�M(�y��_��;��<� �ѣ������Ñ��kb��J�Bj6V+)*�zQ��E,��3X��oNJ���(�c������}�W��+�X3��vط���A����a�@��Sw��r��a�Y�� ��W7��d��KnI���U��N 5���Ԅɭ���R?j��B�Ҕ=0�����Z"�mA�+le��k��dkG��6Z.^�``������1-�����#���ҷ:� ����V�la@������b�H��av�kp����11��GQ*��<u;���j�;���"aq�~�%�h�݄ŧ�WD�~����4���06�.�fv5g��Ԓ}�����Y�}�0,�]p�StN�gNH�;m9�.WB�R��"rY6[��I�b���Eg\�l�6��2�>�l�p���os�vr" ��ȏ����-���]�`���F�߱]��n�uK�NY^=���_!�:D���`�/���Qj����9��O�-D-M�#�����ķ����gON H�X9kce.~{-v��_�9�g̀���){�{g�!�ã}�@Ƃr>�]T/�u%ȧH��<���Ӂ�/K2�MR{���3Iat*�%���-� ,���֘����X�|�:D�Qß�,�!���]�t�2a��1�����<��������'S|�sB5��+���Z+���2�F��Q��7���kN�S��Κ>s-W��ܜ��9��#)|�."�%#�J��a��Ú-5�����~{��vU�˽�g����5� l9��%�H�c��"�X$��_*lsY���<�P9��v�~�Y-���x%�I���0��!'�Hn���ț��ن��TP�t�����X��Yы̃Z�Pl<�0�*�Kd������8��z���U�,MEHAN��d=a��״Fw�� 5$�m���y�:d����;'~�%(�UG��������1Q�a����"����V��X���џ"fSB`T�e�x{ 0�a#l�?�IAD�_�0×S��X4�� כ�jig�l�M��������5���7�����x_�S����ߌ��ħI2�X_Ĵ�X��{0�$>ބ����C`���� ��Pߒ>�������,[�ᘨ�5H���aU>�^����S:2�9��bc��㬝�ݍS{��ъ��.jVgV�H^$�\��SpC����U$�G����b��U�ʡ���=F�u��րe���~p3z �M�ɽg��5��F�)<��G��I��> eM��fH|�گx��0�C�x p0��9YϏ���gf�B���U^����o���{#�{�#����`��_Wq�T�-�t+y�K<O)���_q�x����s�Oð���7������)T�S�r��A�J��r��Hc�Hb�/q��& ����D엲��Um$����nj��e, �B����Z�fZ����~�d*£{U��ƚ^�oP]�`x����-Qe+w�L�m�m�@�<��zz��|z���.�3bC���\�nh���5���5�϶j#���Y瞸´:*OX�Td�L*��09���r��L�{�Z���x��i.���ĭO��pZ��6E�o�3��Z"�p>C�Fj�����l�G�F�"2F韗�~�Z�h�Shxz�"=�gn���Lz��} �Qcc/����`��CԴ�����G+$5���d��F����ܚukIRT� ��~0�l���\*\Ɠ{5Uk�ޓT�[��v<��ԼX ����]�&r� ���a�7�<�-�b�����/��m�LX%�C� �u��2���ԒՊY���L߽�� ���ٯB4(���Pt8��������U�\��_�b�<L K�����ת�yj�l��QG�!_���5�24�`]����3@���~v^VM��ޛ!X��0�hY=�`�g߷�� ����_[4o5a���~�_K%i���7�V��{�t�Rí�6ja.��Ƿ�W��Fk���}���U�9�ɐ�,������)-�s����S�/ |�y����Ǯ�!w���= �l�Se)N��R����g`�.R��uN��O�u42_�*d����P��.�G _8D�����SwPs�@,����g�`[��!|l� }��j��Ƨ������&Q���A��[��܉0C�>���C��^H����' �gK,�IY��4l�=� ��������� ��{l�%��05��(>Y�\����e�t3��(���Qw;�/��0Z���WV�y�������JP�]�� �pG��`L{il�+"�h�;9BYnʍE@J֣�j)�m�:���qq��p*)�¹;&۾�.n���u��O�=�@fw�0GH�)A��=V0��A�v�S:��������� wЯ�oF���Q��.���Q!��h�s�g�t�^"��F�ҏT*�(ˋ6� ���(��� �W� y3��xv��+������Zl3�)n�XU���;����lLңM۟�m��,.A&a�1�/��Q:�%w���*����+�\]s��� d���Tɪ#�nkzc-� m:�ϴ�։[N���,O�y��wlF � Z8��_e�7>�1@N�[p����8z!d������JGةB3�sJ�v��ӵ�]��hn��#8@��fӹ��"ν�s6|~�q�����-CoÑ�*��;� yU����{��{�]�R�$���P)1"�oUM����P�B���:W�h�,([����Ș֦ " ��$X����=���B���_L�,�m s��Z�#��;R܅P��]��Ԧ���"��4%�2lM~�t��gh�R��T5�!6Y��0JC�b>a���)�J�%�(�7[K�>ke&k�ۊ��?%���|ۦ���<)?���0�,���\��#L'�U%&}#8���S#±�;��{7���=V���Gu��Q��9 a!�S��.�/曠��N��ZV}x9��*��x�r�ز�"a8�A��ݴ�S+�W�w�z�V��r�M�x6��W�,=\NZ*EL�����g!ߋ �W�ym�D~��.u]Z�16A���Q*���]?�%�m��s;�ZIΖ�E4����8֮$AK���L�κ\Hb
Static task
static1
General
-
Target
astro.dll
-
Size
9.2MB
-
MD5
c562071c20ec1e8c247d1fa6c99dc98d
-
SHA1
e14dddc7028e2fecf34a268220547537ca770ebd
-
SHA256
f8fd32793136dc5629916cb6b119922fd76f3f6dc246fdc4bda9825e2a21df07
-
SHA512
1683ca3337053d1285007478fa95866516001bf363920459f76c8dfd875099f83363540bf28e4d10ef4d4f755bf20edfbc9a75dd8841b4736c3b849a7f808027
-
SSDEEP
196608:RZeFJpPXTLvJFgYrLiMO+2ONixqGbzWlu9UL/k2tHX8QMQ2kd:ne/pPXfRFBi5j6ixnbzDUzko81
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource astro.dll
Files
-
astro.dll.dll windows:6 windows x64 arch:x64
d459cbc96018d5cd2836c701ae0584cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
CharUpperBuffW
advapi32
GetUserNameA
shell32
ShellExecuteA
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
Sections
.text Size: - Virtual size: 529KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.h.S Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AT/ Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.38l Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ