���JKb�E;r�X[o,*V�y36�mf�iة�ww���)�"~6fU8���Ⱦ c캯��>�~k�R��'qguz!�(��pu� ��%�� )+ S6�Oy�E�!ѱ����Y�Q3p�e�Ɗ��sɒ���k�^�o�s͑r,�IW�.p��9#FD8r1c�7k~�L��8 r�vWP��՚� ���pe.��|4�ʡ��lZ�s9Z���v����&�-���y�����D`ͮ� �e���G"����+>����������cP����Awk�םP*��mz-q�Mr:��g�5~��`@��������i�N�ߪJCڬ��e���^�s�q���] �9��h�p����:.euٚ?8� ��ib��Z�k2���s�I��C�T�,�r���J�٭�g���4]��{[]�R�����\b]�G=���� {��� �J����&�{���� ���"| �<.�H_ j`�i �� ~�����?S� 5�ײ����46�������1��t�gc���N��Oy��%��N&`��W�8��j��^�Y]B����-Dׇ;�E�^u�l�*R�H��ʫ9�����B��g ���@�K����P8�O 穡ʇ#)W���dt%NBz�� ��0�yg�D�~o��i Q!�C4[�R���=�A�:Q�L��6;ʁ�� �Z�����̑A�&Rb��s̔���㟛&%G֙>�a�v�q�&�̾�`gW�V��-���+�<h�a��x�^����W�j<M��]���Nc�� ���|eɩd�p�����J���w ��������_7TaC+ ��� �ݦ���3.ϫ.��{�f6�жyު�K��K�(D}Y�(����h��Ή���������V؋$c��ܕ�Z�Q�E+���[Ҧ��L����cU@�����\cMraQK@Ll�f�"W���R-��ża(�O�l�Ͱy_�A�C��5ۦΧ�Je^�9Mǚ[�mmآ�9�P��_��L�/qu��4� �#��@w#��QL r�+Z�y�6b&�)P̂�y� <���fNJP�P�!����G�$���Q��ͨ��xX�(h�5�vh�oC�D���T�b�k���9"3����=�=�)��lT����0�|�cC]w_����]�ƕo�DB��E�lc�_)O�t�85�YVm�SQht��&.�����*(@�*��яR(Tجo��v��2�A�, }/G��$q��i��|����_����@���_�}�d\g@��A"�_h]b��\q�5b+�77�5,�Q��DE9�Pz�[kl}�^y��}���i�yj�����T�b{ߦC�����tm��]��O����1Q�s�=�5: ��#�`���Pb��f��z�����vnTlt��*��fvs8V�� A�d����� ��F��峔�� t<Ϗciz++��y���C����GOl���y�V7[��Z�i�-M`���BHF�7NgՕ��J�3�ߞm�����h�jf�a�f���I︺��ɗm-i˂4�N"0)ֵ_T:?�����n�ǫ������7=����{�d.K��������W��I~ �� �쉺�C���46��,]����~�EH�."����$�� �|n�僘�wM�(�2\�䊍�R�,�#�K���P�%��ȷ*G)QK�zڽ�2� ���>~�j�e����mӍ]��F��K�v7�}�V�aP��uV9?,�!����u�Nn+~���Z�S~��ٱ�E �����Ц�C@�w,�����}ķ�uqY���x��]��xv/'h��(`�RY��~o�C�������z)Ń����*sh�3���M�\Qaґn�x@P��_j��b# �ҵ�Q�ډX�o����L\����x,��(��]T���������{.����.3e`?��-x��%c�Bv[�}d�l��u�������� T�����fn� j�O�� ���|_����k��8<B%r��{i��߮~��jf���b,������A��w|&6o6Z�|����[��]`�T:���8<�ԟ���7Y��� ��"�5L@�����+Vr�< ��5�S���J�G̦t��,��FM12�Yx�&'��ฏ�t�v��vI�&�o (ᷗ�浀!廭�\�/�<�T��}廲�a}���8�z���\nҿ��������5@�2WeA�ߣ��:=��(L��l�C?��B��6���0��|��4�L��(���/&Ϭ:�PU�`��ז���U��������� o�a�q~S�y��&��*���`�~�II�ڋ�������C��Ы��O�2�ɶ��ؾ���dؗ��U��c�eĻ�oC�"�C�Tⳣ���YZ��Z�������*?�!�t���R�˖X�;&J�e����������s���0�0H��^�i�{Y�n�EǶ�xG�c����T{@�����7�ޔ��"�s+����DGX��b�6���ɖ�_v=G>�ֽ5�����3o̡�1.O�Kc�!��!��d�? B��%�eR�Yt���!7uQqHi}�(���!tWz>tf���h ��c0��P�'qzhx��:+���1q��1?[ �t�"�on�1�%;���x(^�&����*�8e�Ɛe�w�w����H����)ۓd�ӓ�ξD���/u���a}3n�E}}|���b�����hL1Iy�h�P�v���m3(aQ-g!tuW��q�4�������`� /\#(��g���L⊡���`������L����V�@|�Jey,e5��^���HE��4dd�����C.��v#�-���pa��a\�P,����^�# ۷;_Z��P�C��qp��mcp��Ô���^l��_�7B`��o�y`݈�e��.��3+�竗"��ȍ˶�F���}V� ��#{���� &.�(���!�?1KP�{���O�',>���>���l�~��a�^�|�"�o� �c���c�����LZ�Cϓ��+]��Z�Ne�~_�%\�ie줒E9y���,�qB�ꕚH�4����y
Static task
static1
Behavioral task
behavioral1
Sample
dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800.dll
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800.dll
Resource
win10v2004-20250314-en
General
-
Target
dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800.exe
-
Size
5.2MB
-
MD5
ff6312e5fe35c9b16a6b8609d3d4aaa0
-
SHA1
6fb6404cbd50c210bf05018e11bc47c4d9844bea
-
SHA256
dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800
-
SHA512
6afd1adee7fb30aaad87e93ed48993b6899d749321538dbe519a5eec27f726da44b36c73ca026aac64a2b48a9f252b83a6b34a718d3c2c8ba474665930309886
-
SSDEEP
98304:VXj2tVJX06hpNT4We2Ifr4b4rjtLIy4ngdISBvmr/zTul1:VXCGG54VrQw+qmSBvMi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800.exe
Files
-
dcc66765876057493a7e4683847b1195680d6693aa0584c0570b0f349cafd800.exe.dll windows:6 windows x64 arch:x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
+++0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
+++1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ