����Cy�x�75-^¬l.:�s[x�;�:�s��,�pCjݴC�xa�4��C��װ3ˎ�J�[{�G�3}*=kw:x܌�Y��C��P������$��:G�A<G�S�Mo���E�������ͣ��e�8�g�8���]�m�/]<�oF۶�zH$�Y%������ACBK�PQ�����2^:0!5P��.$��謞2d`���.M Q���0��}��y���t_U�|ݔ�B]W�͕�Z�/�)�d�R P%��͓o�|R�;+�b�8a�&����"h�+���T5����v�2��A{�+-fߝO�<���h�Y�}JV�Ж��W�)�':�g�7�������%Ӟ)������nî�Zy����{蒎��� ��.�GУ�ߊ�, 9�3Ҡ�T+_"f1>��28d�h91?�'a'����Ҵ'h��0E�z ���;�g�����>Q6�6K?eA���Jj��}\�HZs� �\���P�:~7�{��I ���\���N8���CBiM��[R ��?�V�x�t���*����IעK7������9�_G���11�V�^��JJ�o���! ���~�h�G(�C�.�T�������'�< 45Z5��% ��ݨ%�ҎV�g����4��0�տɛ��#��^�BhW�bБ&=_�0���$_�Lw��[aJx�*ɧ�� �:���~r �Q9����o��A�㻪��_%��٤�F���(�h�.Z>j~a\4{�ć1�k���G�|8E�+s̚JG�*�ZBD�h�v�6D��.��w�lX���5O�i�$����f�pA��@y�=�қ�:�"#����W�kʷ�i���Ҡ�}=��r#]����Z˗�C+���b�t\ m���Uw'��Db��\�*���_�O�4������A�v�f�նH�V�'�t�#%���=!��$h(r���g�V8��:���ۓ�0��AA4�C���U����#�S����]�TCe-ȓ��*9U�P��~�A���O���J$c���1��V����_P�D����R��EB��9A��y����:U+j��w�6�}�t�H���� �1�XK�N7y�s�?f�����O�P��3�>`�y�.��,K�][�����`���N� L0⨈;K{��[��s�J�ހ�������=\��V��@���T�Ȓy�:�2i�qc��G^CA�ڛV�P��S|��M,^\o`c��"Έ� Y�����%M� ��n��:mפi"������y��%*�E�:�F�;P@��ت�l�71lJ��ܣ��h�Y81\Q:��ڨp�S�H-;�pxZV��+GP�!A���48��;\�L�î��4�N��v�Yd�)ڜE� @i�K���Q���̧}S�ꄍDoo��g����N�&��2�[�&��ҦQ�Z���/�7?�}�Ѳ�옧��g��y7A$�צ;�2P8e�v�=Rs�!�:�e�-2�6�'Q*G��'����f�q����U2��+ uua\V��F�"���4�i\u�_����| "�C�X���i?�HECR��s�6�wA�)�O�j���� ��CY2�}�7~����>z��a�T�_�ϟF��O*�����Ȑ`�1`0�?a��wU��Rx�:�����x���#!s���A��'l�P��֠"����ח��·�Q\c8��։�5��<��.>�qL��}�%�[o˯>4� \&��Zd 6��-LZN��1��� TH$}<�Q����Z�L��J�@Q)���<c%�{ib�0��� U���7��@��,����BR/ �,v���>�l�}9�҈����(�T�B�U9���f��1�@����1�B�j��6�N�m��@���|���;)�&�+с�7��>�5�;]<�YQ,��V�r��Y���� ���X��F�+-�R=_�DE�h8��ؤT��x^��Y,���x+��EI��jg���qս�q<wĩ���-�R>;e"�HW[����K�&����3���1��E�n�#�+3U���o_�7�#����"��M49�W�lBȪD�a�:cL��R�� ����+�^:~!���I�r�+qDy�[��Ů|[��M��Ct�B�53�T^MU�1^L�IJ��*:��z J�-^����#bY��m�~�a��C�}�Fm��9�QI�#)K�{���N"��W|t�x̵b��䟕� )a1�*ָ^�S�7�� ��)Ch�fǾid�9>WHb�3 t��#�-��5f��DGo��J@8�G>���~�5v���k<x -}�M3���M���d\L@|*6�����G#Ɔ�0�9���p }�Q�A�28�r_����P����~'|���mÛ�-�Չ0A�W���D�9L�lv��8i��S܈#����- )�RƛW?$����@ ��<x7��D�fC�������y�;� .!�1}P�3W����m�#��F)���d+��T����dO2_�o[0��|��gS�d�`Bp+:���R�*!u��|Ϟ^F���T~~W��J.�Ƹ�anr��]0*�d�b�-�Ɏv�|��p���z lʷ�C�*)��d���e�S�MA|[��hYCBp��^Z'4WZ�/h&�ԇ����O~�R�� q&�L��(�c��wC��_#O�+YP�kFC�<�����%���g�E��p%W�mS=���&� ��w\ޟ��cˎC��b��m�/&����}���*��#��a3�����E�>g���@E�����ն���2ߑUï��-�K6��{����{Kx��78�pU�5��fc-/�L��@�%,tN����O��}?}��|�M��æ���I���.���D�9���yAؼ�H����=0�*�еL���';\{|R���t�X�ZX >ur 9�w+��Q.k�x���ʣp���| |��:1w!��3ڏ};� ��&-�f���������1�L�������`�H|�F����´�ː�\����kɸᒈ�/ÚT<�����/~��E+u�<���Rꖧ��9w�#�v�F���1tK� vZ:r
Static task
static1
Behavioral task
behavioral1
Sample
ScripthookBypass_by_TiagoModz.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
ScripthookBypass_by_TiagoModz.exe
Resource
win10v2004-20230621-en
General
-
Target
ScripthookBypass_by_TiagoModz.exe
-
Size
6.0MB
-
MD5
c39e7e2e12e8c852b61e1129f5e4913f
-
SHA1
2118169778c822c816a63fa7f7e58cbcfaaac9f2
-
SHA256
c18dd9ff059bab99d628666040ccae46d965e0a5498ed5f25560abfc84676a10
-
SHA512
1727b773f21094683cfb1a1360987dbe95c2d5c2dfe25ede223b7642d20649778609bd81e1d794a2f27502a4898ea9727ff8d713b3ea53731354492648975718
-
SSDEEP
98304:uNrzuFAP6Bnxz9fSBzdKQ0kXfdht3U9FvrAZJU/k3BhmqQqzNHWO:uphilxJfazgIVhxU/cZywq+HW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ScripthookBypass_by_TiagoModz.exe
Files
-
ScripthookBypass_by_TiagoModz.exe.exe windows x64
0a3840ce17cd5e6deb334e35db958195
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
VariantClear
msvcp140
?uncaught_exceptions@std@@YAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oT< Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Mhy Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=CX Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ