i8��~p@�:oԱ���?t���зj��1�E[%xP�2f��9 pk�JDŽA�>��s��ھSn/T�"�!<U6�q�*�ǐ�I�Ǫ!�E�Qc�/V^)��Z�>.�f����5��ў�Q���T�c ��9Th�����)}-� ����] l(@,`�x���N�J��BՏI.sž�t2�L}w��Xm��y��V����Ft�5HwUfس�D��09��>�WŌݢ����Q�!Jp"��@џpB�Dd�A��~Z[i�"=�y��m��i� ꉱ�Ig�nmb�ER�oZ����Y�$C��i˯M�+� ZSk���w> ��Vu���������<}�/���&e2��� �K�\�ϫI�>����w}*+~�z[��[)W��k:(\2?�<�� X�'A�tv�_��C����)#��IQ��Uo/��`��u �N��r�W�g&�$jv�,�ܬ�Ng�?:���D4��j�����@Ƅ�Yh���5���I&&;�����Qt��N%h��ߌ9��+��nW�ZF�@����V�7֡��b��:;�>��;4����F�œNI&��}l�U4&rI �H�g��X�� ��a��z=Ux���\�v���Z��\UQ͟6=������<��V����0x�aƇ������,�,8@/e�ɻ���զ/ ���iվp�3E�%πi��]�8��is��А�>������&4�|c !�!��cM��+=�z��%����B]a��g��AIH&�6�2;���PƩ�kDF^�������9�|LG]��YȄ�RC`�TQ���9ݫ�&�5ˑSR�O%{8����� ��4j4��%o��h�"sS�:퀼RDR�l>��A������S��Ev���{�S��ba���D����N�T$���K�|�~&Kic�C�HNY������.�䵶�%N�\��#��B���Y�g�(�-���5�ϫg�C��ʠ�b����I�1�� �����R/|@j�mo6^��\�w%�]�A3y���s�0��d�q7�۵3d�0P^ ��5䱘���u��h��1�b�����v^��EQ��k�k�>� �֙��ySp������3��וS�ӟ��(�G �V=t ��Nm2��a�f�X|���)+X�4���W�;�I���������̬<� \vi�������1�h8Q��q����_R��o�@b�_vl~D�xLP�밆\o�a��S��5�c�1�;<�6����Wr��# z>>��'?g#p��J�73fi<4,� �K�p|_� VQn�b�𪁏Q�oP_����4��f8�X0��gL�WL?|W�3<9����������L '-�@�x*Q�N�.2��� e�L���u�a�����"Eb��!t�(��+������ _kK����������H���:�[{�%LϦ�іu�d�-�2~�T!.���j]���n]V/�������K5� y>_��?]�9��"kpdC�ƿ���.���f����"KҾ�4������ T�����W��`��c<_���AX��m �� 2����t������� ͖�Jg=����, ���z�����^5T��3!���G�C�<�tj�y���b���ʜǘ���VZϊ�s:���s�2�B5�2�W��y���~�:1���tzJF�X{��{C8�1]?�Y�Aj���M@F����1�#(�5�wVuT"r8n��Z�4��J&���5�4S�|���V�D;Bz8�����n����<�����#�4a*��C'�;/���Q�$@��yr6���d?�ɑ-.�u����8�� *����[��?��_�[)��:UQ�#���S`���nV*U/7������G:��jO5���Jj�[�YE�D.�j8-U�*��e |_�ًI�Q� є��:���g^�gT�i�jԲ��4N3�U�M�\�h�H�] K�tg(��%�d_H�WYل�B����q��ZMk�2ֶRm��RƔ��(F�L�< �.���N'��o��x���Y,p��4J`Aӝ�"[����Jɷ��<�V^�%��dG`�o-z�a#�;o�k{1����b=Z/�)�W4Mg:��@���~ �@��#9Y;�)��$R%��E��!<m��Y�e�B��u��p'����:��t��g�!r��o���y�2�D�Kah& z�����r�� �����T��YȈ�\�>�_��[�L�� xH�Stʉ�9���.������+��i�_�����.en���#D�YW��~M�SNX&B�OMT�B�d��c���<�B���%QK/�ze�y=��*ZMH�ŏ5cW:����T�y����yqwT�-w����QdK�BT�[��u���$��>�<m(���iAF Ŝm!ń#A������wԺ�W�q�om��?^���.R������o�"\�_��g� Ed�J��f�cq\�<�bS���T�����1����|bB7[2�2�1B�!��t���P�%{�H��a;�x��oď���e��V�I����d:��[��)�{����q�'h10����z�T{8np�g���Y������7kD��l,���%�������5_w��i-N�ބ2��"�$�z�b�L�eR�px�1tj�������|!F,�beݭ�(��ݮ���*�t]D#���lw2��DM �+,�J��xF@��ˁu\}5sQ`�=o������b̊H �i�J�}o����&o�*I�QeR'��}GRh�&S��QFX� �%4t�8e뒞C#Z3�&�Q��X�p��P��N��Q,ld6��x�����]}���)�6���Y��9e�� �bPl�j�KR��}�;ڟ �"�uf�8E� M6s}Id|Q��bT��7\��XE�����3� \^��71�UM9�_6�O��iZ�(U�K^����T��������k:鏂0&f��[��"�����Tah ~r���W��..@��#�B|/c%���3#(�m�`EqT?9��4S2�z�%H�H|�s�ǂ#�c�~�W �'-�+3�r�~��������_Z�@�����$�L���P S��IIФuoeA��>���ڙ�m 0��Ŕ��2�V�tI�6��D�H�`�uO���r�Byr݁d]�����'-�:Ɉ�No���h��2gA�8�Y��0`?s��H����ٔ�����G���|b���̫���7����a��U$���1�~��ϱZ����;����̚���4��Bw]|$�hhhտ|��FCgCf$�HL�)���Y�)��7���Z[�Ph[�Q�.:"�Bx#f�������Wn̈́ �$�"�q��%S����&G�(d`�~]I�ш���\0_����!���Y��]�8o'}5D�+�����ȯ1-�e�4��&G�� P��~�8-��7r.�Ȱ)�V�ӕ���_�l]��9-�ɾ������������7�l)+�н@�*�4&�}$�ƍ;q���~��\����%��n�ZH��c/J�D��EY�fty<�s��(�@tؐT��$/=�m9E
Static task
static1
Behavioral task
behavioral1
Sample
VX_BOT.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
VX_BOT.exe
Resource
win10v2004-20231020-en
General
-
Target
VX_BOT.exe
-
Size
3.1MB
-
MD5
9e27cb40b90706353a05e19b384eaa49
-
SHA1
9f5dae9122be5bc7119c09b12e11a063c0b7ac97
-
SHA256
c1cd856251bcec6054cf1b927dc4f9cf98b1999fbd6084816ef9a5e15834ea76
-
SHA512
3d241a33d8cf8b80723cb3fe845f3dedd78ebffc0f827e91d57992a774a266c01db414c94965d428821d129fa05c3c3003adef302c0fc5917353094cc266a52d
-
SSDEEP
98304:6d3CKSzymbvaMDsY34Uwi38Qt41rk41Rsg:6odmm7lh4U738QKzW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VX_BOT.exe
Files
-
VX_BOT.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 208KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE