��zu��+���R{.^.�� <0��J���Kѐ�l���=�|�>>�>i�M�p�)���!�xd����ۡrk��.��Wg������ѨV!�m��08P��]v�`�������*�w�T���;%`����f�n{�9�g��E�>t��#�]X���+GaV������/:e��w=����o%��O_��*I�N�pa *�n�(����Mx�C�mkT,U����u���F�wZ�ej:��@�ܻL�XQ�T~Y���G�Ѥ�v��fȺ���یs�|�(�t[v=��%�t��}�� ��y���4�5��CH!��KB�龩�dKE.�=.�����.Ϊ���>�Y�ݣ��r�����Xb� �b3��.CV��� �Hp���GK���9��N�J��K�i�����u�V��>��˦*�����g$��� �6��$�z@�jIT�A�R"���C� �������t(������*�鯋͒�,�kо=���\2F� �GŸb3_���S��d\e�V��������q+�I� �ojp�!`j�c�Z) ��������H�;s�b�}\�q1d�K��p�.;FV]*x��@խib��>S�M�Td8_~�1�7/w��K3J�S�7�C�����$� Cy��d9,#�2؝ q1Q����Ep3��H�������ҧ����������8M�V5kCۢ��h�"s՞'�'��9��^��/M'M�}AR��v \6�<�����1A3bB�ca�\Y�U����6�+�����7��C�2�n�fH�~ 5!�Kj#���I��m�d{��� (Р�11�{�����E)���O�I�zq0LEG�=أ��� V&�nz��jK���B1t1y�����/�ܿ�����ٍ����nS�!�Fi�iS1"'���`�0]@#��9�������'ҢhT�fKׄ���Dzz�Y��F�\x7>�n55/>� 2�'f�IA����؊�ܤq�t����oq��z!G��J>!����Vj�2I��а��Rc�]yЪ��K�����gUҔ ���Fm$B큊4�u<��B�Ǫ��<��~4�ܣ,"�Z��!��T\;��l�?\d��� �r��J6��̈́��4@ /Ź�l!'x���Eo�,b�Y�����\�m� �hOL�N�?���������^�}�E�2��(xmn��]����y��y<�.�S'�נ��{P*��^�lȩ��Q�ڃ���A.yTݧ�O���������M��ά��9�F�?jg�,��9&�tbDo'�����hv}qGm���qOߕ�;'%C�~�Ëw���U�1X�5w�&���~E���QB�=�t��<4�6��f`=�43 U?�aE� ��N���ԟ�Q;85�j�����vA�~PU5/T�,��ʩ,�b����5�eN�ȉ�����f�QfF���LO��k������Q ��UW#ź���%��i�Ӟ��?6R�A\�G���>V(�6�ng�O�t���i�I�u����Q��Z�hY��+UUY�܄�| _��CԜq���j���Ƀ';��0�B�8����34�� �v� ��_��f��&�9�(��s+��o)�=�7����H��N�I� �tN�[F� m���G�}ⱼ>p�$1W�D ` Zy����̹�GZ�f�hŷDUb�y�g}�G9GϔZ��fYHPZ]����E��� ���I�.�[�yL��h��Ū�:#c����j����u��k(y�ȕ��R�+�d��g�&��-�Zp&g��`��ۇ�fp �H� �7Ha�^�|mF� B�;�>N$���`ҭ�+� ��)�X��'�a@{��,=:��0�.[��r�Zh\H���Fވ&����JZ9 4�?�v+��>�~���Xck�`�ʸ�����?7I<Ax 1F��jd�ƽ��i�n9�����#�z�Cy ��d_վ9���ƘI7�>��M��֔���ʴ%'U�Ne]�+�m�� ^��UR1�k�x_}N���1U.�,��.��! '��z2Z��bR^�z9|{Ti�}�ϛ�YM_��P������<J�I���Fgv`�2��@n�Zw)�4(!��I��Z��U�' �_ KB��F}{�?�]X�w�b0/��V���� ���\��z�̰�����YŃ3����`L&9�!��n�B��į���(0/@˓� 7��D�[<Q��X` ��p��s����&���ef�Y�{~�6`{���J;�%�ڇln�3!�����"�"�q�H���x[�q7@��9�uO�{��f��j����Đ'��m���U�P}��x������.@�S"�[e9�f5X%,~����2��+�؏r�- �|�h;�g�o+�r���?�y�4N����ՍC�����E��������썖2{����O�'�%mŀr�wF�� �)/��O�"̎�T�DD���?p��+��3��_�����z�2J�s�It���"y�q�;�=� I�ň�.�֔ ��x�-4��d���$1�G�)f�*�m��6,إ�Ɯ�xI�z-m5����3�:�'T��1)���Ul~ns6�X�t*�|��I���t@V!|�5ا��䙼�����&�#�;�TU�u<MEQ ��@#k��1 ˻����sj��Ip�/J��i��S��1$��nx{!�>_ă�4ۍ�� �K8���Uj��ڋ/�46���k����o����ϛ�MA�f���0�w�*��_0�|�h�u�f��Ko�� ��>^]j���!�Aur��[h���v�m �N��Ɇ�2W ���ݹ�u�Z���W�+>M����}VNA/O��{�\Z��=��e"%� E�R���<��`ӊ��"������4�V� gy�I'��߇9h�Y�XA٠����I�˭���)2.���a7@�2��x�E/�8>1�u*m����r�Gߒr3 �V���A�Eh�r���zd7�:z����h����ȗ����dMј�8�}EŖ�q�C�`G"Q�ojZ]K{�Q�.�bgʾ�6O�G�b �|x6_��d���9���?,jxt�ZO�'�6~�@�M;�ˎk��m�$qS��6K���m�Mt��2�T���o��z�� �`Hn7%cX�ӥ��t��ݐr�9�sQ$d���9��=�pM_z-���������v�<m�n�&�%�
Static task
static1
Behavioral task
behavioral1
Sample
xRay Web Vulnerability Scanner Advanced.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
xRay Web Vulnerability Scanner Advanced.exe
Resource
win10v2004-20220901-en
General
-
Target
xRay Web Vulnerability Scanner Advanced.exe
-
Size
31.3MB
-
MD5
e9851d1e1bdf48fc1db34a1afa27879d
-
SHA1
7594166f3809ebd76abdca3cd542d910b7721056
-
SHA256
ea1bde68a4f77ccdca3cc86a65659b0d15a4237a43df6a7c9685398d34bff173
-
SHA512
2a150b0b0a82d98c00a919a0e0cf79b449277d236037431c1f99c0c8878a7ef52591c1a148f836486cad8d97bd161edbdaf8528c8409a02d476087d316881b7f
-
SSDEEP
786432:0HM/OtmJ+9Mmli/1wFGG7VbAfFMrBwXVu:0HM2tmJ+edwFGObANmBuVu
Malware Config
Signatures
Files
-
xRay Web Vulnerability Scanner Advanced.exe.exe windows x86
Password: bgjayfarfarcheck
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 5.1MB - Virtual size: 18.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 21.5MB - Virtual size: 35.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1012KB - Virtual size: 7.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 670KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 247KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FarFar Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE