)Ay�<�����k� ��M0�����\�����kM��ݸ�O�&����N:�ζd�~�U�/6K8�C��7҃�m����!#K�N�i@_��J������%*+;�AشW�tQ��U������'�sX� ���nV�lK��(+[Ԍ������b�D�����N!��{~��γ�t���k�^�dPR�T��b}��"��94�#cc�u�"+�Rs��;dfm`���d� SӨ��ݹV�����oc��Y�Q%,��ӄ���>�1�� �Ƌ���\�j�}q���M���]������F���́%���� Qu���Q��7�qLP�+�O65ݯ�����X�* C������ۈ��6'��5������!�WHy�KvZ��xF����� �aG�5���9�_V�u���<����v`�r�|Tˆ�m+����?r���� ���ξt�|��-pq#"�N��|�Qo�#��P����{�Mf?��#�0lw� aw�&�>M��X��;? nZdC�i���_��H�I�\[G��~����K�K�i<��5�k!r��N���H��e�a'�=*�(o�2Y �V� }f҈���6m��9<`|������]��q��=b�����bc��$��֕b����_P� ���r��.k�.P�s���$� v<6uw3hNbIWߊ�2����{)uO��J2���pt!��D �6m��kz_�Z�;��b4 -�c���ࣹ�+�����f�}���3��u�L�p�vZ���+V|�M跪�^��݊�����v7 �5!�.%����w��(���0>84Y^�E�ԉ���������~y�1�K�|�e���.��8#�+R��1x�U0PȲ��ZV�S����/5�)��<8:{k��ɓd��;8�2�̜��jV�WSu"��3pM)��c&�>���~�L]�ތ�\�_���D��Y7D�yͭF�/]���4ı-�<���QP� 8�ả<+L�,��E{T]�C_6b�>a�)�"�m��q�*�P�����6�f�{�iD����z2-�)��rq�7��V��D{)�#^p�9I56���~�2�[{?�Z��祳���2�(6���˂�$ܑ�"��,� �Շ��}�^:�~Ua�[�S��Wnji��~6Ue��RI1�����Sdl�Z�$@B� Vi%>�z�5 �U" �u�Y�t�喌4a@/����e���@��pe#n|w,��۲ϡe`�����q�`ɲ��t�k�B�ϭ�����]�.���ߣ { d2��S�4��0�\^��Nf�����J��}��1^B�1!�`��K�N/@���eah%j��di!�@���sp�=�`]xic�(�*�����(�4fV��D�yJm��{WM#��#�GYTmQБ�OA��mH}rS��D��D�x ��>���7���C�\�Z0�ڿ�c��>R�<Q�<�%Vgin吣�%W>��2��ee����M�G��ÙRa�Φ�{[��Z�v=)Q�l������������v-��ۜ�(�G�w�#4P�j���,X=Sh��@��S�SO8�S�8sʮH���B |m�yX|�!yB�i���9<�),)�7�2�Ν`BX����THds�i��7rطl.���sѰ��?���J�^���ۋ��r��VOh��ht�Z2`��R����@dV� {��|>��j��)�I+f��/��9�{S�Ga�A���řQ���͑����\�ɣ?.&�Ca�i�Y�>�sx|?���~��:t�$�dR#�}�n^�'t���Ԩ>��,Mf�'dw��m��r��q�f`.�Ƿ+����يs�$>J�C��C��<DIg�i�h�� ��kP.ڐr��\�sRơ�}���}i�ƺO���r��d�عT�Ѳ�t�����52��9� �����`-�r��w�� ς�]y�j��}�]c�v�Oc�f�A��r��)`8����M�̖�BC��Ws�%���GdQ�?R����C�X�س�����%��F.ԑa-K^'ḇ9�Z��$ev$~W�3.f�{�G�e�uW54��mT�r�.��g�Ǵ��!�U��X�If�=�y#�L�hu���/[����3�v�C�)m��F��Mg$�<�@��x���ny}�&�G��lS�*�ٓ� �Zv�p�u ��:*uX���NIВ�r.��8����;61U�|��m� ��>� ��"'�,��$[�t��Y��+�k�� ���9�f���5B��9R����R�',�3L쁷Qڠ�qמ�F�`H��G���{���c�8AP �F��t���Q�?:˖�� Ѳ����W�v7J5�Y�T��tȨX�d�d\�g ��J)!i}h|۱.�,l`N]�&U Z��b/��=v�b7�_zm���8�0�b�/A�PF���vlQ̅o��ܕl��#���"z�8*~��=5۶(�,�"�+sy�T~^�����U�6E}����9����H�W� S�#�՛��2��Nie�RV�LYLx+�{~�z�(�R,D;���ZP�Q1'��ײT$�-��ge�fs��/NnvL5{��b~Ԭf����S��U�����#2d��^�G�YW"Hd��|գ�#�*��&�s��N�1�K$�W\�E��F0��3F �Cu�d0�@KިK�]c�7Č�ꂵp��D���Az�<do����\d� Y ��vUPtci|�{�*�d�+�<��ImӁfN>��6.���{�c�r���\G��⌇�)*D:�.����sJ�`�cF��B�Y�9$w �A�����o�(v������A�Ɓ�OM2\=�ƀ��c��5�/.�v*�&Q}�q��)�7 ���\��qҚn���sMa�W��J+vF��4�y�`��Iђs���'�}��^��$��^�AA�+���x�����^��]3��ɬ�+Nd��n���F�o8���{R`QE���vV�� �_����;GFh4 Vig�;)����^U��I���ߓ����Ď��R�kL���8m�Ժ�sV߇�=�}=���NL
Static task
static1
Behavioral task
behavioral1
Sample
ManaBars.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ManaBars.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240221-en
General
-
Target
a171f8ba7245805b39998670c66d2246
-
Size
96KB
-
MD5
a171f8ba7245805b39998670c66d2246
-
SHA1
ed4541e2453d27fca5a92088b71c7cd19818ab96
-
SHA256
8790f7c5e30df81d149fb13cdad3b594adfb7f66f46b03ad93aa22dfe792dab4
-
SHA512
2c0a1f0189c3092d848b24b65b11b2217e5e65a52c084b402a7bd1041f82cffe16a4f13bb3edf020dc7eaa59588249ea2441fb4e838dd330725fc2bc270731e7
-
SSDEEP
3072:UHa2ULPGdOHQAtAxAUsJD2YXmYCt24iqGLDl:UHTUzGyIAB/vCtJ/Gd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ManaBars.dll
Files
-
a171f8ba7245805b39998670c66d2246.rar
-
ManaBars.dll.dll windows:4 windows x86 arch:x86
6e31aa927fe034e5feaa63a49c3cc36b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetProcAddress
LoadLibraryA
TerminateProcess
GetCurrentProcess
FreeLibraryAndExitThread
ExitThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.175Yo0 Size: - Virtual size: 264B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.175Yo1 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.175Yo2 Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新云软件.url.url