d�c��-�AѼq��HRd���"A���,�YwO6�w|��c���v5�O����KCW�L-(��F\�����n��*Ы�k��րdF��Q?l���|�n��8P����r�H&��@x�Ef�d� ٺ�a���>s�t��i��AZ�/p̖D��l�,�[/\DƼL��c�e�9.����7O"� ��p��g�qw��3x��1��JD>����|��`�p��]P� �S��dfP�.�67&G=�Iș--i����n����o�=j#��Zn�b�����Ge���姆@�Y���K1N�P��Dt��*�ܤ�ۇ�C8��J��,W�g�l�iG0:��� �1p1��E2���']:����V�����:����o7�,NP��6�.:C�G������4�+���H4��R�ʩx}�]^$鎏��U�` �� V�~�.iy�J(����-�`5�Q�S��1�����̋+��x^ҭr�lk/�����S㸈h������r~�]�K.Ne/���>��r�3����4��Ċ����݈ �q�;;ĺy�G��n;1�G�����A���'�_g�w�.�6�U� ��_����V�ˍuB.?��/݀%�P⨳�E� �E#�����X�3�F@�;�v�I�5���C�`-��?�o���S$c���Mݭ��h:��U�,f���~��X��?�f�Rr~� ��C��$E�G�'�>v]`e�R<�G (������]M�7��Z��@�� s�W����8;������G�.?EI��!!�3����yP���g���%)Zň� R.Je7���H��� �w����4��AZ��:��[�8s3A0�!��o��,�)�ONk6m?+QA���[�i���S/.��JG�,_��X�m�����M`����7| O��u&E}��1\�8��o x�� Rn���N&�ݎY�iL�+ �yR������F+������ā��y7�]w��Y�ɯ��TւV��m���� �6�*� �pm�fb�P�o���2���%�oŃQE�dzZm�S�d�+c�d��������1���<�֍)��v��w�tH��I��E�/G���U���[ $*�����w^,^H���7������\���_�P��>!�g���O��LR�+�@#it�B�麬���g\΅47O�a��R�dg����,��%P�8�J��A�iv�*���Uc��(=乒��a���h���*�/�����уn�&���������k������\*N�X�_�s��^#�#�[��?TU�_������b�0r�� �2o���?/��=���$>:�F��<���;��>�2�� �_"F�w(Xզ��|=El��1�T�G��e[���V�[$��y��X���/�]����x��T�~������R^(ᨇ\��EMe����Ur�j�9G���V�4 o�;�"�����֖���9�U�.��+����E�R��/�����aD��ܹ��٧бr�;����Dܓ$�R!��nF��u([��}W��|Hz�֝rE�zHZ���p��w2 ��h8@m4](��N���X���MTc�\��#����w��)[$_��"��ג�{q��bpdB�����W9�.��Z������;�= W�F�>J6�-�������)��nݑ7��8�A�q����2��y�����3�:��A؍z��3X�� ���7M]�>�q�� d@Wt�~��␇9��."���[�e���w�V��%b��$ڍ��?��:���mKQ����j�1�a��E�d��n�R��\w�Z��0W�r;0��숩'�܍N�O|] IF�)0�H��rGy~b�d[�v�E�7��Iw�#������B�(�Bg�I�{�d5��Z��O���4l�%ػ��������ʼ+���H������(�m�Y�j�S#���I}���,r��Wf�|噪��Hx��ow@�m����O�����)�]ȁ���WO�q)R���&a�Yf����,&2�h�����'�b��ZfcI,�����VX�5�͗��H��"�q�BDߗ5��tV^���S�\Y|����,��u)��3۶I�4b�O�:6.�憪~�\?�-A�nq��7���$�#�6II���d�?kq�=|��ε(��e|�A���T*i|����Iz���[jKJ�g�D��K��S����fB���$!6U�Z��Pv��&D�-'���rVCk�����3m�Vv�&��;������ŐP���;�:��F���һ�I���z�R���6�s=�f�����Wn�$W�%�~/������F평�{�?�7�<4 ��Q�ut���K��?�t�s��xk �tCf���J�W�$V�ng2*����[��⫧����;e�P]�$�Q���Zx������s��^пat��t[���{�Hl�@}�����������G�;͜�k`Z @��A�Q��#���-/�Ӣ�,g!���!���`&�����iX�j�9���)���AwEd�������i#�����| �3q�R��w����,rq9eC��Rn3<E��9\&K�My�sн\*�e���9nj�`P�ژ�%[���&2��D�SZa��GP��R�025])��w��Áä��$ z��!�9�b�5h)��/��* �� ��h�1U���KE!����7�<|��;Ϣ�͛U��H�vE�r�g߇GL}�0�n��h@����_*8�?~���d�<��nc��Wܣ�B����v��A�A'kZ"iG�u� �n+�n��4�A� �s�?ۗ��9P���(����q��ƀ;��t��Zw!/�9+z��N뀚v��F�0�G��e9,� ����,C���ػ�a��?��2Np;[��������[)���>;�K�GM~Y��� d��{C��-��&��G ���r>:�~X��a�$F# �M�EE��+�5Y�����Il��[���������͛~���P��klI ��C�?v���-�X��mm�_���/M}}Y=iIe�
Static task
static1
Behavioral task
behavioral1
Sample
530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6.dll
Resource
win10v2004-20240709-en
General
-
Target
530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6
-
Size
709KB
-
MD5
ad6573f3996d95cf17f676ab7c2d643f
-
SHA1
94a308f23053a89e549d30f001626ad766f8ee6d
-
SHA256
530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6
-
SHA512
ffa5be767cd049098c2838ac0814944e10cd5c4eae21598e59cec2b325e15b793b978a483ca85a015ef1badb0ea0d602b8d93500ef6ea093979330b37f2529c6
-
SSDEEP
12288:AQNbS6pR/FB8JtSj7LKM9Goz+OGGnpJ6CuDXr4N/6a+3AH1INKUMd:A4bzph38Duc8+fGnpA+h6lAVIUUMd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6
Files
-
530a6e800945018f9b285aa616a98a582e13f6a8480cf316613efffe772706a6.dll windows:5 windows x86 arch:x86
e504e3304e2cdcdc5a73ce8dd8e1d0b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
oleaut32
VariantClear
ws2_32
select
Exports
Exports
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 505KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 705KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ