-
MD5
63c85d44350634c4bc4b218cfd10a1ae
-
SHA1
e33cb45ffcb480910871858517ba7604875b8432
-
SHA256
f002ff30984795f910229e694939d9017a96a9831887080eb2c06ca64dc3c8c9
-
SHA512
57ef24d3281e4ea6ea6bfd1b84e605184a887c1157eb64eebb8f7f4c7081c334847aef31428f88f9ce1f8d11fc1414ac01fdcea65f0ce9df786c2e7183e684f8
-
SSDEEP
12288:hpJ53MGMoQ+VG5y+yLc/niRkt7+rA7UcKUnKBHwh2U2zE:hD58Po185t/niRe7+0UIOHwh2UT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63c85d44350634c4bc4b218cfd10a1ae
Files
-
63c85d44350634c4bc4b218cfd10a1ae.dll windows:5 windows x86 arch:x86
777e32430cf51c03eb930747f48b5cc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetDateFormatA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 520KB - Virtual size: 520KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ