��^-^���T��[�7<m����V�v��m�(/��f�HB�ՈYW�.Ii|0�L�3�����9�_���16c�G�.k8�z4��+ �S�u��(�� ]��he�o�k��Ky����'�����M�Иq-��1�����r�#`X�lxI��H���D�ﭲ�%TBN��˒�Hf������±K��|���F�/��%���i��E ���C��2� Q��I���_���%�hk�0��|\�e��T_��5��!�\mL.��"|�ʥ����d��$��}59�4b~R���1��҈��纝K�ʽ}��H1ٔ�>_������vS� �ҽ�M��~��{m�US<�srl��;�m�� ���;\w�ii��P�^2K��A՞���j��C%��[/I�A���A�"�\㬣ǍoNܠL��G������ Xø�yM��q���<;'AY"/~�jĬ�d^hRx�,�Ґ��cP ���t��� �jؓ�oY��~�B7��V��<���֏�f�W���ּH�q%F��ͣ[Z4 ���/�i�F�_�#)��sR�����M�p꠲E�.=��J�d f���O�^orW��|�e[����}sn�HPS�۽$73�$'�vfL�'��� ���ֱK% r7�;��{5���$�v��F�/��rcbV�?�K��c��� k��Ccv��s̟��Tl��j�TȂwVD������\��g`QBqë�t-a�� �c��tq�MC3R6N�@j����O�=�:��N��X��,逺s�8���ݫA�,�q������W?�%�;���&�x-]5���:����(~��0�� i�/�������D������5���W�EV��na�����A��F���I����νa�/�R62Ak������ �@�l���/�2����� �����E�b�O����NB`cȥ�-�o���_`��F��4G�Z#���;J���;�=�=��8k\��!.{�=Ȳ��.��D���Xi�Vu�V�Ӱ��$���#f<_�`7���jp&\�U��ٹ�L����/�<�#rj����˒I9��U���E�;{f��^@\MJP?D���X�C,�Yc��K�[]E�6�X�qʷ���m^�B�w�"����2 �U���H//�B ��!��u�`E�p#{�� �:n��v-g�d��SGCV��}}>���/��ǝX���"��]^��g�]�(��%!)s#�y e��`�ݓ�/ύ,bk��f4Gx6��0� 3tg�5������N-N͕ZU)y �`ƣ���︧j���o��>oL$tH�UI��������OG��Ϋx<��N:}s�� �z��-��3he�h�в_Ct� �+��a��HAX����db���"f]BT���J�К��������ᬿ�1�oÉ�PbPeVR���P�P�c���� B�&`�cN��]!H���:yW��I��,�r!��J�t��pp� ��á���j�ϑU�%w�>���]E��O#=������Lg,ZX����e!�fϏ2\U831��1��/��[3��E3X�7�|�����ݥ��=G�l����^��pf:^x�mp۠���?��q>��f���e��CP��4�i�kO`3�+��&T��6\o�����_ �)}slֈ��z!����� ����?a���J列���=�dT��@���}��(�/z�v/꒓ε��_����d#t��,�Ղ���5����#_�4�A�,���6G����.ϰQ���훱zvmENxz�ޒ��/j~��o%K TM�< m��QƬdi�O�2+X��Q�N�Z�}q�el�������=C\���}��&HFz�����W"A�����c�lѪ�h�k}�1媊%w��V3��.�a��4�����#�u�Y�������'�q��Hl#&���i`v�R6<<��.mt-�aN-�W�_��@��j�8z��B~���9��8rzof���@ ��`W:����fq���ݰ�b�DJ�1Џ.����<݇�9�\���f��� *�NMX {��A^XMM���x�Z( ^�����K��+�2�lZ�G�,�e��u ����3ak�Ú�+�0~l�I@�`���}g�� �9��Y�zl��ʐE)�W���P�]o��F�A����R�e0�_�~^�W���Rs��.��8���D�k�"*MuMl)F�n��-�?��*Rj���\�����.��U�K�̲� W��-���M�,+}-)\-���@A.���D.�zv9�*5ɍ?fڮI�%�Ԡ������C�!h��A�S᭖8C��~�ޓԫ����Ι7�m�}@�k�?�U�h���н:LW����{���oUP܆ ���O2�"(>�g��X��N%�m�* �`�U���ߤ���P���|�s�#SP��m܇^L��5�� �W����'1�{�j� ��7�����&�b^�~�M��Z�����VK���ъ%x �IE\:�� F�uv���C���� �dU���^l��,�#�ə����Z�4��DH?(��>L֚K��G���#���� �F���u�&��R=��'b��R�)���j��A��=� U�C�??��S=z"� S�S,���(�� �V]7By��.ie����K�&>�Xp�9��[�E�l�*��{�0�����8��m���"�i��G�T�A�+ +���ȼ��!w�U}�=R��4����+�{��v_����Rx�.�Pg0aMm��ڍx�%Sh��q�[A������ƚۄ��Uޮ�c��[�o�9g>�s�/�Vl��О�����r�o�ZNC/����t��^N�'S��y�x���?��]��w7�-��;X4��m����PC�t!�_#��Q�q|-�a��9n���'���bw���vV��x�!o-���uvS4!�� ��\{�aK>g������yk��:�3l��b�\�11��C;㥬�_��C��%g͆��9��z��,������P�,��F�2�_���+W<m5����˾X>���Y_O���2�f��Э���
Static task
static1
Behavioral task
behavioral1
Sample
CFX.UNBAN.YX.exe
Resource
win10v2004-20220812-en
General
-
Target
CFX.UNBAN.YX.exe
-
Size
7.1MB
-
MD5
7d76807d1cd8742f56d19993cd4ce8c0
-
SHA1
cf446779fa60c902e23c11c96583fb0a854de0f2
-
SHA256
54c62aaf5d9231270d527b42966b78723f33a8a4a2a44b2f4df7c9f2ac0874d2
-
SHA512
2068a250a14dee1138ee4c3745924694a8fb0ea556d51ec2c1901b9ffddf931243114fb43c38f0b5c578d5e3859c8cfc1ade25587d12948a77e35fefade602f1
-
SSDEEP
196608:pwSyweKR0EtkP4dKhscRzw8gc3xx1j1khn:lyw0Sclw89xah
Malware Config
Signatures
Files
-
CFX.UNBAN.YX.exe.exe windows x64
6126d919bc065c5973cdd41f57c6719e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LeaveCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteW
oleaut32
SysFreeString
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
urlmon
URLDownloadToFileA
wininet
InternetOpenUrlA
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChainEngine
ws2_32
htonl
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.+"t Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.g-w Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.[ar Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ