�S�u`�����f�-�0� �P1�>�Do���V,<7�F�do2�L����lY2�#�z\���7{UU̾+�1�:�Wz��H�m���W��R�����W������Z(��v-�ڒ�9��q�h�mf��څĥ���!c����2m�� ��U�a��v;�@�:��D:�|'j�b��hD��rB��ѵ#���#���QU��8�bC�m�ף�T��[����7p� ��+�dD�?�X]��?B���G��_���^ ��&4k�U��dM_[onD_�;�NS��_;l���P���pL�@���tbB{�T$�V����~t�� �����9��yQ�8���T5�#"oh��4f`��K搆J"����P��"��B�J�_e�h�k���37�����@m~S7�9j�>�c��0��`������H���(�e�|;S���pboI�I-\���2vm��[��S&����1 ���ZtT�?�Y���Z*�[Y�[[��8�O��2���k=E�f�w$�Ew�P�ҷ��2�4��aK;���D6���|kɼ��A���Z��!Ƙ>{mAo� �=�'ϔ!�|���������]"����y��r�`��E��a���[�\zTl�:��X7�lZm��Z�֤'�"�j���q2�,����b� Sz�z~�WCK���-Ѱwp��kZ��H�,wI������`���P�L��4|�@Hg[7�.���0z�T���^�˩�M�;i�t٣��(��̛���CMx��|�m�+ 1�w��e����{V���!�g��e��b��9����6��>3�N��WY�a�Cu�r�v3iU�� o�Ҁ��n��g�{�⟦���\I�� zܑ���ţ�:v1o�������EnA-â_��NDq�VYp��_"�<ZM�~�ō� �wt�O�* ��b������c���Xe_�i2��e�pc����mE�!g9~t|��}����J�|Q�@) V;"#�'!u4�1w��,�\���v�t������'c��]�;� npK�}��>=�#�n2�.|.�R~\Rn��;YRЖ����P���8Z+6d� �W�����'��|}?���}������z ��� ��U�Y�@um��j�8�8 &��|�r�6�%y:���ө��7�]~.r��}���]!�K��E�����,���H�R�����xڌp��ȝ�8�Ϯ��%�U������ga� 5���>/�G�bѕ�fH��xpH�1���'Gs�G�4�w�8Y���X0p��)oA�a�26�������U�w&���΄���5�^6�!��KO*#�;���h_��`�a�,�T�}*nL���.r�EohS�P�*YΛ8��#��vK!�g��z�]P����Ym�4������;>W��&O��^�lآ��p�����L�U�� ~C����b�=��l�PJZ�y�dv�c�*t�1���e�������6��dE�*N��)� <�k #b�EcqX���D1���-)� ��L�B�~�f����\��*���E�I�wz����پp�C�D�=���f�(pV$YX�A���ަ��Vu��*K"y����Dgo�����ɰ��0�I"���.�-�M~��*�$�m��Z�"�1��U\P��""�;�a=�o8k���A������QR��L����H��t���)_�ە�a����3{�3h�kE ��o�<�L4-x���e��ZX���Y�U�W���tZ�LF������� pYi����*�u�Pi6��Ĭ���e Y���l�:��e�����`�[^��E���D����Ea�!?�8��ص��_��CA�ii������56��N�2��v[t5��!Y���ju��U�ߐ�L��[�n.��멧?$ �H4x��]��u�#H��D�v}�����5u�]�����f���Ʌ�1�s9 8U��+���H�;#�X;����N.���5!�zO����Yb��,�vJ��c� ԙol��|�b���0%�S�;.WiF���9� k1{;���:Ҁ>�#l�v�F���G3�A����`�وb�S��]]�W{ s�Z\�",���<E����S)�E,��qn��7j��Ret��@���ފ��2?�#c�D�����&��� ��U�u�P��&����W7�,��9���S�8�3�>wm��5j��n����b�x~���Y�WOoF�:�oժ�p��h|���7r�=�����[F����e�������&;�R ky��'� �1����e�/�9���_Q<������2s�Z�w�T"�����W?P�$�H���3����5�y��{��؎��we��U�U��`��7�u�xؘ(:���2Ϥ��?P_�LX�hz7�����E�%I��� A����U�R��Y��d�+�iQTd�!iն��F�����=����wU�n�8���q�b�-�x���u~�6^���|X�B� ���\�@� * g!R��q1�僃8n���X2�9�hg�Ρ_�o�����Y�X��@�V��x�f�۴� /���,�ds�#wL�lv �aX�ҸNJ搘��;O��xؗR�$�<�+������P������r��~H#«�'A4�� h�杝Ze�w;PC7������6�.�P��mF��� �`���YKv()A�α�ܜ�\��[����;K(���q��UX�J�;���?(ܶ!��U�.�nތ� V�uW5��?��������zblB WƁ�D�y�{���#���W���9G����J��пji3n�V�P��W�ХW/�1�����4��M� �Î�^���g���]����е���o˩���]��4( ��������ڂ ���t�#��?zPZ^�_Ƅ�FB�qXd����%E����g��1�^�763*X}�W}���T0����ޒI�)l�+��)�캌6���(;������� ~maQ��~���k�] ��QC���(� ָ�v�nZ'hVsa������$�}'�ٹ����- �i�y�6���������6��پ�����4ŭ�U6��
Static task
static1
Behavioral task
behavioral1
Sample
fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b.dll
Resource
win10v2004-20240508-en
General
-
Target
fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b
-
Size
1.1MB
-
MD5
f72d9d878c9f3fff736af226d74138b1
-
SHA1
90bf02d498820a51f794134d760109689d06c14c
-
SHA256
fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b
-
SHA512
40fbd258d32a32369c62f135b4dbd2208936c294a5c1f29cd6d993dc6a00bd289e74efa0367c74df169343cfbb0ff7733795f10976dd238c63c9b14874d8fade
-
SSDEEP
24576:a33PJoGtrcoWoHFP2oBzqcsE7XuhfWYZwmSwxovBStTbS3uIsjwWv4ZyN:ahoC5HsLY7gvwhN3uIsjpVN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b
Files
-
fd6d619f32068375259ecd0b63b16b1873b894118f6a13102510199e636d0e6b.dll windows:5 windows x86 arch:x86
10f823ecc0f64126ce6db12ec829b364
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExW
ReadConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
Exports
Exports
Sections
.text Size: - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xb0 Size: - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xb1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ