��:��*gA���Z#�(B V]�OՀ�������S�qQ�pq��--���]��Zδ�˓�}6����w��P�^�t5H���ߜS��(�X+ۖ�N�]�u��l��[�/��;n/�H���f!"���;��x2��An£Ol���w�^Jm�=�/!����Z\�*}�I����WÔH��yIBi��#qՑ˚*�J����� a�'H�v��H����x���=��8QG���h&����%��,a�G��b5����?5~~�C�� �/e�R �q��������h,�n�7z�d��L�%gkj���r6��NY �H���t]�s�,U�����x�s0��V�7J6n����ڍ6� ���N/���L��>^�[c����5�$���p��� 5#IS����[�����im(d�F�Sc=�������2^�� �(pH� �/�w�Oe�6�j�6Yp4e\�E�-�L��8ǹ��CV��e�/P?��c�x�{u�Kvz;�$0~�H@���U�T�:2��2{��g_9G�}َ�&�@���AX�;g�&h��PF8�o<o��<3_Y&������_��A�����\�R|I)���ng��L�j%�&��Lт;�.ւ*��FX�V�s�+ޭ-L�&��wf�xRr{��J�f� �ѝ۽�QUd�����d+������]�l,��~���7��1����� ��(f�6*��`'�5�����:����i[��@\w�h:2U�H��ƷK�=H��# ��� gus�x�-��rK۶���hA�����E���*``ɕ%=v���$��Q��d���@c�3er���x��!$�Av)�C'9s?�q]v|R���-�!z�M��>�縳zE�!��A�W��4Ü�Y�ft�r���(�'g�.Ģ;���F����#F���`ӢuV-o}:��w6_�J�x_�#�.|�е��G��0�ͮ�N���T!��c��{�:nF�a�ʔ86C��}�m����Y���.��C�~�|T3��0ݷ�d��~9Sre"Y� �uW7 e7Xb��`��V�cG�Kz�7��I{�Ĥ���A>�c�$s�<��f�h�4��sb �'�ε(n@iQ&�*fG��T|Ɖ�)��^Xz@�(�w]`5����QʸGP5{��@��S�!~>����q����XZ�*"J���證O$�*_���?7}�A�B�d���Oȣ���q;�F$k}�v`���z�et�f��� yufe�IG53����ZG5VP6���}��>���)�Pb��.��[���Y(�H���掃?l�Y��(C94[֏�I0� �@�n(u;Js�^��si��C@@�7��ES3(��Zw;F�Ŋa]Ma������I���0�p%�s�lknSӞ��/�(��'O��8��'؏�Q�åQ��W�Rg����~�73*U��!�iNf�'e�;E"�K�h�IP�6OD�5zX�>_�r�U�8��t�*� � �O���έ`�[���/��@��ltyQ�˺:`��=�Cr��m*-��1�umUE��Y�(�4�mKC/��)���?����pw$9�9t��ʊ�vN �l4漟��d��-�<�&�`�?k���nSb���f�����w`��:j>�iD�=wj�!l� /��Q�l�[���O��3��5����L�T�A̞�u^��U���6S&�˚�e���[�!!�����7A�Ts]�K�ȫ3�*�'�1��ߏH���&��?��&b�2?�� �ٌ1��2,�'L#实�P.��Y^��������-:7���A��Ғ.1�»_���®_?��b�;t֧�� ¡���"�}�C���XK��J6u��0��&a"��;��r&�蕶˧c��� g���?�#q�^��N=�3$nm��=L����:��R��t��@��:����OE@KWx�jp��ڊw�c���A2��n��,��M���A��>ZG�%�e0\;0�/cqKeH���Ѳ�R�^��|\.��p}������im�d�G"��V���4Š�Ckߤ���1�z�K}|�B�a� ������4w��_�tϘ��7�\&`f�ŬCRV�@��G�r!.�1H��XH��_�*����x��ڃ�EI����M�F�H�X"�h>�/�D{�I���?����O@h1+��,�$�w�eM�k>A�dI>��m�\l?������r�3 ��'CY��+��%!%���S��"��B+�g�<�/Kf:��� ϡ��o5^W��N�x��6�"#�}�o��!E�DB���� %��LX��i�{,�譤�U �V"�.�����-t�|���7��.p�����\v��������%��O߈�T]S��� {D,yWC0IA�ު.)��v�9t��p�0_���͒��2ftF�`����9h�ߩ/�Ijlj��C/��[4BQ��P?}�+��J���7�n����HW4NMeX�4�'��]�x ��)!��Zw(�=�c��,��ROQO<.8���$��+�;���X���y�n����a��(E� ��}�dΆv1!�nM��y��d˿넃���*,�+)@�^�⃔�D+˘X�t���@�A���#�,�M���"N�C��b�<n��S��7�Q���1ڄ����P0Ӈ6��I X��O�(���V����Vhl<x:��G+�J\4�Y��Z8J��d٠ʾ��0�\ɋ�_����j�)�h ^L= ����W�&�d�����|݆2h�1���k�f���_��&+JS�ݱ��K��S���⮈�|K��!29� �F��M���!S�a�c���� y�%���� ��y¯��~�{+2�����+�羋�����8/�GKg�hi����S��� ����B\�&�.��S�9P� �0�����,�Vg����ZĎ��Z�r���W\k��AG^�N����i�J&/�xg�~w��K��������ߪ�CVH �������9��^�C�SԮU�|B! ����Z@z�oS�6����PE"_ղ��E���{�~ �ܾ� ����,ii�58���<٭L�
Static task
static1
Behavioral task
behavioral1
Sample
Innormal_Engine_V3.exe
Resource
win10v2004-20231023-en
General
-
Target
Innormal_Engine_V3.exe
-
Size
7.2MB
-
MD5
60621df8c405f855c26b5608f7c6c254
-
SHA1
6fcc91b36ed053ec8749f88a41b0681be7c3a17e
-
SHA256
3ae00bb7bb6ca401531e9dc8a7f61d3ab11ad46cd5b62cf9c1233e80c6dddf12
-
SHA512
a99fb423e82d3f1c78a54e5072b607c2b09bd24878309f4933e948d7fc5b541ff91752db543ac2cb1f468f4840725abe328127b2fc4ed55384403de1bac75ce8
-
SSDEEP
196608:cXc9otGpsaTv1G3E0xqMqGHoHwyMbZXyF:cMqtGy8v1G3cQvs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Innormal_Engine_V3.exe
Files
-
Innormal_Engine_V3.exe.exe windows:6 windows x64 arch:x64
d9952379e9cca35736a891ae9c4b8aed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
VerifyVersionInfoA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
CryptReleaseContext
ole32
CoInitialize
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtResumeProcess
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertGetCertificateChain
ws2_32
WSAIoctl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_stat64
Exports
Exports
Sections
EXIT-ON- Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EXIT-ON- Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EXIT-ON- Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ