��E��|�}yKd�n�Hw���+˘ ��Ċ��w�����˨a�9�����ȏ7��!;���7/�{=%������PhlN�|��;�s�[;������1=[M²��G�lT�aũ�=3M�o��_r�vL"U!�1|��?E�hu�ŋ���'i�K�! �~L�2|k���J8��� �ӵ}��� V��P܁w�st�%���S~���$��O��խ%Мy�ܵg��<��Fl���=��zalxJ��8�w�ѓ����Ї/��v�,Оf�q��Y�.���銍2nbX����ڻ~O%x0��3x6��Tm���=7\��2nPylR`Ng2���@��1��;�����d9~5��w<H�0v<��у��!���-�S9��ڈ|#u �a��b����&�8 ��Q�ؗa7 eI>f�wι_o���Lℙ�[����輱���2�Z B@�鞴}����H$@!C#�d����(�"Ӄn�Bl�1�����`祍P<7���`���[K{�{�o������/EH?����ؑԝ�^�L�;2�8�?�:�Ic<�Y)�`+>|�y&`�ճO�v�5�2Ӏ���]����/֯�٦�����%s=<���g[�����V�dM8�a��(�P٘�e �����$+�R�=M�b��=xg7͒ ��|L\E?wA��hQ��C!�HﰙbVXj�-�%�� f�:��ć��T�����uZ>)��Es"ኯ&}�e��t{���|���C :���o�����aR�^�b+��oQAo��zȝă���`���ꪭ ʣ��]}J�h >�� �R>f��i�y/�w�%�^TuǬ����0o��`{��1�|Z�g�5)�t�V�&Hv��`%/c�j=le�c�� ݗc��+���T��yK�\H{\e���V�PlX@x^����%�zqx$�_ z�t��v,��ɷ\���QwA�m�x��a=�� �/R>��۸�mT~,tj�ϖ��N�����J��0i���c��?is��<����c�/;j��Z�m���ˊ�&(�AX4C�U� �[��Y+�u�7��~M׳@�և��n���j�~�Q�Y�ާH];��lۏ�� �Fd��B��&�caM�{�o���F���'�ZO�+S��yB���G�l6��K��� M굢�*(�����}�"<�es�ԙ*��`�SIȵB��wph���Jh�r���H�b涢��}�4��}�Tϕ��b��]V�����E`T~�b<O�̗|~�6�����ؐ�}�9F1�:���w/#������ƈEW�y2���Z���}��!r��<��noQͼ�� �X�]��ꤽ�Nm��Ӄ�uJ���X��������!�o�&jt�qJ:2G�/�b�J����:^�v���ͩd�{�Y65dT���DN�)�7����ޟF1V��c���� 9B*C7�"Ø�,�I���4�����af��8�'6�s��.�uX������i�h$)��sI�V��!Q��_0[d�b��ȼw���B�+`$ �G��λ�Xi� ������ I6HDγ6T -;���A��:�oz�`�@�j�$���`(�}�~C��-/OT�4���e�?�v��_��I�\.�T��)��K�.��L;p�3����+ڌ5=��;����J�� ��e��4p���I%�b v{f�_�V�1�aR�[W�Dzcmon�� }�Ϸ%��c{S~���o�� ?-d���3�f��|� |C�7^��:� ��q,f\�3��a���dvr����$L���Ek�^���=�eF���T������I��(���sZ���"�f�(}H�[�T��v��6�$&>2�IT�{VL*���3�C�g%��<�U6���e ʨ�?r��8���P���S�X����v���Q�wF;��P�ٖ�Z����Gq��F&�3ѫt��[cD����#$�S��9f�[(p��%5���0��g�P�WL�z��>H��ִ����4�'���4��5�yԡ�%���fQ��9�����������rA��f�B�x��ɉ&�|�l��&+>��� �MZ�`�'y��#;��� {�Y<�L�b�d��N˴)�4��f���3T� �I>Rqܛ��j�, Oq�n�o-��~�F!��������3���p��t���?�8���\å����r ��Y�o���u��#a���dz�敛��Lg��1�����&X�����2�������e~W]� ς����5�B��� �b���ac(Q����g6�0)��Z�ԙ�C�a ��f��s:�:z�+��_�9a��R�ӽ���Dw��X]�"�Ė�0�J��۪rNj���t5��stW������e���s�*��VX��!���P���$�-�D�e����g��S�U���Iy���M;3�gw8?��S��(7#�v��n.O4�ֲ�ɷ��(�=A��7�º���26�OOc�=~�����rR�}� �6��kt̂��d�ą��5����;�ӌo��yT�^�}�ż�����4�X�A#��n|-�s[dd�B+Y�*C� �b��V��%�Z/�(�T�y��k��X�&J�.� ���F���vbҴ����v�*.�KxrT9@I�Z�l���z|��}��,��r!��)��ٮ����K�()��<���iѺ��KH��,dH�Mտ$��0�T�Ӌ���c݁IZ���C�+@U��7��l�'Ag.����wp�(P�twKu��j���6��e���C��T�lԽ2;ߥ"���dvG�16����ʐ�,��B�U��,%��$��'��'�o��z߉7=�q���ʊD�&��?A�к�*ďC�������S"�� � Xv'�Ʃ̷��$�����G����>�����6'�����Y�X-��x6d�g+���k��,?4��&��rnj d�9���Cr�[&�8��}��� D��Y��n�Xq8�7�����������vy���V���Z6�@?�Νyb^��D_&%�l��� ���iT�}�V��#�?�~=g������2�d���bX��f%�H���ۡ�
Behavioral task
behavioral1
Sample
Lexa-FREE.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Lexa-FREE.exe
Resource
win10v2004-20231020-en
General
-
Target
Lexa-FREE.exe
-
Size
5.5MB
-
MD5
3bbb6b2832c55328d0c74d30abbb4679
-
SHA1
441db4a1b474a588d6218979d24069b17f89f4e8
-
SHA256
b426a420e7a5e0ac1f0a6af83e8bd74af558d78480fd41275f5a2a5e3a52e33c
-
SHA512
8fbaced020bd4ecec4263ae47fa347fbccc1e3339013be2558cdca34b2c68dd74f72266d59009fc1372a2b63723622a76842960202bfd7bb44914b0a8dc27afa
-
SSDEEP
98304:D6s9zQvzx8LB3CS18S2I4f+33ffKa20ENMmV9sa8vJIbKpvy0fTb:R9cvzuRzlrnF20ENMcn8vJ6K/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Lexa-FREE.exe
Files
-
Lexa-FREE.exe.exe windows:6 windows x64 arch:x64
4ab6551150a4a0d40417a4ebf2ef9385
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
wininet
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ