9b�*�Q�bO��~��o����B�Pv�c���EՍ��)Y�(��x9�2�ۮ� ���DPӞ�i����'�����&�0��^=\T�O�������m��ї ��\3��"�(���SN��������M$2�um�^��C��5��\t��N�!Ó�Q�z�b� X����2l���i,�q�X*1���"����*�������k"G�J�����k�!�̓2��~;�dT��E.;���'cg�)��z��Le����Y��h���Q��N�K��H���[�'h��6�]a����.25v<X���#���yS �Hӫ��j��@x�|z��R�X�\�H�s����/C�d�=�*���xUD�X����)��^��Y{��=�"+b>��u!2�%��a������0J{����%h��}A/e�:4Y�c�q����s�����T���:�e���ѻb�]���O)7+ύxaP��L���-�'���E��d܃�'�b��4-�d��y^�������y�,�ʝ' ���ˁKY\V�u9���k�n���m.z����oJ��`��,����[���0&�P���{z����5|����V� �Q���8o�-�䃶@R�?iBr6���*�-�P ��-NK*��$�ցx�T`w����ϥ����c���B�b����q��v��C��*��#�G�En ���zW��!�F��!���XVӋβCP�e�l��H�ܨ ����ֆ�喒0��MIOrˎ����c������8l��I]K��[� DC�X�o��x���^���R�:���Yb� ����9k���������˚7 b��q(�ąp|�Q��q[��]Tx�ȿۛ�˻���n}���?X.��QR��#t;�Ds!�IR�����EW���>��z�'�.̭�8�a�.��jU��OO�p"�Q)ڝ�\hF6���L�*�(�F!���m��������3�8�h�X���:������>�;���]gHro+9��OddC����7 �_��x�nhr��-SA�q�1��i9�s�� ���!�<'>�!w9f����$^p�J�����fS\��RDx����B�.*/�P&D0�qٌ�ŧ�Y �B�o+�K�;1x\-�:����US�3u�5?~�t$>�8]�*F�t��-�=�\a"��&o�H}��'i+Ys\Y��{Z�r)�EP��N��y���~i�Y�/���/p�e��:�����eF�o�Z�8��}[�G���R�u3�:�dv*�3R Q �0X�)^GBg�1ݮbp5"`@�iE�&2�sq�0�7�#��k�R�a�a�'W��۸�צ���p�FՈ�ٱT*��U{����`��sK*> l�$`�5��c�o4=P�lϡ)�P8@_5ԕ(%9���������MҞ��fX�Īgjk�����*��wS��5� ��*�6(9I��s������0���rF )S�0�]A�$fҩ|� w��33�ZxyJmA�^�MW�-���![s�����i�fĈ��(�;���JOw���F;����U-����5'O����S/+��C��WM�fJf� -�~��.)U�U�"���:�<O8�'ɓ^ 08a���}�Ű$�:�s6��ʘ��~�Ч����b@Pz.�>A����r�rr5���� EX���Cz�n��1��?x��_gq��ň�}��$���f�jJ�'2>�4�����j����&> ���'b��F�}}'�D�8ڙ��hke��G춺���՜4�<� �9�j�ʀ�ZM���^,!3O[�.g��[��sad����Hi׃�p�T���=��L �5(�Cb)��5H#�Y|���e��RX�v/?��wMu`e��ŏ؝p��j�x����v�����^�){�M� 9K�C�/�D�]�dK��Ș�MC�ӎ!��w�2&��!.㫹Q���9�?M��Y����_n�ԩ����+��J��}¨|˯7�_Ǩ@d0vj4*�� <�iҮ��Il��"���q������A�_�P� ��01}��=�������C#��4Hdp͡M�2���~$�;�>��*��Z˷t�����$�������BMk�ay��j��@��t}E]���r�(i�pCP�ͼ�i|ʛ?mЌR�+f$Z��ʫ�A%.2V��'��j��ѡ��ѡU9|�4�I �?�6�ў�j��k���R�HG��������C�ud��oؙ w>��Ǖ ��&m9���0��>�͒���]3�{6��}{E�ܥո>�M��FՁ��.������:0������;�-}d9�ǻ��8P��u��uں��x�� -FK��9'�#�2!Z��(�d+�@-��d�����L�y��p�\_ �fI�u�Ju�Ì֛l4������@����Z�3�65q��F�*�t����4/$�p,G�%�ww�{|/�����-�����C8��/r�� �xv��O<a��Dq�����[� )߷�B'��k1.�����+%�յ�7\(ف��u�,����r�|��V^DXAg�H���b�d�����2_F<��?"l�X�Gh����5h�I=�]��q�":����'�����T�w9 ���!�/�_�����d:2�7 ��CF���3sF�� |;?4A�E2H*(["$t���_�X�G �ja���3�F���Y�oɆ�� ��o���_k�J�����s�\�d�����QU�[hC�cpWfku��/&^gT�4̞�y�n�?�ݵ�������{d~�/�͓������o���9���U���k�?Og���#���� f��M\�u�W6��U:���ó�S�����Wa�o/8�L7����ԑ�>�s����2�QؑusE��VY��V#�A�S�/�ibę�*"l-h �둇B���O6�}���nD� ۥs#�[^�������=4�pWB��1�p���n��b}a� �nO�.I�yG�CR�Fv��LE��`H��>��+L���i�� ��v푍�6a�:M f��V���U�� ���D:^ً����WH!�����.x��@3���k���a
Static task
static1
Behavioral task
behavioral1
Sample
astro.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
astro.dll
Resource
win10v2004-20240508-en
General
-
Target
astro.dll
-
Size
8.3MB
-
MD5
00da6e9bb991d41affe5875fbfd8f859
-
SHA1
324b316c7306544b285cabb19eb64eaacde2f239
-
SHA256
0798e5b2f721e4f25bec0a9a764212c3dca8daae022841ad6d60f59ad6f161fa
-
SHA512
05d6189143057069c4f1afde6996edcf584a48a25f950a5e4b6379e65e76438dc5175689c17467982ac6fb7aa3134c2d2766d5525156522941346bbb9c262cd4
-
SSDEEP
196608:guKDs7yFxsRv2JfzAPVweuTEJGRCZRRF8Wpnh:UDG2kVwxEJGRCZ98Enh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource astro.dll
Files
-
astro.dll.dll windows:6 windows x64 arch:x64
e78a587df4003be53fe8a174797a9c28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
CharUpperBuffW
advapi32
GetUserNameA
shell32
ShellExecuteA
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-math-l1-1-0
cosf
Exports
Exports
Sections
.text Size: - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.g<\ Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.6A{ Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.?D: Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ