�f(y�OM��&Ѿ(�uZ�J0��@��H���9d7���D�)/qTҽ����~��o�}����Nr�2q,�0{'���h/��/� F3YI>��O��2^��,��m�(���Ս�/���x�mK0^AwxL�����-qA�8��i�=.y��q�͝��7�d�CȽ;�T�,w�P�ů��c�%�/��n5��ڒ)�)�MH��6���s�U%<7O��V݃����� �c��ZOP Y-��g �UsIc8J�|�~;�V!�Խk�v�����������V#��uwu$3��#�&J��U�=�gF3!$���$UJ_۰��@���(?�+g�)\�R_�l<HC�U4!��ѽ����#'���|��?�a��W%�?aV�e�����rt�����ϕ���tʝ����� �f��']|f���wծBk�r�6y?XH���f����##_q/v��n�?�5'����$:�y�l5�x"d�_p����F"�%zlj���]������Nm�#8��j���V�ha���9�7û<����m���^�-�G>����MZcX�35�aт��������ט1��u��(�����D��"�^}�Y�gj!j�N�ŀ���G��Vɴ�ӭ|7��g\��/�e_�K���@�`T�I�H�吴�w�=����Z���Z��i�8��Y�|��(����m�yVuh0 �U�������G�s�R� %�V�IHnZn��` &��x?�4$����|� g��a `p�hze��]�"{Ā{�*��_[k�3?��rF��P:�_�a)M+��5;r�\����<��e!}6ohKLd��lT�P�Ž��QP��\�R�¸�ۤ�G��8��xo �n�^��̐�E��P�=R�<��ؒ��ӿoҨ�͵j zL��\j1�נ�},�Z {��54��RRi�D�0*W�M�ze�����3i2n&lrL�tJO,e�����嵞Ȗ L9���s���� �熵 ��&�x)$���"�ljl�▏���1�U�"��S����w�W����.y�-i�3{�!Qz��3&l�m�t1�J��2��盟E��&� ��p-���xSO���k7��]�w8}S� ����ڙd�&�˄M�e)�E��ZlEaYu$� p�4�Y�<h�{�~,������N0w�8lI�r�d�TRZ�tygH��F�'~} ����h�g�'�)q̈a�+&�P��{�yT8���9*+���_"�{?��ְ[8�Q| �;W� ����u"��7�w\� ������ ��<R]Ns)�暀�z.R�*�D;� ơ[�on����#����\ ]%J-��<��O��w��nEL��R��VZ���4�ɐyS�����O��l&�NɃ*a�j��L�-��T1������M��E�O�g~[;�ѐ+!Y�����>�DQ�T�O۰�X��LV"|������>��B/Ke����W�{ʮ��q̞ M����� ��рeG�2 k�k���/O&�! m3z=I�9���/Juێ�41w���^��RT8���>�4�zp"�g�P��������R���3"�i�S�@����������re�Ȥ�����c�f.�3�%Sv�g}���N �I��탖*@.��5�'������jw��t�:��G����Z��w�)�� ���+��Y)�]RoJ-� Z@�-5��t�(Q҅��@���F�������v�M�5yO���(�@*�����A���%����)�T��c�C�Cc�F�b�i^���bSb�F��]v��v`G�t�렕��JR����M=��6��R4cە��iPz��^5)�I�Frq��c�������(L����W �}�fe���W��[���YI�g����)�]Y=RQVA��-���M�����+/tݳ������P#O�V���杷ݾ�v'��Hqq���}b.��L�jrI�x��� dG�F��&�!˨��O�����C����]�F�σר�R'��� ?$���5B7�P�n2b�����k�h�(- ���y����ܪޣՈoܒ�s}� ��SƲ|!�O#��סl�2�%��ٙ�no�R��ģ�nď��YaR���}j{��}�Obt֮�;�U&=�W>���֥��H��EJ��+���=���0Ⱦ��4��Ȏ*��ὣF@�����S��Jx+6�Ľ�9�k� �<O>��j!�*��.����p�|�FAm��X ��B'P�{0���������* Mi��qT�-˝t���Q����Q��١��[��7~�@J:"a ��%�؈LF ���q� �t�j�7�0`+�=݈�$�K�~m�!�[��Ѳ���G ��CJۈ�0�)�95ae�v�FL��]4]�M�g5#����ٱ�C�,�n#0\2���������e"[��j7�� yM���D�w�o nkp*9HByOr3��w�@5R�.X�Ω8�����c��v���0�4�%���oX�+� �6 p����)aY8�ʼ��(.�9����հ;��OW�B���&I�l �M�Wf��KS��yhH�(Cx�%I+:����� n�T��X鰓�UK��9���jUf��=�NR/�do��.d�������̆�0W�TO 7y�Pu7&.�P�RL�'W�{��<q��Ǐ�W>y� ����� ۴����0jĶp��"_�*Y�/O����C��F9%��N c /��J�=+����:����G�4�6y�d<�G�e'L�s EWR֘�k�����&"� P8�F���6ֈ��I��-�̛=sf��n!��ޔ���E�j��>&X��Q�˟�}n��3+1��&S�|k���Kh��6��`/ʻD��@8����X͆��S��4�3\�&�+���:�e[]��j�"}hG@�c�.#�P`Cf���y��w��l PNU�����������d��`{�^��N�{ƙpd�ңno8�{���g��$��e�G�N3���YK�����f��#����k����h�+��� !���)�Q���ưh������W?��bV��b�kRf��>�?�d ;9��r�/�Yy��J���
Static task
static1
Behavioral task
behavioral1
Sample
en_xachinaproject_fun.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
en_xachinaproject_fun.exe
Resource
win10v2004-20220812-en
General
-
Target
en_xachinaproject_fun.exe
-
Size
4.9MB
-
MD5
718a26b9d4072a1cef33e4c7283b88b8
-
SHA1
4babccc4cdcdd8dd443d2d357fa8f3304ff08189
-
SHA256
ec90aec32da69d6b09a52f377011160701a4b417e994e1187d01e5df2ad110a9
-
SHA512
952c4f178c8dc70d6b9a2e6ad666363ebee3d9d6eaccd262ba7f0916865176683dc1b361763d5850aa0e5f2adbf77de7d9634568750624e81248e77ce0d89dcc
-
SSDEEP
98304:It1gND0iRa0AlRJ+nUXcnvRqQI4MPEFr7OcP1Zia7ejP:ILT8vRxMMFr7xr
Malware Config
Signatures
Files
-
en_xachinaproject_fun.exe.exe windows x86
154cc7b15e2da76e061894402b87e8de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SendDlgItemMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
DecodePointer
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xachi0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xachi1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ