��|����ֶy��p�q�V->��]Tg1���L%��cZ�6�[�5�m��)�ѹ���?�|P{�ua�����g�h�++co ��ޝ7��Ʊ,�Il��{s�9�$��Y)�K?��x�ʢE�@�_b���ǭ�� ec�#a� -5�h(���2��^�:NLJw��i�-]1�tS�+�������N��ms< {2):H�]^��(�[O^ �^�o�)Ï��W+k� ����9����ט����P_���p;A7�����o��f$-6�S��?ضF/�^xYu�\��Ϯ�x��$#��NI3U���2�Y���#v�:�7����wH��-�?w�2��m'��."�_u��oց ȋ�Q���xm����.����ġOF"���£IW��!s�v�ME����Q��8�ܙ����U�R��&*{uaB?�� ��P������7gT���CS�y��"�IUy�ڹo�/7 ��K���A�y�r}̋����j���s)2n����%"��Ic�lG�E1<?��s����ׄ<��E��C��$[�C��];�O����=���u^��ui�$:1y�(GhDᄠ�����qAG#��E��!�m�e��N��`�Ki>L�F���Ǝ�p�R��,�����A\R�� ���R�v)ӨN~Г��X��G�+2BF���4?�ߜ����nBd�ݔ𫄔���c���lD7t��S%9��|L[(vn7�'�ִk/Ӕ/�!�м��"&��$����q����]�0A���Dˁ�{���X�+.lh^I�>_l��]f&�Zs��na_�A�"����#׀�ي�� ��b� T'G���,'/����X����a{�Z�VFHq�f:*^B�[��}D\sa]���|����rv �{Nbq}v�ʄ#`Z����{���C��)����0;o�EB��j����*��Qͯ'�̏A録Й�]rW%�t�MM�����e���kw��ѰLPAF�T��*���$��`�Q7|���y���H�G��P�wPY��p���sD��z}~aߖ�-b��(G?K��Z2��iuN i�(���[{|�[���� �����bޱ����P�����6�����b�����5�q,_��W��")���ޭ�Kh�jRGI����@�c�d��Z tZ.�}'�o5���T6#(���T_�LA�v(����k�).cr�Vӓ7d=��,����^6Xx���tR|`NOk�GG�%�˩w�u�u�`�\�]]�36��^�)A���G��ه �F�<q��q�[���� D�))�`Wڲ��H�;�%#�c�!1��g0?}����������� P<�)Dt"H����P,$�L���|<��X9�jqUl������|Q�]%��x�X`Ο�M$�g��uyriM<��4��� .8���q��r��Z����m;��TK�Q�·5�(�k�Y~��S��UFŭ�ԙp������v!���C��pH3�yܰ�g��ph���2�}�9��$״;fLZ��j����.bK����o�A4`\�9�tq{�CG'�h8;��r`���9��ҫ��δ �1E��*��Jh�ڧ�J2��B:E�+XW�;k@�y?#�������ay�!�Z2U*�������UN���Zb焰��m��M�a8���d�skr^�(Oa���pu[�,j����0��'A4�y��~C����y'���&�2F��8![�k���3��փ�C�����A�ʠ�Z�j�|9��?��H�~`�%�gLA��8��gR��%��c��~a��[<Wpˆ9W�r�ŋ��hԧ��q�,��&�A�Y�Zށ}��˟�0&��T� �M�[吨����O��}���K��dC�*N�:�t���5k���L�����w�f[�+��b7��D���AX����@������/r ���|�*�w�9`�F�f���ԃ�������h���D�9��\�עAӿ�����^�K�U�+c�G~��+,��R��c�0�������I���^4��(��ߺ�ԛra�e���d����6� #�v��9�V(���J�{"Ƶ{GD� �����*d���T�[�����7gN`b[W��t�;�=��}�Qk|��z9z ����D�v`ͦ�}.O��&D$��9ɜз}�nj����'��F�G*?WO��$���@]�`��Wİy���j��E���R)w��ht�V?�Œd������ C�����Xx�܂��fp��1lD�;����Gj��Go�a��0fi��t���� �:�u<hdm_����I��?���S�zh~�s#l��|���{<R�t������5����߶$���oT�&n-��7� ���y8�ߍ��:�}�N=��KP4� �5sŻ�A��(Y�����[�Y":��jE�����-�P'��ߞ$���b������ߕ3�U�1�кL�������,�HBp��x�'D���$ֽF7Z�v5�V���F�/�~��8�9���������Na�����au��:h'�2�Abu�셊�,�zq��8Sw�ی�� ������F�Yu9`c����[ǯ�Pܦxb�Iz�w�e 8:����g�S�S}[~��4�Y�Je�P��S���u7�c{������Q���D���'%����et�+�BC����!�A�A{��<3d���r���)OG+��@�t��0/�پq�$�9�ݓ� CӠ%>� sHt:)V��|��^�G����Te�1�D"�{�I{9C'*Rjf-�_��GfvM�Ճ\����U^�kb�h��F��ԯ�~=/l�KUO�%rb����j��V�G���L��jRMcV�6CV���|�X�Ug�o)�2I���F�q˳�_��f~;Ֆ¼����Dz��a��Q���P�8�r��ѣ?�1t��C)�q�a�s�X���~/B�i���;��� �g�Vۉ ���ŭz܌��M�ۈ2k��>�������qk��"� [�|z�B,�)6ݸM�����#�w����OTV,�H8��f��s��+�*/��b�{�f>P`�0��~��ɭ�
Static task
static1
Behavioral task
behavioral1
Sample
bc55aaf7e8387f5d723bf851c7119aca.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc55aaf7e8387f5d723bf851c7119aca.dll
Resource
win10v2004-20240226-en
General
-
Target
bc55aaf7e8387f5d723bf851c7119aca
-
Size
429KB
-
MD5
bc55aaf7e8387f5d723bf851c7119aca
-
SHA1
f5ddedc4f2a194178d2a9c65f54d973ba048edc0
-
SHA256
22c2aaea3b8b0658035813fb3f6d272eace37ffe36d19149ac455e2eb2be7b9f
-
SHA512
978aae8088ff0bc6d253b3ba6fb0422180dc38c3094e4ba60f9ec44742ebb17622ae74e5c1e9a6401a555e58bdfe6560f76d101d5421d40f4f964fc0cf9e81c4
-
SSDEEP
6144:TPD6NtyO8ew/dK7cAZCgGw15rF13icivUuYxAL8S6r0NHlKfTuOP8k:ukk7cAZtZjicivUuYxAgS6oNFKf6X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc55aaf7e8387f5d723bf851c7119aca
Files
-
bc55aaf7e8387f5d723bf851c7119aca.dll windows:5 windows x86 arch:x86
6c0d54bf739683472c2524feadc32b69
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ResumeThread
VirtualQuery
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetThreadContext
SetThreadContext
SuspendThread
GetCurrentThread
SetLastError
GetProcAddress
WideCharToMultiByte
lstrlenW
DisableThreadLibraryCalls
GetTickCount
TerminateThread
CreateThread
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetModuleFileNameW
GetStdHandle
GetLastError
GetCurrentProcessId
Sleep
GlobalAlloc
GlobalFree
GetModuleFileNameA
GetFileSize
VirtualAlloc
GetModuleHandleA
VirtualProtect
ReadFile
SetFilePointer
WriteFile
CreateFileA
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
RaiseException
HeapAlloc
GetCommandLineA
ExitProcess
GetModuleHandleW
RtlUnwind
DecodePointer
EncodePointer
CloseHandle
GetConsoleMode
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
DefWindowProcA
GetWindowRect
BeginPaint
ShowWindow
RegisterClassExA
CreateWindowExA
GetWindowDC
DestroyWindow
SetWindowPos
LoadCursorA
GetDesktopWindow
GetMessageA
TranslateMessage
DispatchMessageA
EndPaint
MessageBoxA
gdi32
GetStockObject
CreateCompatibleBitmap
SetDIBits
DeleteObject
CreateCompatibleDC
SelectObject
DeleteDC
BitBlt
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ws2_32
send
ntohs
getpeername
WSASend
WSARecv
recv
opengl32
glTexParameteri
glTexImage2D
glEnd
Exports
Exports
Sections
.text Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ares1 Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ares0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ares2 Size: - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ares3 Size: 426KB - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ