.SN ��@}��M�x��'���u:6�44��|�����r7�(3�hZNHr�Y��8 o�� q(z��S�~��� �k�\l_� ��������}���z�ɥ�¤���j�$��*u��K�PS6�m�߀�PA&�Z=��w����0��E���ݏRـ����%��� ,���#/��8Wnx���i��9��1%��GQ�x���U�[^a�_zum)'J!�\��e]�=����Cw���8�nX{��ok��'�<5�nێ�a� �L+-�w�GJ��|�tC����Էӷ9JA LK��g�^Y�X�# QP�l���s���2�<h��B���rVP�%�*M�5 ������s&����Q@��!��o5Lu�2�煂���ox\*�߯�4�3�樢�'��~�e��_����A+\�������)��;N��v�{�ɠ�?����(�NƸ��%�����b�a������U��o�y�y�|��Re�8=��=�S�C�nyy�{u��;\°Dg=�=�h��1K5ȧWR��3���4]C\0-���њ�a�B{��\%g���i��[7L1�{�A���V��|�:臵0<E��J �I���n�zpO?&h�u�2b�G�]����e�Al��] �������ٶ�I;Uqx�d�{@����!����5(����Y�:�Q�@Ī���^�Q�)쓍F�#����A�R�Á!˳��������Ȫ��]D���m��hNiY��wA��:��t_gU�q*��O�Ɨ���{a���'د���M�+I�nH�~e�fX�3�0U��*�Y%F;]��^�ڼ_��Lz×���?-�r�c� ��Ds쐾P�Ȅ���~��{���[���<; ��tS��������Nн7[��W&�C��A:����g�H �B�m��Cȼܜ(Ʒ�����} �N@::��a�@�"sQ�� �^�lv�"L���Q�K��l���[OW�H+��B������J��b���x��rS\�A��a#��34�S�+6�����Es��|���Z�fe�ͳb�R]d�}i@2^S�'Q@ ���(F��7�+7V�Nr=P;#�R�8�iT!�r"�,y�{��>B��[!�����ջ��� wP+֚���o�r}�}"�%F5�v,<S�<�z_�ܮ�V�!���]� c�ٚ0��ɤ9 ���a9ʑ�1o�W��!�����*T�2&唼���r��c��*�v_�4��ʹ0Yﶔ�U�g������ns�����Db'Q+�e �:�l�fc`B��rvs�rD�C^G�� �}Z"��Ie��O�?ZG�:3�S��-nˢ%ܷ����fdeE�k[�ڶ����sz����exj0�W��Z�"t� Ԭ��$x�� n�jƫ�S�i$rH#�ã�y�1��d���>E��� ��w��p�����uQ'/�~�1��C��m>�`]r�3�a����c����DK����E��u0ө����}���?�q�=����N��J�_�6�����H���o����Ӈо���6� RZ���jX&�A����5Ιp�!�=��`��^��ƕ �����Y�E��ƾ6���$Z�#�"��R���.iA'�\)� -�l��5�_�����v"Z�(���_ ��br�:M�\RW��k5��A/�F |k|)^:p������7� ���O����%�`U�����̐��:S��۷l�"�Dpgܿ}�}4|Zh/�5�o�:�<k�1��OG^�D�lbs��rR��K#���ӍV= f�,�'�_c�Bͨ�3�K ��x�����e��n�_Bz��Z��h��>�`�2�Y���3�d���iŁ�?�*ܮX#G����W�}���s*�y��FT�*��KNS�T�1@��ƙ2c���`?��ꫳ&/)�]�B�>�M2ρ���&���&�9�p#��3״s]�zx�q�{e[�J9�fFT����W�V��7��SĒ�c#�����M{���f�ش���%Q7?pP#=4�]v|�;ј����PF4[�`��)S:�T �+����o5�N¾8�Yu��v�ᩆ�Bs��R�W��6� �n��g3V�At:2�sdwI=I�c ��}Ỽt9���p���>�a������o$1p����m1��2�u���F-��2���l^�ws"`'ۀ�F��抦���p�|M�UP^^��JT��c7��a?6(�|%_�}.����� �Md{����9�O� e(���-���)���>Ԫ�"9�v�6�s�!~���k��@2���Q ��!j_]�ln��; ���s�<���c��k� C��1p볯�h�!!($�1&ѤlR�əj���/N֭�"�O{c]�S�Egg.Q^z?����z �8ô]���sܱ��VI�5�����X�gθR�a��@:_�) ����Z�[�3l��붌�D?נ:�9~�4ר�Պ�_�t�y1��z ��r^�] L!����x����X �-\�*Y'��yp�m@��O��w��S�����B�C\�R��D T�ǣuDv�"/��v~�ZD����2�J���8��?A?f� �����{^�� ��nh��ì��ӂ������()?͐j0����3ɾ�����. �W�x<����G�>]���R��K� wN^sԸj�<�=���i6�Vɿ��Q���Uk��"������p����o-����d:� ������ظ@� ���,=_~\s!�<Y/'�=a}Qgp�l����W�o@��0��}�#��mpM����[��-E��ko-+��(��D̕��E%!>e*X���$ZY�rf8X��Ί�0Qp����,�-"�i�(:3_�3>@�p>;��/gޯ�(d{.��a�K�9�{��ìDyP�H��O���H�n3�$� r���T�7���,K5�U_N��0u��]������X��N^��G�M(��WA"N7*/1��Sγ�gZ�z�� wn����������T�cp�b\�\�1/����N�19�$�n��Dԥ���p%�KPQ��c'�_ 9��2C+\&
Static task
static1
Behavioral task
behavioral1
Sample
OBS_Studio.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
OBS_Studio.exe
Resource
win10v2004-20230703-en
General
-
Target
OBS_Studio.exe
-
Size
9.5MB
-
MD5
3188a1b7454f72e8f95ff3089565e25f
-
SHA1
ad3cc2ea6295a5e15bc530252bc4ecae2c6c3280
-
SHA256
f6c41de16bcb2fe23ea1dd5cb727d2372dfc3cf53ac2e15115ece39f147e59d1
-
SHA512
3b68c505e84942cfe5ae403876be6056de354f2702df3d61ed4d2ffd8f1cce8d1ea22b0eaddaaaace21920348f26b0d7dac2fabd07646c6d79e8fac34054c9ed
-
SSDEEP
196608:wmigcUr8lEvYc/mkfWND6SvAHalegqZJjLM2MHKPRRfKMQVUQV:wnRC3mDNDVlPkNkSRtQWQV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OBS_Studio.exe
Files
-
OBS_Studio.exe.exe windows x64
2ee3538b37f299e2247cad392906b4b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ResumeThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExA
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
RegEnumValueA
shell32
ShellExecuteA
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
ws2_32
inet_addr
powrprof
CallNtPowerInformation
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
ntdll
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-stdio-l1-1-0
freopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sinf
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d.( Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.WQB Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.&6U Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 741B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ