[��������%��*�5�\��U-~�x�U�I� ї��%���W� �v���c#QP�?�Z����1WV���m�ï��?K���nT�y��W�x̂�N�6�QX9$�(Ģ��pU���t�ET1v\��o6�_.WB�J�V{6�~�e�~-6���4��y���F�?�ruv�e�2�U�F$+Σ剠��|� Ҏ����A�&�$� lHaz2 @&Z̸��˂1�3G�f���n٨� ��i�w�V-n��=�� ���1��Ē�h w�} �9��J�'��E�b��FS��q��p���9�s��~'�j�꜏���R�" `q k3X�8m�@�n�f�w7d���d����wH{F����x7�f'5O�x��B):� ;�%���!��]?6'�����Q)O�3c��]�B.鿳�?G���Ļ%_�o�R/"�8ϔ�V�e6�+�ݭ~��S�oP�54ҮWV^�a��`LT�@�9��W��x���h���=D������n[���� ^�����tY�5��m�laIB�@���c��U</$Å�5^3��!"�5���*�r�O��_w"�7�!������v���yR���&�Tj����N����s�Ł ��m�0.ͻ/o;e��h.�JAmz����Cs[Ls�����.�#�k�3 v"Ĺ)��fjҕ���M�?p�\��A3��T��j��LX�����W2*ս�<�����qo�a�'���&q{ߣ\�<��}��������)}����8�[�P��y���x��%a�q��"/��P�����6��5Uӷ:z%J~�e��c�@h���e�r��F!�6��˘����e�f,[��:'a�p�٤�VEilJ:%��� y�uR��XY,�Fl_���Fޗ�|X8I� Jt:��2�9���1��-`��o@�����g`C�u��0L�[Aa��X��� �Tj-� �tͨz�G=�b���?pFC�T��>��"Nt_��Q�k^��r���i��|�Z:E��4�s�/�g떃�C�y��r������y�P5MO�>�3le�,�r���7��������1�N1��#� �������,��)�`0�~�x���O7n��R�M{�����U���@���wsA������u�����q7�8e�����K�9�+8�.a8<��F��}�`�G�3߰§d�r=SI�ujk"�\��聃@ XC��>5̒�۴v�!����`��.ډ��Y'���t����U�|P�����P�+xm�$s h#u��M����9g�����/ ��'���1�̢i�>����\����:��1 ��0b�n6��V|�5����T;�>p�gZ�3hf�]%K��R�!�wY��bN(�&��H���|�#z����YN�����У�V��8=�����ߐ�3Z�G��K�W������Qj�@�[���li8:�1v9T6�p58"KQ`"���ŋ����l�����/b�����VYb-U��;�U�����7���a�N�� �z �Z�H�6���)�Y]Jc���~�n�*���S�/���oDx̫����ڛ|�3�b6���?E$�[K�@���z^��M��S��je�V��ɫ���%���i���-ʤ^j7eeӭ�Q��]�+8���欉b�������B��R��˱?g��Cl男l__�}3mL`8�]tQħ�:�c)��r�����|X�/�V��������j �'� IZ.`σ]�"!�M>]����8Qe^����K/�'XQj�Z������ag��ʡ��>vK�t�u�Lb���2�?�?k���D6�b4״N��;Z��tߔj�h�6��lR�P�G������A�ؓN!���m��|�6x�����h�ַ��p��yب�y�]Q-c�8�5x�)��V�m(��fjn ����g�y�Cy�;�]O��&�UL���aT�ckE<?\̪5�N�h4��S�t��,�ﺪ�!}��ߍ�I���D?����7f(6�1i8/�W��>����~�'����g�!�� �C�)ox�a��*�j"(0X�5�HơXc㪻S�xHΰ^�Y ��:`�y�AP�>|�=��S8k�T��k�*����;>�{��zg���nc��yQ��4��t� �SjuS���}����pnD��"wc[CY8�5�OT�NΧG$:_��%��(xΙ�G)��F��5_�тe�z�4Bjˮp����i%���[�=��$;��$��H�@U�v[u�JG6��f�wlZ����ۊH�����f��l���m8lE�3�'���!To�����we-��i�o��?��ι���w7(��j����<��9D��&(X��ԁ�,R�D���4������}J�֤��}D�1J�f'�&}��'.&uX넫�"��(�����{1��О�j�K'��N-N#v��eX:���7�� *vť �������j��3���]��_�Ԯr��.*�b[xa���M�����0aM+��A.]��1X]� 5���YW�p�����&T�F�u{$�Zp��A�+�h,��6����L=����{غge���=RS$�gx �1]X^�Z>S�|���S���t���lYf/Z���nj��Y�ӽ�5�P���t9ܨQ��qT}���0lNz~�z��k��kXx]�́���(���deα�C3Ǖs'-U����B4�=8���(?�1��[]���A�ӛNe��c}�m9x�a-�@��.�i#?��HDj��ӏ&dQX�Ax13 � W&;����^��g�"�Y��4 P�]�4����z�Y�����Q=�X�}b�}��A�����C��\�tnލ���,�SxT���6g��<��7&x)Z��[�*m��MR�8��Z�������@��2���l�ۇ���J�p�zDY������Kg>�=)���$��'/uv��G /͆�P@<�V�x��m�h5T�C2��n��cTS44�ǐ<�Z�����u<����zP>v:+Z�ָ�v]}0ߵ�@j�l�So�R:U0�x
Static task
static1
Behavioral task
behavioral1
Sample
cxvotw.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
cxvotw.exe
Resource
win10v2004-20230703-en
General
-
Target
cxvotw.exe
-
Size
14.5MB
-
MD5
fbf1002bc189955578765f439c9d949f
-
SHA1
9bf1f53778cd32fbdae718dda77ee681b57195e7
-
SHA256
a7e0adea039841b14ff04d120227c7f0f14630f70f863c302b4e7c318c447dfe
-
SHA512
c94f1ffae50b80bcea1da64124905d8ce465b520235859e7bbc6ade2c9491f45acd5956041384f9be396c17ee13da77ceddb124a4cc8855a721b85521b5c495b
-
SSDEEP
393216:DHM4FyeVWUiHoG9KjdGR8nbxzDRej9NG9Sp:DZzVWUiHoUqGR810BNG8p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cxvotw.exe
Files
-
cxvotw.exe.exe windows x64
1afac1ab3518aa2b263c9562cdbecdfb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalUnlock
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
listen
crypt32
CertFindExtension
wldap32
ord46
normaliz
IdnToAscii
user32
FindWindowA
CharUpperBuffW
advapi32
OpenProcessToken
shell32
ShellExecuteA
ntdll
NtQuerySystemInformation
d3d11
D3D11CreateDevice
dcomp
DCompositionCreateDevice
dxgi
CreateDXGIFactory2
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.b>{GK?* Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.*=6'KUB Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ap2-W,M Size: 14.5MB - Virtual size: 14.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ