h�����6�.9�F����)��O��%�p�����t��������oM1����H�r�V��kƥO��a0��[ ���s ��v<��KG��4�t�r7�����[��d�sԲ�N���rł-x�eM���SVtoD�hP��'��gI�^ୗ�2-'Oj(���a��St �e�]�cs�٨'r=� ��)c\�u������}� ��Р�=�^��)�Xb�y<�%s3Soz G6Oj�;XV,c��K�rb�hMx��]D��.�Y0'G�,�Hś��[��k�5�AA୦> ��&�*tZ�.9���@��W�-�����6)������E~�3��%"��R�zT���/�Br��N��oшz���7I!��|��z'cɔ����łk�6Ip�ǽ�~ �?2� ���S�Љ�n�n�!`+�]Ya]��BzF�SrWt��!7ZN;�C�$[v�xy�oG��)qC0q��73MX�I��������) �B���I�U<[�J�f ���MB�є@疝8�z$��#DL�L��j�B���9�\H��:&MGȬr���D�����S��T&"����ϻsa /���@�����c��NZ P��eЌ��@4��VP�����i8ѼN�R�Ѷܜ���w�����U���Vm�x��F�3Ѵ1�w��AZ��v �)�Q��;,(�,�t�T�� �ת�Q 7���V�ąӞ����kӧ�kf��~i�_�������S�i~�I����eKf������R ��b3�����*R�6v�>B� 2�,���.���P=&����ߤ;"�OE��K\�����TG��eO����"\t��2TgY����ӹ�����wƾ�������3��L+�Y��l��)Bރ�)��#.eǔ]-��z9�I0��������[$����6�a[J�q������/O�7�������D��K7*�럏-g&K�V~� �*������n�Է֟ܭņi.��Ƹ=�A�y�9\줫P����S�/�C(b�0}cxX��% ��2L�}��W���G/'A�O-�5|V��cdO��҆��O���4ٙ#%@Q�É�a%����nT��s����`��*���w�O�z�zS�$�-/.��Q��o����;�۬k�k ���t{s���eJ?R�B���ŠkE؊��Ze�>m�˟�m�h�Y�]��(lC�1%ޝ�5�����.Vi ��Hj���0r�x����� �y�_.\�Wë��f�ܾ�U��)����iO]�p�{�/錰�kRP�l�ɷ �����*������3*��4{L�� /���+x��bw�'�*��}��:��!��C�V��4}������; };�~6r�;�&�0���e�O�r��iarR�'/���w"���Z*���)T_�w���}1����=���5K�e�0����eE*�Z��?zb3��.@-�4Y����s�-�탁Z4����+Ӎ��&I��gf�Ь�M'FK�o鍸�77�(��p����f�<*l�K8Rmy��~LM��`�{��B.[�-("P'�z#�LA��.�Qև�5{lF��/�yF �.�e~��Q眕aϩ�^N�;<��5�G82����r" �&�sO������!=��$T�1vm ��u��w�p�cm�� �M#T/�c,�W%>ޑW4���t����2��K�r〖��i����hg����D����+M����pP���`з�ў�u����K��>WE�>��h����Y�5^���4����g����A����d��BIS��F0r������ .�����y-{��ig ��Oݰt yQ���Z�0��pۘr���E�P{���m>���,��T��Kԇ30+ܝY�$��9�AY�aƪK��j�o�+���f+��HU�š^��U �x���U�B�t�p�1��xN���q9IoŖ�(O}�)�ZF�K�%OJ�� C�P�Y�M�N��3����,��%{��@&���zOH,4C'�����Ts���y0�AZ)���<�+�|�4n��+' t���#q��=+'����b��#5S����}CB0.�F0N�"I�&�,W�ml:�7�u6eg����y�7�����@��,�����3_1j[4b���f�W�r�r�����@f`k���r�J�wgI1��F,spj�ʸ���uv��@&+z?V��=��pf��`X�������Ɏ;����s͊c���:u�88O�e0L�`2���;9��W~��AA��x�e*>8c܁�*���]�7���\W��N�SE��aBT��� mi�.�$����C�KRH-��^psLf1��C�=n����d5l]��-�^=e�7�E�E���%|���Q)�!<7��ZPQ��-,�>S�J���+lܯ<�|��/���>0�' �r�����<�^LK�iL����F�u��=����N?/c�^�:H��e��庈Щ��!v�c�G5GFY ���W-f����^�(�NTЄ)q�@�Bc���H~��kX��5�ʺX�.��iD������qO��X���ܷY'�| JV�5���ly�8ر^"D `-�̍ ��0/�/��K�dq�a�u�y�9��]=�2Sm�_?kka1g����V�V�������%�:�]��T]�҄v'y���+H1!�����E�zą�ȳ�� x�+���lՙ���Y��&@���:�~xp~�ȓ�r�u,Q�������R�٢M�o1��iÜ�;�3�g(�l��[@6��q�LʴoCo:�B�dRgi^Gb�,[E `K�By���`��u�HŎ4�86�����9�Sw8{�d{���"������Bn�2k��+��"� U�t�ݤa�� �$�KtQ��H�@]c=n�W���v*�`�/�uK7��l�s��Q��� Ϣ0g�����[�\�`v��H�I������n<GRJ@���*ޟ�;j6j{R}��xv-��-#����� �iC!�0D)I~�jLd����pq�bn,�Pm �Iɺʂɜ���]~-P�y-�ܿm�z��I��_sҴ!�}��j����
Behavioral task
behavioral1
Sample
2a9d64daccdd0439b9e7204b86cd2fc0N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2a9d64daccdd0439b9e7204b86cd2fc0N.dll
Resource
win10v2004-20240709-en
General
-
Target
2a9d64daccdd0439b9e7204b86cd2fc0N.exe
-
Size
6.0MB
-
MD5
2a9d64daccdd0439b9e7204b86cd2fc0
-
SHA1
394f0add498572e7b99d575d6f1cd9b2ecad68f0
-
SHA256
1ab9f2057f3dab59ef354ecdaccd5b0e71d1896c5f784eb08b4881ba4ba250e4
-
SHA512
39adc1b19f2bae9e015b4aad254162442914394688b73c62b52aed73613ae52ddc7c8c3e1195334a4d0243944624670994a587bfb7cbf42889f1df8791553c5c
-
SSDEEP
196608:3OQx9rVVhCXBjfHwdbn1q2kLPySj6xZr:eQx9rMFfHwdbia1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a9d64daccdd0439b9e7204b86cd2fc0N.exe
Files
-
2a9d64daccdd0439b9e7204b86cd2fc0N.exe.dll windows:4 windows x86 arch:x86
8c5dccf11ad74eca5dca81766b637b24
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
comctl32
InitCommonControlsEx
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CheckDlgButton
MessageBoxA
shell32
ShellExecuteW
ws2_32
socket
Exports
Exports
Sections
.text Size: - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ