�����@]������eΒ��������uȅ�S���������;8 ��5!Df~�5S�2,��\7kG�{*��?�G�Ot�Ĺ�?�Z��y��(�:˻q��I�x%��݇^0~�4"��c��P��g��������^t� n�F��\�#����Te���q]�1��6`�L _K�K]�=lCS.���ߡ������;�L�f�'�R�q �GF1L��7Y��z��1��e�l����_�B$����Zs֣��,0���Y�1F����:�ע��d��#WX;F�F,E=S����Y��?�\�Z9L/��lQ�v���֩G`2հ �S����K��9OLa�V����7����t�Y(\m`�C�|W~J>���fp�Y�Y*�D��> Z0�C7PǪe��s!ݧ6N-N��a��.rx]���a��X��9,e�C������y�N³��;'D���} ��g����v�P�3��Wg��߄ r+��_V��w�G�2I���{��Ƣ �|C��T��#Gt�3{�?+��탵���`P;>�$=`��Q�W9�����\B�Ĉ�v��!zǯ�^�dj�rx��e2jYw��2�� ��$�Y�g���҈���1w�sk��AB��Ԃi]��P�-�E����˘'�)��#�I<f����Z��/]����t����8=/�ק�(��G/�$���5y P{�c���!�m�ݫ�6=:m��ZgZL������A᪠�7[�E^E��\��<:�a\+����3e��/�\ ÷�;U���WpfY��ҝm�]����ΰX�b�!F���1�$��y�������)~�l��E�P�3�0tf�T_`�b�L�WR<j��Y��.I�W�("����ݺ�V:�߿�\�hߚ���,{�h��abB��R{�{}X�Qx#�x�P�i�p��r��Sq�V�œ�\�ρ��P�-?�W�ϱ��u�,1z�0�0�[tH�����\v^�Wʫ����lF��vm#1`��0+�g �G�*�������d�]j��9W���vm9k�l���[rI�m�6�~S�a/�@��Ө�{���&�P��cm�duj��^��Fg ��x�J)7#���=��2?�"���*7Մ}y���#�+��M�LǕNiǤ P�?�i�SO�UΧn~�xH_ƫ���sWJ������( \��d���HC�Ǣ�o2)s˄���y�u�h>�rh����������� Z�4�A�]CoW}[Ybɧ��9F�J����N�H�2L�3���q=��m/9������1�M�¥�m�aŐ�U��M�5|�������?���;��gr�1?�SU�F��Y�d5�V�����9�����J�³Q��$�n�m=nÞ�qW��J�M{E�3E��G��bcAfe�ޑ.�s��O��/;��{7C1�4Y���RY�m��w�OR�����ҥ㗣�qE-�?�Q�H=w=�n�F%rFC��.��z+��<����i3�G�[��1:3��xG�"v!���+Lu#��?"1��T�+J�m�� �ޕ,B+��<'!!���-%G�a�9$�tk'S).c;d{�w�-�I��7�h�%��\�J*�]��Y,u<Â!&R~�Z� �U/"�:��0mM �}����rh%}J9q���XVAvz�� �NE؎�U��<�[������Ư~�p��5�T���R�3/lC5�MG�#�6�m��/C��q�[u��fdE������/�{��y��w�2N��۪11�ן�Mbߒ���4i�� jՀ��\},b��t!l2J��"�]�ㄎ\$�;�>�cF�Z��t���͊$��e01�e8n�B�d᧔&~jȸ��X�лY�&v �������"�����\~�������6��_����Y�͒Ki�WKO�*����HË0��a<(��4�%A��D>9Y֡�G�����@dX�>� A�&�p������[E���&B��p�S!��&��Z�ٽ��*p��^���NƜ��������j�:����7U��sZ�ZMdZ��%�V$�'��ĩ�w�aL��k�ԯgC���N�(ϱLN"[m�m9ۮ>U�*���T�y��IZ�!m\?D���j �]xr���\8P�̠��Q | s�� a�#cBE�?�#SX֖��RC/!�DZE����O������4U�䚑N��p�,���!��Tn��w;%5���{���ݹ?���b� � m���/���k���>� ҡ�7C��b�.A��ۇ�ʔD���MFR���'�*�@% � � ��-�QXd$��Ƅ�C��BV�d��ӗ���DI��(RZ���J6^���'4�g3X7wS��A���H8�V�.Y�����F��i^���Ȅ���J�Gm1�I�ƽ�f��!�in#M�� l��ʊ��g#T�w�@.�-�Hް2ID0�TL:�� w��%G�[���o�}afuB'�z�γ}|��`u��Bo�� �+>��V2�\��g�L"^����+�KgqF�m�G���Ga}f`L�UHZ\zU�S&���7��i?�']��$�I;����7x�+jH}�[�fϗ�)���vS�K��pi��D����e}Qxʐ@0�L;opP?���P��� ��t�m��:��) ��mb`k��P/�2 ܀�����v-��0iw"P�<�bS�C<��� �Zuc̟�K�Pz�%���v���u.q��|.G6~M�������-A�;��_��ׯ �&��W��q�?�o\��Ycw���EJ�+��. �"��Z��-Dd�*�Ϳ!�_�������ŗl�( ������64 ��EAϯ��ld�`U;Hd�^��_��2Ä�P.~��8�a:��N�<���5����ܜNʯ]�ب�顤�K�a��k�cȑ%��� a��N����9�����IJ�e�l �1�!��?�my��b��.��������Y�lvx��eWP)y8�;e�$���s{�c�r��0�" ����h�]����h�X���ߐ�����:�h�g�4@� �'���Y�M���
Static task
static1
Behavioral task
behavioral1
Sample
7934919719f200be0756a8f4cb0db1dc.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7934919719f200be0756a8f4cb0db1dc.dll
Resource
win10v2004-20231215-en
General
-
Target
7934919719f200be0756a8f4cb0db1dc
-
Size
116KB
-
MD5
7934919719f200be0756a8f4cb0db1dc
-
SHA1
8de4d60845ee68eb5cf9cedc1d04fa07151a1bf7
-
SHA256
448e7c0561712646d663caedc2eecc9dc7375ef2eca4b8ecee1b2cd69938c222
-
SHA512
896a22f3317923cfa573944cc77b87ef553b955552315706e2ba91642b59d252ef176b802e8f17f8f10d030332e652efd1c2feb9c7b7ca6618549ed8197e0cb0
-
SSDEEP
1536:DSITOQsLoJymNPpGHX0/s2HoAeMvm/hv2/BMMM9bPvr8ewFRtz0GnxtIze9kx38C:DMQpTPEHys2ZeMO/eKl9bPviyGnxGTp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7934919719f200be0756a8f4cb0db1dc
Files
-
7934919719f200be0756a8f4cb0db1dc.dll windows:4 windows x86 arch:x86
e31b445994e79faf46ffc9e893f72161
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
jda
?createHook@@YAXXZ
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xssd.vmp Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xssd.vmp Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ