�w�����pJF �譛˚br�[��//ɐ8��i��q�\�Z�w�v��i 9-�dN������?w�-y�]���Q��UUF���fo=�Ǚr�dji"��ts&4�Ÿ�h]����Q�?bg�NP�h�u����ٖM(��q�,�t�!�g ^ъ���=����1���O���.z������ ����ڟ���� E����Bd{W���.�D� ���5}�r��H�vp:�)Kx�%����^����Sj;���9�/�r��CP���D*�@[0���z�oʍ��Ĉ�fQ�X�d�k����˛� �@K��-~l��I�]]Py��a�X=^�Xy���`M)�'yXe,�����Sp�v��.�UEխZhl�}9� �W���u���w�@y-�9���R�.���0.�Z����� ��\5����T��4Y���$�j˅�4������Pz E�uF��ю�s�w �(U�p�(#�ZhD5�l�;8�?\R�w�v��dI�M*��=�����z6v�D�����0�O� M��\��T��%e���۵t����X��^�mP���r|���li�i���@r��[AA�~��[6=ʾ� ^�����y��^,ԗ�7��0(����3)EU���ծ�/H�� e��Y�h� ��_L�\��F^i��X+H��:c:�!��d�Rr�ۻ�X����� �ƹw���QgaW1�nb��a���R#Z�}P���L-��m�+���>Kl#�5�U����L}7�S�Lz��~-B�������T�c�.�?8�����U���uNs��)�(TX]�sd�h��u6b)���?�3���X擸lV:���r5��#vs^�[?bK��x�T���k��1z�:.*ru����S�U"am5am$��XYt�D3� �l�C�n��&x&�4�ي[��A��!��U���g�r~}P�ox�}^5��� .5ؔ͌ӓ�����|��|Wcۆb:�u�����_�3ؓ��Z������шZ��O×�I�[[�U����9v�{�<��k���p�2��$��Zwdnd����ԌN1����|�:CF�������_�0��".V���K��6r��*�"��$�.#]R��7}���յ� ��t��]��� }�Ö�'IQ�WТ�泠 �(׳��N~���R4���G��[�F.,��P�U�5��r�1�:��6f�o�*!�������X����A2���t�7���q�Zg�7�֭�D��)j�Eο�L�0Oy8�N�f�������H+�3�ź�_��X�-��r��+��yh�je͑����( �RrN���*g�����L����{&�_5�y��<\ff�tU$aU-Q���=r1!��w�<Lܶ�SIqX;{J7.����")��Z�Ķ��߈�Hw]�0��+�_�V��<�͘*�y/����@�;������2��K�g��Q��z� �6�NJ�W�^�w�vkw�HS+ Zfd�|&������n��={&x���CC�S����y�����Jד���O 4��]�=v�D�]C��:g�!�us�ގ��"��4�sLZ�kW�9ij�pх�j��6�.`f�=�@֘�4yW,Z����sT���h`p �t�ʹ�%&7�\��;��(���8�r3x��FZM�"��&|���`�R�_���"�I���s��#�-?��nCS���?Ã��������Hym>I��=�����P����F�6�I�#N��|�}^�a�.b9�J�6K�`RU���K��;�۔I�߾�ֻ��+��p粂���U!jȸD��k�2�#&�Ve��JX���3���K�[Z.0Em��$0���7�g�ۺP+4�թ����.�<��31ʜ/K�O��6 L�������gAJn×ׁo.���~QԊ\����]4�y��#�}Q��&I��^���~k"� "O�Ȱ�� � �A|Ɖ*�ā7��s���RP�K�Ā'�u|��#��0��~Z���'l�'����+}Ho�)��n�>��(�dd��Z:�S��U����F�1D-c�K���-E.�E��|J�H[땤G���y_��bHcwC��L���ga�s�6,�4�"��$ �m�(T�٠Aa�Q}��~�Uf'3��~P�t���z2�f3��<,}M��/�4[��L���j���B�yX�O �S{��}�b��*U���C�'ݱY9l�e�]{+Al,C!�ٍ7b�}X���_�&Ÿ�+�(n�1��>[:yK��i��e�e��l���@ߏnvzu�)q~TƐE�mG: |��; 6���z���Ȯw�A���,l!��+º^���{:� �;+P�LP�jb�j�����FDzד����\�Ķ���e����:9-#�ZWo�N���6����)sjÓGƔ�X�H �|z2��ɠ8����}D�v�� u���c��E�Ⱥ�j�����&�b"I������V�������(��0V�Un�[�)ε�G�?>�<����*K9�-w��"����f����1TD�Q��UW+~��\��t�j���=���䰿.<�����]�w�W���8v�'@O��5O1! ���j2�ay���3&��9Ⱥ�]�G�?I�5_-��G�'�>ePD� �G�9-~Fx��%%du�P��5)煐d�V��������������.�Z�9h�� ��80�\��vz;�q��Y�8�/�v��j��>�yߔ}&�������n������Q2ު���g� �����.�)��`��;Y㞜���E�? L�=�ΰm`�yq�qڞE�G�c��A�6����/�N�k�U�� 4}���������VPo�5}�#��)]�4<�3؏��q%�@%�>8�w�W�G� �����~� ����B��Q�@gG���Vzy�Ԑ��l���T5�K�<|�qc*�/5���{E��v�� �d�NC��kS�~��l�+�еd�6_������")�\�<J��� ������y1���$v0��b�u��o�f���'"~at7kQ�1V���Ren=ѿ�;���C8�v�
Behavioral task
behavioral1
Sample
853e0e817189593eba6dd13010ff22295f8205ce1ac87a3ba0cf2cdfebc6a86eN.dll
Resource
win7-20240729-en
General
-
Target
853e0e817189593eba6dd13010ff22295f8205ce1ac87a3ba0cf2cdfebc6a86eN
-
Size
324KB
-
MD5
f406207cf62dbd57839de6e13d535260
-
SHA1
937223075f16957fcaf7695d87947f9be000cf40
-
SHA256
853e0e817189593eba6dd13010ff22295f8205ce1ac87a3ba0cf2cdfebc6a86e
-
SHA512
a3f959478537635f3b637671e84e8ac63bcedd764755f120abea32bcf330756f4e5f8eb009b7261df5118bcc784cf63bb3bed09a55d62dab91124ee84eb4994e
-
SSDEEP
6144:uffiwI+FsqW5Ju0EOSR/qzsCWOVR678fe9dz+X2ZwqOf6:sWRnu3O3zsCPr67Ae9d6GZU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 853e0e817189593eba6dd13010ff22295f8205ce1ac87a3ba0cf2cdfebc6a86eN
Files
-
853e0e817189593eba6dd13010ff22295f8205ce1ac87a3ba0cf2cdfebc6a86eN.dll windows:4 windows x86 arch:x86
c3595a9cc3f3b8ce3a4fb723ffcba859
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsFree
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
RegisterHotKey
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 312KB - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ