�ԉ���d� �칪m��h]@Z�Y:�ȺuFw��j]DI섣��7q��G]�R���6�dw����h$�:~�t/z �.Q6!=��ǜ}�f���J�G�gan�z�Al��ϼ�M��|�����J2c��W�(}��s泯Wv��E�c�Y=�8��}v��7i��6����2 ��Q?�O��f�"��Tb�E�eEB_�-�V�w^�}ÝV�<Wdff���i��1�Y¤W�� ���]szA����)-����s�A�C�Ӊ�$�ڕ��͵_B,f��i�����b���R`��Tg�=]n K92��!�*�����`�Đ�P+7�-w��3�<h�vv���՟,�@�m�����-�27q*����a��\��*���My$��Res ����-�Mu�U}���p��>I�w+�Zִ�*��?eN�[Gl(�)bsn ��+'��HŖ+k��U�J|�� �j����WrQ���#�1�p҅ �~����&����4�9���B���E���<$WRe�.�(8h?)��O<���`P'}X��.x�����38�����H�ˌ�`(����4����=6����K�*ht]���L�Fc��9��âaS~�d)�S-��i!�,�VwMy%���$�x���ʼn�W��:��5�z�t)�/2e�CL����I�| �5�� Ef��z}����� x� ��,\����w�QD ��.�o���%_��K&��'��� �Ï�_��������Df+�bF(��\����>v�S���Tk�S�/䕟�C xR�,&�qq������P�>s���O� ����G%��(+���=+t�����d�.��:�%y��o�mc��;O�p �Qp��|0��Z(�;T'�M�Ńfoj�<+j�:��>c;����x�*R�k$t�>�C+��]��*�2-;��i��v�u۞����6�.O�@v�/%���`Xpɴ9��^|t���1�pL0�M�& P�3��O��]yOvC-�#������f1Wy��0bl@/��{H��o|4��vѷlY��8X�K������^�/P]Hk=F��c}~�#ϥ�c�B]�?S���{�i���KFk�!���a@���s����f�����3VLv..�c�$,�8<��d����O>���t!C�%$$M+���c.R�7�g��(�ٓ�4I�ی�B�ѷ�DAJ������B�cM֍9�N%}�ϩ�mų�3u��4��C�R`�k�6t��Ak2�e֣�8Z��5O�������������D5�x����I=d�a"n���_�n&�]��5z�p350I�w��;z��*�}p�=����ީ�ƈ���_�HB�!�y �+���u��+���e$��i7�]N7�c�l�v�';������i[��� �) 6�Aԯz{�J��1Z)q��@1�+W�FK����瞫��?�o��hy-m���C�X�rl� i�Ì4e��4o�W����y��ͫ�Vu�3ޢ�@*ǥ��$쬳�Z-j8��Ѫ �D���=,���-rv���D v�`-� �"��C5>�����$h(h������Zh��S�i���%5�'�YgX��+J���0����r�8}hj�8�K'W�U�e���]R���zl�j*=��̤AM2�~L�k*[���'=Z�'p@�WOpo4�HF�ФT��.��1���l��D�c^��{�$d|m�v�@��=9A���5v�9�Հ��p��QY�����,!�6�����$�?.*8�tv��7тp_�b[��۫ҧh�����i�o(�����������Ke���A�0L����H��mL���� �`Cs��� �(�<4)@��ڷ�"�!vۥ��g�Ɋ������VgB����γwH��� ����� {Ʉe�X������~��{�"|�Ҳ�����^u'VC�X�JR����v�20��\���\��d�㒫�Z8�ϖܬ��A'>=a��zr��.H��[� c�%+ςiW~�U�*@;��ef�k�� :l��w23hf�]����E��� ɏW˄fo�谍���0,�˱Ό?�����O&y��V��㣹7}2t�p�L9w�w�oz����>+;��"� �<6�����RW��F |��I}������?/�`��p���|SދLL��z%�9���0-���y�k��WS��T�>3T�K|y�b ��ZuG��ݶ�_E�\j8��T�1WO�֡n|<H��]("�"���Q�R2�t���m��B��C���y�O/i0-��U?'���Y6��VS�c�w�\Z*��8wl��+Nh�z��;K���u���N�8�_q��|���f�3I�����o���z��n��������p�tʏ�4)�>R���+��~*���YvZ�Po���$Sm�uY�E�@�ڿ�R�m��Nx���(τ��[Dc�{����.G�9W���D�p ����p�j��e�q�W����>$��AEˎ��5F=��أ��s����>4�p��E����y�����j]!ҕ�&��m��jyr�l�9�Rshʰ�_�JyЌ|ɯݛ�صN�L�@w�J_�Wg���J���vsSp^�w��/���4��: ��� ���1����O"����x�g�Й�U�9ؽ���/|w�P�w�h��-!��d�1�:�*C�֕������j���gaٴ�>6��ї�<�t�L]:<j\���t�!+nW9�Ml�1p-����ٓo���`)~�������@��;��{Q^!?��z��|��?�s��i��@Lj$QC_�ӀdV[ښ�7�������8��?>DŽȯ���ũdFO��Y)"Q���B�����J����јj%�FZY�3T��a�Lu�H A�LK�Ξ���髣 �b?�0�e��7�^K]y_�*�|��3l��Td�7�Ҷh�ouIe�-R�FQ��U� �lj�.�-� 9��w`�R�p���{�˗����a �c�h��g�կ T2����z��74�P�r�{4�~)��jC2�����>��Fe��q���O�n~k��`�b�?�-X�x�Y�c�mQ\aM~�v���������O���
Static task
static1
Behavioral task
behavioral1
Sample
battleeye.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
battleeye.exe
Resource
win10v2004-20221111-en
General
-
Target
battleeye.exe
-
Size
10.7MB
-
MD5
2ea04a1591965320832c692140625a7e
-
SHA1
368aa44f45c11eecd8920474f1fc04983a1c68fd
-
SHA256
9d6f6d267aa1950f1beaa7d1991045d1607606debe44765b9881894c21c3606d
-
SHA512
751d275a75d726a7a303536bbb4755f7d6a44978b1fdf941dc1a42adda11c7e54652050073f42792e9117da4d7ed1a9d01ee60255169cd2a0bfcd40b979e4441
-
SSDEEP
196608:xwnz7/30GqUN500Q41557FkbodANqpaQakp+9gvz1toOuyDBkPtylBbuR:xwn/fNN50+15hFZdA0MQakE9CoED+Mly
Malware Config
Signatures
Files
-
battleeye.exe.exe windows x64
01472c77a4061d3c416f7ff71fd3c126
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapReAlloc
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
CharUpperBuffW
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
imm32
ImmAssociateContextEx
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9
ntdll
RtlCaptureContext
wintrust
WinVerifyTrust
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertOpenStore
ws2_32
getsockname
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 379KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.}pu Size: - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.^ 4 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$We Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ