K�������i�YI���9�`��������D�x���l�z��prK��+M��vn:��"<�Jp��t�,������ ����q�3��Uc���A�KF�I+�T�a����y��<'���I����2���O�W�U�bM�k��p˓�տL �ܲa:?�.�+���5�k"5�g= �Z�AN0�Gq�+cz��o2��8���ڰB�͋�1��!�e�`���H��!�w�E$���U�LN횷�������Y�&������<��3lJL�������<�w�?��B�"O��r�ZFM�gJ��V��MX��n�T|^u#�!ܧ�9oW�wv_^���@-����j�˫�߿��l�P5�8 r�u��UIޫ�;sW*o�6(l>gY��ϩB��{�onHK%�߲SWZ�G�7����,�z2Dv[J _��.j����'���F�3�^#��S�o�w����W�~3�� che�мo�"�v�>rW��%�:��y��W /�ޓ���I��d̺�P�V$��}=�qfrz�����ۓ� �h9���W��#�<oA�_#%� �[+V����LtN��?���n ���%��g7&��8���� ��c���DrBs�Z�K�C">�����A�.�k�6���Z��� ���E�"3���������E �����%U��֗V�=tʐs�����pt�ة#�B��a�����?H�ð/��/�?��N��)$~惻t�5��苌#�N/}�,�5�Ubƨ�\����z�d��ۚ~�U������<��Z>{�F1>+xp�.#�:����ox��"@w������߶k�e ��`�&����A5�WR�6��� �����+������#�Bqԩ+�n�R�~/u�2�;���_H�/��V�i�QD��` ��cC��@�*�y ����5�(�`�Jf��D��ҫFو:��}gM���K�i��eww�=�wIJ�����㪓 !������Mh�E�#�qE<FW�?{�� 23 B� S���q�?<�b�W����X~���#�����l��G����r�)>��^�j.E4�<6M�@@�X~�(�N��$�u����e ��Q�2dS�����`Q;3U�y�V�ST��,B�J���'��T�Nm10{���0�3F�I�-�H��u��J^]����s;#�Hu��X#iQ X8�y�����v$-�gg4z%0$\�5U䇔Y>ӧ��� ��B�����Y��.�����A#���Y�7�c� �u�n��F�X�Q���kW $��鼠�4����?*]���A����ިhֶ5B7���;<I�4`�A3<V��5>�Ϲ�s����F��/��g)4/������a�4�-�)�;�@�4'~t�ǟ����8@�r�0jG+��ac{�E78�o)R�Fs�/9�,�����R���T4r`�wP}�ޝ��������{��b��Y�`sD���ެB��<S���e^x o�Rĉ���h�pd���T#������|R��WvȮ�k���V��j^6��v ��n���W���R��+��������"ɏ]Ƕ/���'�Z���nN}w�*�,/zI�������]o17h>&���b.HEc����2���nw�F1�>S��qg�(x��R����5>*&�NŞ�T8�ޏ�g;5B��=U��w���4�Vk�]���<(3�����][�ߧgM=��O&����.��!=Y��߫���{٠���(�6D3� ��Y�ȯ�44��ee�l�.�8Ҝ�"g��E�V!�ꐨ�6�s�0l�ǫA��'�yH�@���O�k�h��w�g������$c9����ס�(�u�E���:q������˶�WW'3���ɓ�6���|u��oP�:#�r̠��f�;�z45����T��lHX�8zm�f&;��^V�7�&y����M^E��'��9)�Ze��8���խ���s^�G5~-�H��^�q9w!�1RUe<a*�"�ç�l�ۃ�?�.�Ax-���o��O������¿��x�߷��|K(҇��g]U%��@� �,=�{� `������� ��K�I\�O���el�R��6"6ϩ^��6��%j���S�s.��|JqPM1Eٱ�|�`�t�Gڙ$Y!m�p�:J��Y�~�c:��XyBe���\��T0���RWO{�%\A����QR��D1��F��iL-<�����A�i����?*?�k�8�<_������G�6V��J���-S�A��`��k�10�V�>�O�`�R����<���(��o�:7�՜N����Q��H��D���&r�m��.(�J2��}�*D]�stpߐ���<�;�����Zz���(g?����F���@����!NA�d�qӸG��%�� �Jq�az����Y�A<7�'������:4��(���`���m�K�I�mOE��]���b#�.�o���~��0!BUS�a�& ���i8�4�YW6h���D��\�}8lE,z�%)��2���W���P�M�V�����2�sD�V��#�'���F�uRB!xX�uϿ�o=*V����2����Y�s���6};�AF7�7_?k?�.���N��f�����Ov������u�:Bx�kίr)E���9���u�A>+�˔�b�H�z�QIw �9�]e��g�!C��e�2��L?na��P�i�!�)Ӭ1|=�|�%�|@ �V�s(']�"/��g��������Zo�@��m������^㴿x���-�ohW]�(��| �������猅fc���:��nR�Ó�d�C�.o)�lQMu�u��R�H� ��i2��"�����0�U6.��֫1�)��hu�?�OcWi��N�%M��]j ɩ ��s߾�ŵC�HB9�f{P��}���2b�+2D6�s61�q7T�"�(�j����x��h��f6x��~���X��A����j�����}�!��|���7�z/�����LKA���b]����@��a�lW8"�!hD"�2)�����Qs��zR˭s(��֩�S`�$���)
Static task
static1
Behavioral task
behavioral1
Sample
load_dx39.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
load_dx39.exe
Resource
win10v2004-20230220-en
General
-
Target
load_dx39.exe
-
Size
8.7MB
-
MD5
8ca8e73cad413e5084c9243c868e34e7
-
SHA1
83d6a76cea1101fc7822b1ca6c16a1376a09d2d5
-
SHA256
86643aba46015249749f9cad02d7b9dab775f1affdcc4974c36852c27aa385f7
-
SHA512
8358d1d6aacad8140656e466740cd48e04ee6f8c15701b1686b14f0e392c4dd46a1d7b3760bf6111f7b2ca1eccf5c78dd2703f829621e5289d9c380d1a48bdb6
-
SSDEEP
196608:obLb03Tx+PFlyiEo0hm1Y7UZyZ/3TWAoaY8ymRPBwdweN4kZ:obLbUx+PFwm1YQZyZWAfJymRydwMv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource load_dx39.exe
Files
-
load_dx39.exe.exe windows x86
Password: 123
d99adbdc35decee5c15007d2e8a65e07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
wininet
InternetOpenUrlA
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uwu0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uwu1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uwu2 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ