�⍁2�sc��l�m�$#�x��'�&��}���C��_,Fek�������d�Y����ȝ����Ӑ�@>{�p��/��N���k���a:`���y�G{P�p/�.��b�iZ�)2O��rmH�1�o�K� ��[]�@ U0ߴھ�d�:8�]�T��c�cj�]����FUd�t���L���ŋ�δA7!��G�^�Qy��G�W����qg[�ĜInJ+L�e����D%��?y�S�=XV�O�g*BF>j�˾o����~�>9ʑ�ĭ����B��{�6`��~�ӴUo���j��v�o�!9B��n6�U`)~N��\{eD:�2KُB��u�ؿ�w��=�Q�>Y��z��^ts����#�>p�%�(�^��m��N�~3��x��rSb���`�۟�G���jn<({e�3�2^S%_wnU�Y���$�� �����T�"��o]����+�g�s1ҽ�%�wZ{�R1;�����M-��Z�{kC�R$a㹔~ş��}][9�OY�(;����[KQZ���z�U(e|�RO��#�O'����o?�V�'�~1���o��:ΐ�:DFFV;KBד��\�x�{j?��2��&�scB����T��>�(���2̜��H���jB����ґje3���m�.+ ��@�6��l/s��Iة ���k-B��/�K���n��7ʜ��($�T�sDҕRN����H<u�V��.��V�s�Ǘ��T{����_����f�Ff���r�p�7��w�yg���l�2怕2P������|P�x�h���ě*�+�%C��C%�ܙq����wf��]�Dh���S�>�E����p,o[JFst:7s�G�b.�C{�Z��K!�����bk��}�7�X��B��R@5� @�7��+�O�fT� 0?�G���d���M����n�%R��*K˰��%����H$#�� S�HGCS&=ܨ0��|<�,$��h1�~�U� �ع �.�����Uq�n�F�x�x���>¯d�@i���� ��_���0��oxe��X1a��G�9i'8��GY�eB�9l�W�1c=��=,ylC�e^�f�E ��Y�@:Mv��d}!����<�+�P}>�_m(�-�i*���]��̳����� w>Ad�Fx��"��ɺ����]��^Q6�%Ϊ���r��a7p̯z��n~Z ����U��e<g����āl��x���q�m^�����(|��)��p?����Ep��H͘I�sI8���)oс4ޯaHf���/���I�37EV@U����7<Fu�;'!�z��c�۪<h���|u��$�v�$�x�1�(V*�bB-�Aty!VX��p�W|?w[��]e&�vGJ�G�D�^�tw�μ��ŠHlƅ0r�`��?o�~���~* ��^�V����N9��� n�!���>�� �A*�]�yc���e�S��_pF�*&���9/*���A��y� �S���H��j#�w���=:@w�"X-����X��G�3�bO���Y�nK��>�C��%E��g��;���.��I�C�Ȭ�eP�,�o/�e��n;��/�����N�eQ]]@����#����C�����Dݠ=Q�L���%�G9R��IإO�� ������TJ��o��*4u�&�lDY���R��,u�/��m�e�2�?�oh�[^�f�*�}�LːS#�@���˯����"�d�o�ղ�V"��oC�]� M�v�z7$�wC�Ӡ�z�=��7%!E�^+z��i�TV�����\#�y+��r��u���N��Lx��S���C��'�I���b����7�q�s�oWd&CU����n-���~ź w�T�������E@�g��=�4��F`�ڞ��@��8�xX���;����y�1G�y�<Pa�)Q]��������8g3#�5� ��B6����)�<u5_R�!�_1{`�'t�Z��P�%?x5�������r )z��ro�+�CQ�F9����8p}���R��u��o�I��_�ނ���j�K�x*Ia�O�Y<���4`8��m���A�O������,��_c�6ğT} a��3'��p�J����)EVE��ls�� v"�N��gX�k�_/�%p��jAj�4Hd��a����S� �(�u�me<>8:x���ɘ߫T��q^��ZCz�²(�����e`ᐕAA��ݛ�F��I˥kH�[5^��m�z����X��������Sc�9xS��Ң����qg]b�Z�lIR�aŊ����2��Uܷ�R�1�f��3�qI6٦_�vYA������ȇ1H�=��^)Z��&ζ��7�5\���ǹ9]���e:��13\���1�щ;��+��R����YY�E"R��f�K���Q�o6��n��&�/��yLr�Ԩ5p��" ���Ó�f�I䶞��h6�_�]��<7u�%p☵����-�"~ߏ��:i�Z��'�v,�h�R{�̊�+���Q�+� 2��uސr�1������@l�D��7�:5����L|<�/��*F�$nZ�1�/l\��I�6[fe(���u'����YQrXM�������ر �q���|J�mu�i�����˃����݊6������[Z�k�"���$�R�=@�i���lU���[����oe�֦ ���#��l�͊8����f����5ﬖ̈́��8 ����xk��Ng`v2���6�Q��Iu;��^\��:�����c�gt��?��ɿ�bhw�\/p@W�K@[4��3��T�҈��fy����z�▇��W"�E��9|�/"�# Y��En7�U�6�q��"&՚&�6�����0����:[�T��]�vc ����'PX��k�M���wF��`�Rq��|�GhC���-b)�n"cy�J�l������@�c��7�P��{\���t�U�2ԈFu���$¾}d\�4�*q��q7=�`� R�N�C&U�[1���w�I���x~�,�q�_=ߚF>0�,�r�+����~k�5V=��13C �z�ה��� �D�$�ǹ��B������ɣ��G�.��Ca`zNo��v�I;�
Static task
static1
Behavioral task
behavioral1
Sample
9607603c1570ba6035971d4c04083313.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9607603c1570ba6035971d4c04083313.dll
Resource
win10v2004-20231222-en
General
-
Target
9607603c1570ba6035971d4c04083313
-
Size
969KB
-
MD5
9607603c1570ba6035971d4c04083313
-
SHA1
c40ce679c52a93910f091a75d9bda90e4c16b779
-
SHA256
80a88ebf5fd8cd06d0fa3eb5473a105dc8c65b4220d97504f8df91c4b8e8a820
-
SHA512
a8da49e90e995fc61e555c3fb25cf6646a50ddd2c4f45425525a5684ccebb3ab659af790cae7c811f0163c0a07f40bce752d2bd220bfad2492259004bc61ba45
-
SSDEEP
12288:Hk+PiEob7gOQer38exkXOfNDaFzVK2hd+XzNcmVNKIT00B4hAqU6OGh6g6MK:Tq17gXe3KOYXv+zCyLRYU46
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9607603c1570ba6035971d4c04083313
Files
-
9607603c1570ba6035971d4c04083313.dll windows:4 windows x86 arch:x86
e3f3ab5637d540d0e90cb09d79b21690
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDateFormatA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetScrollRange
advapi32
RegFlushKey
oleaut32
GetErrorInfo
version
GetFileVersionInfoSizeA
gdi32
ExcludeClipRect
ole32
CoUninitialize
comctl32
ImageList_SetBkColor
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 386KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ