���6[�0WP.7v�1u���g�}�Qm���c�%O0ҡ1��`7<:��J����3�,A�B������ �ʰ���G��U�"�LE�}U}Ϯ��a��l5�u�s\ ��k�x>���%a��D���\S"���^�@�3ӼL� 3@�p�ūW��M� ����G Ul�/c5g�I�=eE2Bc�j(��c����U��[�g/�L�g���|��`��<+MU�rf�E�͠殹.5�9���a:M�����x%:UC�am����F���o/��:;#K%?�x� O����9�"�2w�U���L0eH��Ό?�p��mz�K9/#x!:º37��̃J�����ۿ�Ռa�y�6�������!a��J�cS3����K��������Q�GJ!h������r�sE��P��}\o�B�l���J�U��"�i�oBr������� �m&�� �`����'+�ʮ�~+��q�n�v��X���h�h[��A�3!�y����Y�'�w�W� �nv�Pd�Tv8zKF-WTOV��u�e$����8�l��f �P��=NV����r?L�'Q6�AԵA��/�����VeS�d&JL<9���y�B�Sd16j��)��))�lH(v�`��a"�"TJ�|i��b�Kb�(|�k������{j�]�N C�T�Œ%bg�](L_&��!�a�Q�>���j �A�E�O�3�ٽ��ϣB���+��4��{���;*�~Wk��i4�`�Ǒ�FP�!j=��x��jHb;��Lؖ��0�n��՝���9r<�;� hQ�x�����@�\��O�p�{3�*�Z�30���҃"��:gR�U��ٹ�� v^��(x#Z�a��]����5��j��ǬǰS�̌��b��&������O�c�c Ƶ|o����Q/�?�����BB�LU(�_�&��������,80��!̀TmJ�t0�����b�h���(����91i]�.4�[��EE���Q��� �:�=���h���J��nA0�[~�n�s�ᝢη�L���ym�h���i���$nG��X�5i���V�fB�4�Ju^'H�j1HA����Np �#���?Ada��ں<ff���tZ��g�+Ρ� ��xM�"���Ն�R���N�%��L�Re�R\@���7TC�JV�������B_�/Qz��s���2Ju �ʌCm����b�Z��aUr�u���w������{����VV�fc� �I�!�Gg00Q�s�=���k�RsՌN���g��+\�Y���G�!���Աn/��#���\��60�ЄW�Y����Ϗ���M�pr�l�wէ�.���Nӄ�Z��Y2a3��Z������ky#O�+}�n�� ��3:yU�Ы4�ܹj�ݢI�U����W�� o/"�lC�����G��s�K�7�D08EԸ���%�w�m���ns�">�?.�K�ǐMߙW�Ҋt��~K�T��:��bD�4u�6`O��\�/���!�� F\�a�7�??�L���|�]���1(�����m��?�;�F�����h�N*�������K�E���P��@]ȍ��<�Kp����l7��ܤ`��nB��7kΗL�зW���k��>��L����ʠ��q�c3U����8��ԕ%�!���`Y 2����Ei�?�$`Vy.z�m� �d C���D�==?]m1*G��CF�9�Y��U����(�>ub��`�d[oSq�i���N� 'P�E�(�d ���יHtT.���c���g�� ���U�H�/����m3�Ɗ��MȺuF��*�͖�]XA� 'f�;f(�9m���M(O8k�}OF�3�B8K|~v$����D���������.���f�Q��bݔ��l�bQW>�}���_��Uv�@V�=���o0��[��rʹ��6���!�����= @z����|�T[&�P�ԿI� 0�����{������mcǸ�/��<'O���{������c�5K�W�c8<|�� ����{�T/�ޫ$JF�������+{l[R�e8��L�W#u��j��җ�qe��Gu��)�ff2��Q(�p1Eo �χ����T������Vvt"�ri�)O����(=X�4!ck2�L)�b�j����U���dt�stX�Tn��f�8i�M3�Bl��C�Iv�<m�a����JE84��'���Ϊo8sH��eTD �̼��-�n=W�W����u�;5��ݲ�/�|r\�\�W@MHL�%����2�TD�Qt ^����B���cKV��>�q4g��/���@�Ӭ;�l���Ba9���,(�Ej`�lj���i�cTHr Mװv=4�Ӯr����bB��sD鮌�X�ؔ/ �% ���e�=L��y-�Sh�/�������+�3_;<"b�)-\+��,�2Plpc���t�� s6Pѧ�`HW�V��eJ#��� @#��\Hإ�R�m������ЂZH5y�QM�eyZ��`n��%G�@(�� �Ξ/�p�X�.5��!<JO���P���H�\j���r6���ޓ��i�y"�u���yvw���k,|,oR��Y I�`�U�r�#����U�J���f�ܓ���2<bzI��+۟�6'���N�����X�]+*\�Ѹ���.���,���HO��#��г�R�~vǓr��y��{7!��r=(�#i:M�#j����,�%QET�͌Ijz��x#tP���vq�Z���Gu��T��Gy������*>����`nm�5��뽘(D_������[�le���<��F��H+K �y�}1��~\�(L�W)�8�h��m���-�JRQ}�����a��C��|�\է~տfm<��+��$�)��'�ca�Gg�l�H���`��������BxlӁp�5#����ݷ(\a�=�B�[�����o�;7$�2'���%[�G��N��w�� �4w0+�y�7��ߐ�s�}��Ę��3���M7IA, 99��6j\���_`�^� �[��W��N����>� ��;���ɇ��������QF�3J�˅�WV��d���ŀȿ��r
Static task
static1
Behavioral task
behavioral1
Sample
1v1Skins.exe
Resource
win10v2004-20230915-en
General
-
Target
1v1Skins.exe
-
Size
12.4MB
-
MD5
c2b3a16cac1b7ee8c5b2f120177f5a36
-
SHA1
394d4ca73be4dfcd414bea928b1c784234b446b7
-
SHA256
d3c43c8e40e102a18e24f82d6e73548c1f6ad963cb3c541b4f30a7d22d9ded71
-
SHA512
783b1238ccf0dbac5f2f4699aaefbaaa6002cd1f76262a57ff4141d76fb346078d518dd47440f9f9a6a14be983b8c40eb4bb2b7ad641d1e60bb92bbcf2cb2dd9
-
SSDEEP
393216:ZpE3WFI9jxRey/2mLEQpIshf0yetGxFo4:ZpjFI9tIyuMEahffF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1v1Skins.exe
Files
-
1v1Skins.exe.exe windows:6 windows x64
1d7759bd7f93fdb7e969a67e6f8ad776
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalLock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
shell32
ShellExecuteW
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
imm32
ImmSetCompositionWindow
ntdll
RtlCaptureContext
urlmon
URLDownloadToFileA
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hj0 Size: - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hj1 Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ