�qU�����D?��hn���Px'� ��Ub��A�4�-�5���N�F��m��j<� f�+�g�ɴ_&��CD�ݦ�<��bâ�/e��)UhP,G$>_ �z;v`� j?��Vv U�_�Ū�6K/ �s���/�1���������\�KvW�&���MFÝ�0{F���N�B��TȔ/L��9�^Dc��{0?��<��N�Gg��1!��)i��%xo����\�}۱��2+��bxl�/�O��%���Y�s�tfK�e�T6C���漑��L�Ie���M�b#VbHE^4�Sz��3�aTW ���,��!?EG�S��9��\�q���C�u� Fn��w�%�1Opvs9*��a�mT��#�k��w� jŤ��T�k���y2a��@��sMM���~�Fa���T������ �����Z�^l_TX��M��yò!�XqGV � b[�(�h���{A��V1 ��vPn����B��\F���ե�Z��-���i��m��z��|jE� �Q�������;�P��G�f"�l��d�H�krb����R��������)D���s�Y��w�����+p��;���OE�����=��f%y:g���;@�\}�t��䭙��!����X�����V0��\�@* ���pj֧�lJ?u��}�D�i _Nt�z~>ģE�y6_:�k����V��l�qӾ�G 3�r �P�{GEڒ1�!�3u�YC*k��J��i��W��G�9%ϱG]�5�����C�h�M�`��-�c�����i��a�E�{X�&���A-)a`��T��Uv��̃*�+#�r�Ms�HK�����������=�֧_���`�|����:8�����u;��A���L�%O��'��,�߂`���`�F �b���D�<�^�������%�T(IK�9UD��3�n���>��/S���o��օ���y1������I���O[�f����~�B/f*<���O@�}g^B{�� 0*q��Fɲ������2�l�+�[i����$0S�0�V.sK�nLw�w�Vp㚖pزo�i�g�Nn?)1l�&E qnMI��҇j�<�Q.3��⻢�w��:���@�T*��%�4LJ��Ō�1~"���'����Gu��R��P���e�#�@����j�S��9�RP՞�D��i�~�:ߔ9�H��k���=I����'1L7�mA0��?s�m#�V���];�Ux_�p�2�9�m��V���8��;p#<^G��I�79�c��[\^�rD�,���Z�r0�%=D�x��T6`�]V���e�/y����ނ�6��gr?��g;��ϗ��C�(��p����[�c���΅Q��~���+]��%���[�DG����m�jzk����rMG�W�v��b�ؖ����^І1���?K�h3$���v���uh��êrC��=�#P��N��v\�#O�ڱa,�2���2��=�;�í�� m���u�m�g�}&8���,�� ����`������u����Q�������>���#M�٫�����\9C�$lL�����UT�No�3�����Dᶊd*�3g�����'ҳOT|/�RY@�`?�e�Iz�>�O���n�p���'��P���xoF���ޚܹ��`��o��ĝ�Ij9�AD�B���-��H���)��˨���Sp��Nu��|Y��F�j�Y�6 �'jy�f��R����m�p?���ʭ�z���'2# �f�C��]���f#Ю��2����N�]^>lnר���:E����fJ���M�b9���"�os� �L��gow���9����O3FH)+���z�*�h�!Y�~V�!<����'��tK�;�_����o隦[� �A�"�Z�>���?1+ Hi�N�j!���4ڪB1^~e����[�d�cm�Maa�.ɺ)�Wm��@}.�T�K�� �Ay���y�NXw����\�<����¾:g��M6BL}i��X�i̱�4��`}^˲r�V�(`�i@��ĝ�_�� I:���o�����(�qO3{�`�Sݫ��eh��V�� @���O����}�m�]y0T�Z0�Z�/r@�H�-�y%���6���r�k�� [��#9ei� ����Y��)�B�yY#J�v�4���W��#TSfc8,�ᑣg�f����T$=ͳAĎNU� ����ن�w�/��}���J���0��+�E"�ڐ�_5rswָ��ݗ<�][Jwm.؆J��A$���Q-s�@����M��w ���x�Oz7�$����mrc������奉i��V���x孝k����5V�%�+��@�����j� �}��-A&�W&]0�o���@.p���`ԝ���9� �-�mE:��K�}��F��<����n�5��Y���U 8����^�Z�9�3ɖ�1�dg�W�B}�K|�e���� ��h����0E����.bpj}R�eh���d+ �Υ�V_��|.x^Z4��]0�:���м3��shln�T��m}�C�����n���V����������0:�C��}q��^6�<|���TdlG�`ݽ?I�R~QR���U v��G��s,����[��R[�������I}�7_��"��t�b]���n+��EQ�kYYA3�I�18;?M0�<���j(h妦���?P�ƆФ^�ݙ�Ro���kӭ���88ncӀp��nj�Y��|Pԡ�=��6��xr������^U��+c�kԜ����92$�oNNy��ψ����\c�����_w�!k��^�Q�Y\q�l���!Y���p��u���gL%�������GU����j�]�°�$��BN��Q� �p����m���SZh�'�2"�$v=c��_E�I�J%�VU>���psth9�5HL2R�L�{�,��������O��p�l��M�<����l���*��� 1�L��yJE��6����o���*NA�x�+AAtRO�c��4� ��*���}}'��X�����w�)��� UK���� 1��c2{�l�1>� �r�ӽ�c�?c����L%�
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Win32.AntiAV.11458.12736.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Win32.AntiAV.11458.12736.dll
Resource
win10v2004-20231215-en
General
-
Target
SecuriteInfo.com.Trojan.Win32.AntiAV.11458.12736.dll
-
Size
212KB
-
MD5
ab422ff8448edecba65b64c866b4dbf0
-
SHA1
a6f26b401134161322f5bede0a932ce16ff67957
-
SHA256
5dd0d585b9381dee405717b692d0531b14087cfc472e69b1ddd961220b98de36
-
SHA512
14d1026a2595394b88eec0326cadbefe408f6918b74d377f5f7ac42a6f2041f3d1e6271c4ca4acf5524ed213cb8b02c80bf201389626e292329bffaaca3b03c3
-
SSDEEP
6144:/HVTcpmJCYE92pKsJcnhYkZZbgffjivT9mkcD:/HVDJusWnhYkZZbgffGAkcD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Trojan.Win32.AntiAV.11458.12736.dll
Files
-
SecuriteInfo.com.Trojan.Win32.AntiAV.11458.12736.dll.dll windows:4 windows x86 arch:x86
e7947008a6c878fb8290822f563a66c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDC
gdi32
Rectangle
advapi32
RegOpenKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bfbf.vmp Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bfbf.vmp Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ