o#�~����\善1�sc�`�?�c#q´2"o6�1�.x���ΰ'�B�qY����"���=>���t���u����a��"�~����9��|�.�k@}�JB�*�z%M^6���ϸ��G�Q���J k"�!��V�|1���˛��L�R��ġ�0ўe.�aT���vvx��@��H��� ��R�0�]�c6!�h�zf�=�4�m� �&6���[8eJ�^�ޡ���m�ڬ�j���?R4F�f�j5O�xB�_�����v&������ȅ��ݙ''��ʔ9Ꙝ��Ch0*���i���)P�l��[El�K(�SՍC@�8��+��^5�gd��M�(�{�Z,:�J�1�^�̎�������T�\0j3�����A��v5��2}��~m8�$� �����&*�������XX1�ؘ�=��no�"�P�1�z��c��ԁ`�n'�r���^xF�'�)�J�(�Wa�)��� �Ђ���DDϑbLA�%�)��[��q u��s Y��X�qW�;�_��cR�.�E�mlOH��PQ[X�aTt"i=����00�z�t�e3-��&{��Kp8�&����V�L҅�����岝�6��0RS�C��ԍ@��ʧ����5Շ3��s�)i���u(>��yO]Q}����c�)9UgZXF��B8y�w����Rh��&�_�7��0ƭ���6��9qu}�#q��u� ʁ뜡��[m+��n2h�y�s��Ǧ�)N{� ^�}�e�i-�*�~&��#�A����M��p�0:�.ʜ�ot"�Ω��� ��(����{��幮�]��߈N�@A��=O�GѺ��.O3������ݔ�����R�X���M #&��/���v�ı�䒵�y� *��͙8�������$�� ��h��x���ntn�øe �V(Dx��1����I�&�9���6v���ߵ]���yI�d ���6M�X�_���/qp��[���%��1Y֦��q�L13)�.)�I�z8���t��e ���"|ii�1��gQ>��ȃ�0���k���pؘ��UU�<|2 �;ö�' 7����T8�h� ��� �cƧڏF�Tⅸ�;���]�I�T��b7u"$�{��c������L~kq���e�H�R��>4b��-���VÎ�"x�LV&�@�����l ��F�b=�j�Y�$7��n�1����-:�&6�y̪;������v�Q��VT�X^�=h8��0��ƣ#��^ZRC����U�ܱ�4 &�f04��y8�������S��)�YS%����z�=�1F�e|�ln����L�P�C1�5%��k�*�̎%��sX�$_��JGh誕��$w%�����V'ƛЎ��lc~�ݢ�E��'UO����]�V)Eh@��I���|ٰ(Z_�¾=��fY!�.����o��NsW.o��c�X�Ŝ��M[�Mt���8W�6�g��b�x�l=��7�S"�c�)4����h����EprM�]�H7�և�S�4W�0h��ɻ�#u����x@�,>|I�K�JN� hǫ��@��I�0�P*K�v���)?X�v�ͱ���W�BE >��:���p�~�@�w����d]���\��݀r��0�c�W��w��Ϲ�8�����N�e+V��|�lz���eZa2Y�tais��U�k��������E�����G{��!����K�D�����u쟏X�+��S�̶��F�'ˎv�i��@S�Z�J1�ãϸ��P��D��T���@��-T#$�fԭ���M@��1���/P�mK�n�@�c��/�~7���W/��;䛨���Ր�����9? �M������k�E]��\#�r<Z��H,��^��;��c���Q4�*�c��cF�x���/l���0 �����8:�n2��{f\ ��M�� %Q1��G}^T2m];�Ԇ��HF+B?r�.��'T�L�uwˏ� �ܿ�'��iY�3p{�3J��E�Շh��I����^?k,�\q�=��V�v�Zx�<�~����a����Bח�����ڞ��?�~) ��e�鴡P�͵ �Ip��m�dM��<\��f�������xpW03/7,���uT��h[�@�R�eb�����dp�F�w�>ɟ튄l�r��-]q������V�? d��Je�d���u��/ �~P8��H+�Bڼ�-ӅU���7`�֍<�Ȕ4eh��)i���^]tUB��,���������G�84�d�'���m�h�G|���tw�f�G3:�q�д�g��YB(����(�� �b���V�ً��H>���r�����r�rCzfĢ���cF�t�T��M�O/-Qn���oc�4j��$���P���Y:�����8`�ϤQtV��.=N3���%�2��؊��zpk��b# �5�M[�[�r�t��"N�֨*�zg&�G������V�*�J�ޟc��wЬ-��ܩQp+QTi+D��l�V�Hl�I���宴^���)����0�ru�i$�<���wI���}3GX�64�B����P�t��+�h}�����Vˋ��:�,=��h�ȼ�u }3JS�C�1g��&;�5������ e�Y{,������ۧQ��8�ZLY<6��n��u�7�(ld/Z���2t SLy��Z� _�p��pz�aq�� ,����dw����b�����зQ9� ���Z�5�(b���}��d�->'�4�����y���Ј��9��U�0�^-�K����q�N�K+�ί<�X}Z붬�X����<�6_!`}�?A�A+��C���i�+[��=�`��f�_u*��{���Q��SU�bbн����&�}CN�_�r��D�DQI�,�RT~�K���\_�4���[�F���O����D��� ��¼$��b^�먀�D��'�{\�QC+F�Y3_�۽v*�N��Y��5};�O�������!�� E�s�^�d29��3R�3>0�=е-X��z+�8x�bZ$� .*^%�[rJ,u` �k���/o��vL���������M�bh���F�4� ��᱁8���
Static task
static1
Behavioral task
behavioral1
Sample
76111cc3d972bed67b141f7464418835.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
76111cc3d972bed67b141f7464418835.dll
Resource
win10v2004-20231215-en
General
-
Target
76111cc3d972bed67b141f7464418835
-
Size
1.3MB
-
MD5
76111cc3d972bed67b141f7464418835
-
SHA1
d56cea6a746e9f8cd00d393398e6f82cbc16678d
-
SHA256
775bfe8f5773b123b9974eb2f77b5c14af93d33149d624bec8183f8fcc975a84
-
SHA512
63a7df0eacf97f43288088dd11cf0a3823ba3a088543fc77bf015c32af0be8f769b97a24fcb5ef5e1c23ba5289a79b3ccc79fbb06ab8479b1ef3fce72b07767b
-
SSDEEP
24576:PiVJfee5GEFMNMTvgMM8RWxIEumhScl9pnWOimo71jRIDXfyV+BVSjjAXYwtI:KVJj8CMWDgMvQxIlisz1NxoBQjjAJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76111cc3d972bed67b141f7464418835
Files
-
76111cc3d972bed67b141f7464418835.dll windows:4 windows x86 arch:x86
ef4628015d042ea47a17f0798621d8cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
strcmp
kernel32
GetCPInfo
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txt0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.txt1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txt2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ