�*xb/9o�G�:���˾�������!u��_�����R(�$-)��lVN�ߌ�r�����=��I��Є����Dz�zX� ZZ����N�����Q��n�R'���ҹ�ܾh�э�*����2P�{�R�]�rLht>����ĈB�JSH�>��Nk ��*I^bQ�{ I��@�Q{�Slo�Ⱥ�C�m��QDm..��$q(age�R����Bhw���>!�f��-Cn����H�Z�C*��3O�5M������?�їja��.~�'���ċkvxMN�Nb"��|e;���%M���n�������L+�{X���|�e�[H>S+�B��sEr�-+�RK�k�f��_W�G\Ic�v~W������]�00�o��P�6|1p8v�k���2�V8�����b�:gU��[.O��_��B:$i� ��./����=�Fj�ᘣ~h���oh����|7��`�(����?x�_����f���b&^I%:���2����w3Y�Y~|�j)�/�4?���r�G t���pk6x�N��?���mU�4�7n�t��[Դ���n�U6�����]n��K:�#o��|���ce��{'�vl�����X���(��ҟ�B��2���,�B"�|n��O�8) ���f2�nU8��}ř}"�|�?�i�d�ڱ�J< D����f���#�5J���1����l���dm��.葏�������쨁߆�z�� Y��p&5, {�]��a���}��@@$Ѽ�40v_W7�������d0Ř�7���y�G��CK�x��F�1TFX�������k5���:-<������Q74]=c?6����o� �{ +ʀ��^�L���; �,i��>̱�h�$��z�&�g�����/"�n��O �),x<�r�gȨI%@ ����+N�'�u_g;��8`vR��x^�}m�WKV7�mާ,��qo��Y���`���R�a��� ������[���U�:��'�M4U�.mpUΞq���}4 �Nḃ"�c�1&`~>�h{X���0�t���ZK �+=��J�bϓ����j@�[�8x�l/W���ͷ��t���\!J;�t\� ~��{a��ċ��a(���kS�Q�iR�e=�\%kW��`B|$� ����%M�[������8�ك������H�]�/�����8��jڴe�*�5_[��$�[%���컃2��>R+k̘�dxEC�n%�\7�ι{���v�+�h��}���X҆(ԑ���.��ֵ�,���o �g� /�j��=��5>�.R?��F����#���V���k@��A�&&�t\���-�B��GJ<�Õ=>=��� J�� �K���8��;��|�����8��ݷɓ�)� ��,���K����� ��UN׀���~�F[��M����t2���DE�"��Q�i���RA�i����C�����M�Ms�\L<��0yN!N�"n�̐\�W�ʦ���� $�T��k$�vaW5����H���Ҹ�?���"�xj����6�+G,����nKs����Y#�N�B���/W���6S���x5N��`�FO��m��<(N3���w�F\'j�"��V~D��-��mW!G�5{��q&���v�P/\gH���7{{�0s ŏ�r�'� 궂�a��d� $��U�v2)�hGF[� �` {��-���9[�/j4g�IH�%D�߉ɒ�f��'e6�`!�˖��,hrh���ޤCP�@VY����'N�Ɍ쉲��L�c�V�>���Xh�/S%�o�'䙮���Ñ�1��P�c'[���2�B�02���P��Ry�x�pѕ�v�̼����Q÷߷>��orS�+���I0�<%��D~�yk�L`Iݦ�ܟf`Z��+���$�[�ա����̏���i�йu���������?��M�8#v�y'i��n�%��[~rU�6Y�ԓ���~>s�X���͗*�5*�1�ojB˓;�c�1��&���e�^b��h3T]�z��-���q�����";���7�-��$P��~�����D%�# ���%h��� ʇӫI���B2��ǹh�~b�^�Pn!���b�vm��Q�zވ7� %��WZ[�!�䩑c̆�����!^(^txSXU?E"wE<lj9�^���O� s�j͇0�D�.u�!q5�zϊ����*�44�5�����U9H����h�`4�S�Y��U,l�E�q�ߚIVь{����T�*�����^��h��������|�ո�6N$y�MC��Ŭ�]�{r�� ��aJ?$�([Ps���ԫ*��N��i���7�Ou��M3u獍ah^3T.Ї^� *�E��<�S� 6]��u5��)0����������l�2}vӄEʏ6��ao�P��n~!�lXIt����+�+1����ݎd�Qwfli?H�f�Ǹ���k56���'�G�6�u�DF#Uk/�O4G�b���i�����Sk��/~ �������5B(�"������A��.u24Kn�K�UP-���R�xj�J��1#����n�CL�>�%AQ�yBn�,���=���/����ޞ6!ٵ`o��\�����gܟ0̈c̓M�?9��R�dh���ړ������ry��>��� !�h��]AU�t�UEnyї����@�I'8ds0�������k���寋�� h����>ۮ�dHvu%���Yt[(W�"�i���A֍zv�(i:��C"mܐ�;*�+{�"f��~8k',$|P�'�843�ma�W��8�h�"�E�lI��m������(� ٘�iuwi�_[��l`q�k���Z���89��ۮf�]v�A�^k�.�&��%�.��ry�h쌚53~+��n ob��{f$����f����|vwUU87x���m�=3�{�^O[���W^ �n�{@��C�&]S�Á���==���W���g|<�0�缩���x��r�`5��J筲�SA��r1�s��Ȍ ��3�;rOM�3���r����{�)4���/?Gحks��u��V��j2��L>��*j���v<� �bW��Z�;\w��=��p(S.G��@�-q�i���PC����c�W�`V��]χҌނ�
Static task
static1
Behavioral task
behavioral1
Sample
79fae7cc39fcd1423f5144c606f19fd6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79fae7cc39fcd1423f5144c606f19fd6.dll
Resource
win10v2004-20231215-en
General
-
Target
79fae7cc39fcd1423f5144c606f19fd6
-
Size
1.0MB
-
MD5
79fae7cc39fcd1423f5144c606f19fd6
-
SHA1
b95ffa654759d407dc105c7afd2c68d9206a17ab
-
SHA256
763d24ba663c7f733d5642bf8950e738cdadae407d018f6a1ec939cfb4ab6f8e
-
SHA512
033396d40ebd651c74c53b2b78837c18cf61dd9238d82eb6bb09c9a1acef92cf4b5b2d1ad7f327866da734f2d8306b0de5c480c2284bed86857b6e3994e146a2
-
SSDEEP
24576:wsa9mLuF5KkL4+qXXkSh5GWpqFs5oU/xDvM2hx0:NCmLw5RvY7hPpqcDd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79fae7cc39fcd1423f5144c606f19fd6
Files
-
79fae7cc39fcd1423f5144c606f19fd6.dll windows:5 windows x86 arch:x86
fc885c198017fd7b7dbff83cdf03ea6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
MessageBoxA
gdi32
SetMapMode
advapi32
RegCloseKey
msvcr90
floor
msvcp90
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DRK_1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DRK_0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DRK_2 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DRK_3 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ