�I��ק�|uZ�Z��ձF��7O�N�{ι��Iv��~���RrΤ��l�P�-�/HN���E�A�ʇ����{�/�����C ;4e/V;����f�q3R.�~&�����j��@����[����~��ƀ��[��BW�E,���M��@>l�e&�l�_�TL�W>���d�2��E����BT�ĺK��r���筊�4�jg����N���pN�N��� a��&ޯ#�f������H�����(}�dG����?���i����='$��>#��w��\#)Zr�ۿA:��y�:����ҍ���M�3��3�@�(1hZs�m��4!�Տ�=-�V�p���nc��X���v��8�Ėz��8X�A]*����u�38VP��Ì�H0W��)D�M�#�v=&���q�F��'o�<�/�я%c�~q�mH�r�bR�D�`�@��O�~u3���\~���h���A�&��ԓ�m�� p_�����^�\ɏѿ�U��&�D#�Ju�����v�ꅌ��L�uyD��4������Bym���G*_1�ږ� ![c��(zY@���$f5�-�(�K$R����Q�Z� ;�$��M�t[L�B�dHer,耘�+Sxk��2֪�a� Ϣȓ�`��~uGm�R� �F�3ä֒�} v���M����}��̅ߠ�p�_k�74����5e����\<C厘N�(���B�&+a�YG�;��O��;�� K� ~���vW!���1rV�������Bƹ 5����+��↚<,�C���T�����H��G�Xg���B�P��1�i�msWrV]��-���2����'�d�ER���sm��=�}ﴼ�ɥ������N"t�tX�;����N�ݑ���2��6��ϚͶ<��cCnK�������g���X.ѐ�r�\�@~�h�r����ߣ6�IB��Q�B��e�m膘<a����oI����LbCۜ������kE��,�e>5*6+���6�9ݥ�Qdܴ�� ��˓�^T��������A�������`^D�u?�H�%`����i�[��ۻ�k�(�D;�aK����u�� �ifk�/ߦv�ء�X�g�J[ԅ���D� �J��˞�sr�^����b�;3�-�{�N����B�WRXm�l"o���e�3�U�Q�m��Q�ݧ�ᾋ��b���!3ú�[����m`?��v2㜩���Ln�.R�^Odk@5Θ'��4ia�S��8����^�T����$�6mע��l �ä�-����¹XA*�����%Y}3�����jR�� � c������ݾ��.e�12��{fP�x!�^�$��ʒ���1�5ZW�җ ���7p]"m�Y�-1uYBi��چ��4�e��Ѝ��XU͓���W�.�x�.��n�W���7��D���')#�:!�g]��yus����'o?ua1�4'Z���M0���őtD<wV*)���[j\��ˤ�iO[���l�,�H���0��]٨�����~��~}GD�Z @�O� �է�G�a{Z��e��L�Q^D#�[O�-#����da�@.[7��?\�n~_���T`^���"ku,�4�r��ԝ������>�Oڥ�V�5d����r��>��+�P��l�ĸ%���c)����$ ��w坣�'��I�?�ȱ�S��q�����_���~��b�ӫ���U j8x8�qH�'�!_am����xު!��������]�ez4:&�VO�?��&�Y����P��G��R��v:�T�QΚ$�a�@��|����OJ�:���F�����!?=�.���}k����U2��m��A�)��C��g����"�Փ��~IBt����u����D���;��&��U����b*ѻ;�EO)eݯ+���b�x���7`�P�*�|;M�q$��9�|�Fc�������f��W�S��z�W����ސ,��i`�!�f����Q��\�% ֟�ka�2��g��(Y�VU8Fg�J"�� �����[�������#�Yp���*�GImH�������| �V���ݝd�h�?˃�-�`����^^L�|�`�RB�dv� ��J쒯��!%����#��3�0��ƃZ�v9h���\8<�f˘�aYG��1�e��|��w���:q��d����X!��b~���H! ����WɈ���Sv'��Vb!�s��o���� p�0'��M� _W�Eè���Q�-��=�����KݼTR���K�3�{<Q��|#Q��H�Q���8��³�d-�8���f�ǽ�Nd���h%ʳ�B��u��J>�S2��V\����=z�:�,ȁl���U?���!ɏzN� �$ay���首����=L�[d$��X�ZZ���~�3-���� [��<h��� �C�� v��뫄�d:�� G�RY���2,f��b4��;WQ2�*���ܫ�=L5��gIa���}�4��{�S�����I@)�9'�D�z*I���l���.+N��������ɨ�0¬T�9kso�<!<��hS�T�,�l��{���5��(������n��-7��X�Qzmܖ5e4/����Psq�ce1ىlٸ��p���e�~�������O�rA�$RP��`����2�/����HPNH�pu�c�ơ���`�Ii��|�k���b�X�g�@���I;���ݥ}1'��¸ڰ��7oB��`�u!P}��ܭs~>N� ���I���ˆ��8's9��H�������V$�"���!���O'16L����7L�o�P�m��b�����S�S��A!����5��}Ϸ���b���oܮ����J���E8U��Y����L�d��|�m�mH��Z1&��#������e�QQ�R-o����C��R���&�їN��`C�Ab cIg��]>V5Ѝr@:�=�ڧ���2�D+���.Yn���k<�JbbW�un�#��oX��Dw�\d ���@Yv�%w�G��oJ#;��PU.@�t�P<.p��4 �OZjibK�<������ǘ�'~�x}⭞��1��h!��R�
Static task
static1
Behavioral task
behavioral1
Sample
1911.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1911.dll
Resource
win10v2004-20240412-en
General
-
Target
1911.dll
-
Size
8.4MB
-
MD5
56e414d084e08121889741056246707b
-
SHA1
4fa15c0903b4cc785bc5738e4988a033dd668764
-
SHA256
f95dfcf78d493552f29a27421e3192c0b9bb3deced06faef25f7a7d2d82935aa
-
SHA512
0899893392dac33fa191c57975d3861346efa71cc01158405547f07896f25cf21eb53110f950c989c88ddf24c7e0bd95cd040944ab21e1ec13d4912720d49153
-
SSDEEP
196608:wiFNxYBsrL+GwUnPvSbuNVofFpKM8G9gks1m0owsXukGWf:LZL+APqSmdH9gks1m0mfz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1911.dll
Files
-
1911.dll.dll windows:5 windows x86 arch:x86
8571637d91421c67025088580c89a3b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
opengl32
glScalef
glu32
gluOrtho2D
kernel32
GetVersionExA
GetVersion
SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowCursor
gdi32
SetPixelFormat
advapi32
DeregisterEventSource
ws2_32
bind
winmm
waveOutGetPosition
Exports
Exports
Sections
.text Size: - Virtual size: 574KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
19110 Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
19111 Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ