x��:�r��p��&>��e�F?���Aۗ���;��m�Ή��1�����VG��y�@!�x��_.�fa�}gu�� �rGH^���k1v���]�vԾ$+W��H��/�0���̼�ܓb�vD���5g���g�>�')�[��2e+������ŷ�ˬT���UM����=��W�m;�yI�$܉V*�+���t�p�ǒs�;H�w�������&�7k�\$}�AA�>z`�V苭�cD��6�(���H,k���~(��:��a��#�d1R�[�/]�c��7���ޕ����B������GA��T����f����k[�Ӌ"JXs�nC���/�f�)��2w���N�=(j?�8u�yqg$�����*�1�����]F��k�@����ߋ����U�.wO��_�l�"��01�E�_��T5~���-{J����+��{Zm��T� �`J����Y G�ī�� ��L�2��3���7Ym�%���;JҐ3�X�}��$��7/���|�G������s�a�.\�=�����3�YU��Ā�+��T2�HA�p��4! �$b�wO;L>Dz�&+�Į�����9D��לjq옴�g�S�t8��ŜϢ��~p�A�$d��]t"8���1/ ���<��r��m�ր[�}wz0�~Ɓ���"!�č���+��md����Ę�YWR�h>���˛"q^7JݕY�ˇ�;K���q�ߞ�J�ݬ����"Ώ��њ SD`<�aF/��?���5�������R,4���=�2�rFUd��S�x� 3�D�4��T������wA�[��T?���wa��4�J�,���[~қ��M�F��M�̹1)�'��`L�$�УI9��D."������1��!��4B�E�@�����˃Z�^��G���p����,�yF�}��x?�S�5��h�y/ȤO0D!��?��)lK�?��؟�����I.V�W�����%� 9�����RB?� :��V�X6E��¼�����¤�J:�>Ťx_���:+����V�c��W°���ͦy<�۩�*�Yh3�*�M�zH)����g�L5,�x��'��k��8��o���<ndz�p�#��:,�����)�P0e�����'������F����n`���))��<2g��'M�@��t ��G G J�UA �n�Z��N�c�L������.H@���Se�.@8zW��tA���,X[��/ZT��C��Wo܌�}2+j%�2@��-|R6��f75t3T��%�7�� %�:�8�&�?Lw���f���h���o��ZM�xC^y~���\�UNC*�it�Y&��v�ՌK��5��m�����Uy�%wĠ����.��_�\����T�,�rx�'Ydw�i�BF[��-"���N"�Ȍ]k?Va�-�'��;�fbg{Y�JG���Һ�}�G��L �O�lD������sC�rAL#�X[�P��[�3�O�`�|,�E���K��q� t �΅uIwd�N���[��E� �z�� ��y5���ȱ�*�/{���A��t#e��}b���e�?'�T[=�e�D�٨�v�j��n�'{$�]2�WaׯQ�s>���o������[����� ��ͫU�0p���)����!�FȆ_�|ܜlZ��^��Cn�?,� 9^)FL�ӡ��|#�b����M��Xʔ�j��tBO; �dܵ�����%���E���`��K�)��m�1e�vyX�z视�ew"4��N��+���)GP�\�-���ag�p�I��6<ŭ0����hc���@���W��N���/���⫈E]�'����a�l����^�+��#�G2T�[���M�o��j��d���O=YWM9�vRON9�h��ʀȿ�CC�[����_k(ozn���z�)=ק(�Fe���k �e�(S��*�rC���5������S�B�A?#�-���J����.F��{ԝ�E�+d���O��~���g��yvI0f�MB{���I 4�"�8f�rE��ԉt5���5�����Q(��/Y�X�ڍ�Pc^�pՓ'����V�ђ��N����|���/�.��5�M��?2�y����̍'�?���N����5����,D� �p+-����ɓ�T%<���p c��3iK��5�Mj�"�Z�:�],p�2eo���cw"���� ���/��û��C���2�CU�ο��?�J�8�����A� K����. ���w8^b;%]�W�{�����Ef4�J�擮w�^��L� aWH� �I��"��uvo�� �*��x�����P4K���Ԧ�G�L�I�N3Ө�U��z�]f�����x��}ޝT��8ZI�q�7���⛐عB����M��<H�+�K���A���Mbd1��3���3x�8X`�m�� O��^�+̡��h�k�2 ?f�P��k�r�p7�>JT�/�c�v ��ʖ�yfhC"�e����[�*��b�������Z3L� �����٩��:�Y���Ѿ�Xk}5! ��?P����M�1 �9�d�;����Tέ�����1��qO[����"j��T��ǖ�M�C��S)eQT2}�r���5I�A-�[�3�IE|Y~�S�����5T���L$������q��� '������w�*g6�S𪎄x�>�j��{P��������)T$�<!x� O�@���J>�*V7a;�M\(�^�Z8f����I� �X|�}��ov�u�������ksvV}rpY:�L��x妴� �}��R����poR}ΒҊ��4�#��djW.w��+|�?*�Ib�N�OY�D��Cvj�[��?�"�ϓ+��G*գ�m���/�G�±w�W�~�/��|��-��9/��;7]�K�%������E`}_?9��>�a�����NJ�� jhc��KM����M����������P�$hZ�Ϲv�+�v`n=!�Ҩ��Z������ır��#:�S*.��9�$��_R�8_���FWs�?�Df����ߐ�.t�%�Ч?������� 7Q�O� ���:�
Static task
static1
Behavioral task
behavioral1
Sample
Netlix.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Netlix.exe
Resource
win10v2004-20230220-en
General
-
Target
Netlix.exe
-
Size
5.7MB
-
MD5
d74f43d5a83829c38771a329d69a7502
-
SHA1
2c99b799c4ac4e3bd77e83316a36276137ce3e57
-
SHA256
2b586e52068589cc3370e8b855f1f0e7a9682af1f0f03bd8342e09bd71463432
-
SHA512
cb23a40df7f109121db5f5b783e44b4d597ffc54e9e4a5657c57091a0f8a838c23b8dbf9d9d7a9a26e8f89269f48efc3c5009d32f13ace7da3b4097b5039fb40
-
SSDEEP
98304:+IY8rAkZKXYK7X5T0icaIH8tkKTk6PxLpNhQc8guoiq5KDTnKnJ:L717MpBRhTk6pLpMEuoGT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Netlix.exe
Files
-
Netlix.exe.exe windows x64
c198912aaf2145e12561f4f9c581f275
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetStdHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fdwf0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fdwf1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ