2pք�#,��ޢ��8p[`�@�A ������-�D�z����[�, ��Kh��{�5s9�ƜuRNľ/,�U�B�P��6͵���(�}�v�O0*5��Kvd�{�&br�4���R���74J����/���\,r6k�S��C�q�Q;5��������ibN ���T����98ҝ�.����n�� �4 J�k�����Y��W��9]���U�!�!����M��2���RF�J 緫��rb#�.��<���(b��l��i����ֹ��*NV���vށ^^�0o�~!���PkhTc����<�=�gJ��`,P�6�G@���L����`쮐Ø>��^仏:%�ϧ��ُR��."�����i.����D��ր�6� q���?,�"ʎ���qaikaNG���r����I���rO�p�4��8j��/(fa�l�_2z:�vѲ������f���Nh0��7ĵ����d��H�����TT�9tqw'�t����N�K�-s1� ��S�*8��������J��l��e(F�<��$�/��$B��L�6�@��)1,��H2�*��'hdX8�3���=��] ��h���s\�,=I>�[�w�����/X����f}�U$glc#�s��ӏhV6W������J8�h�&����68I,Ue���ߣ�7���v�u9BR*�`��'��2~�Y��,4;�0ͷ��A=>��u�N�z�'< KQ�8�̰�"��%��8 �v��~�"��Η,8�����^~�W �B����k/��������ÛIv�bd����eS�ƿ���Y�?F�8�z��ꔿD��<����&�L�2�>$K2�E,�Z�lR�� �ѵ�0��Y��{F�ӯ�-����|+�a]�T�R�n��LJ\�nb��� �F�����v�0�D��Z�Î�'%>���{WC�/ƿ���E#�6,Ap���Aʂ�U��"��83�2���>�G��X凓?��_ւ��c�a�}U�G����=0'���`��|�<�,��|`�H�����Xs��U�"�d����ԄJȺ�I@|]�����j���U�����oh��Tf"�4���Zw\�M���R���%\ȡ1s�M��q�s2q�v��tx|�dƵ�~F0����)%�-gX#�k����5��[nUH�;ڐ���B. �?�;���q>Dž�[���-��[:��<�0��*�#%��@�4���� m�[�X�K�_j��x����拲ީ�&r��Tgk�-ѹ� B ���_Du+e�6.�4�@t�,���'�-�f/��pX2���y���Ajf�:���V+"�?�+���l�vf�R7j� T%c��e�W���Peh��߀��a�9x�0�=��;T.I�ix�5��i㟢�����`��?�#��i���?!Wn�˹d�>�dMcvܖܸ[�(����K$���N�-X<le'`��EQ���G�p�G�jf�+�eqv�9�3�X3�.s����5�\ �,D�F�d�?P� ܒf�[�e�`��^~��S�\F ��I˂�� ��]����t#��%GW־a炖�^�⽳.ZM@`߆>���`�c�9�`B9VKgZ�����+��1���S.�O�Мm��#Im6j�,,�_��Ww����?;2_�"�e������$=j`��/�ͪ���b~�ŝ礣k�Sq��X5|���D�-��H~/��ʼ�� �ˍ��Z�I[{�[j����&L�����ϐ8?�3��)��X��1���V:=o*��Cx��{�h� �zD�^�y&�Ƅ�V1A�D2�&5�*��Ik��%����i )Ln.�d����!�tY�g`̔���?��h�PNC�����؞{�q��_\������ t�r���g�Y!��'�O�v����߃���j=J"� 4��Ak����e(I]@���F��z���Av����bDEo*#*E�4�$��@h}��v����%��}s� �x�� �pL�5�Q�� l�x=���c�21�n�MM-���R6=wšF�~�m�{K b�j��FP�W�(yb��v�������)D<�]����dm�����q�ukS �!�3R���x���;�3�^�A���Q�Wn�C} G��Ӿ{���x�v�o�$Z�u��������OE��� ~� ����#E ��nM�2��L�9�7B���XX��P$�G#��n�������S㓅� ��pY1�����V�t�]uNR���<���y�Ԫ\��@L<E�:�}m���:2h����x��F ��֗�$����b��+3�Ŝ�T�)�{���c�o�_�=�������O<)����������W~[[Aܵ )��r"Jnu���0��>`f8#Z`G�$fWs�G/V�\�.�҂�������� �L\;Y7Px���rv!`% ����Dҡ4P9��0B���,Q�B�l(�yC����ƒ�r�F�!"�:_p{��I+K^"W!�A��� 0���+�q�{`5�O�Bıvvا�F�0��[�;�k����4��oC���'���~BR�@�3t��.sT(7ي+=)�r��Yv�w[噙�M�-}y�m5y1�|������#5�Mb��=������,�������r���\'H���(:��`�d�!Ӄ}QC���ۡ��@��ѻ^��z�wB..1<�������fH/�n��S�6H���{���i�s�P��$w2�������)�t���?.�D|sk�_�4W_esޖh�({Щ��`M�C%ۻ�d�ǭ<TZ�E����EJ,�2?&;�)�\3P��c��� &:�'����P0���#�/P��Y"�=�b9��J�*N����o�������^!v�zV~F�9��s=��9d�ڧ?��u`�m¨п���J�#*`�z���@G(����h�^�o#|� $����kРh��ȼ� ��O�:����� QPK�:Wt���=�(�K�p�w��q���.�� ��+��)3�� e������r�i5��NPՠy3�l ��Xd�GF��Pـ��#F�Y�J�W��*�^�Q���u�.Sx�� L�6�_K�<j4�!_
Static task
static1
Behavioral task
behavioral1
Sample
7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837N.dll
Resource
win10v2004-20241007-en
General
-
Target
7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837N
-
Size
1.1MB
-
MD5
16cf41c31af46102f72153723d1e54b0
-
SHA1
23d043b225a97c06107852043a636b00241eb25c
-
SHA256
7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837
-
SHA512
7f4bdff6db860ef2695fa189f8736d9874167537e005a8e83adcf861fe1314b96484ffab7f04e1c32ecc51c592b8ab452c8241d24ca6452880c172d157d0c514
-
SSDEEP
24576:efRq9tzf19yu+IoiRBNRKaQF9I4Z/Vgh2t0DYQ1bQlFrbNGHp4K:mI91h+7IDRKaYqc/oDYQ1bmrpGHeK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837N
Files
-
7472b7377e472ac2cef269018ddec63d7613cc7fc04d84dd508ffb7e9425c837N.dll windows:5 windows x86 arch:x86
bc09234f2c5b141f18036be034f110f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
gdi32
DeleteObject
shell32
ShellExecuteA
msvcr90
_CIacos
msvcp90
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
wininet
InternetOpenUrlA
advapi32
RegOpenKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d3_1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d3_0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d3_2 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d3_3 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ