*kT�y��r�"+ĭ�{�Q}�K�=��4f��ӧ_p�ԝ��������}ժ 1{\��{Wr�m�ݦqG�R����q���_�l`��آ�m��t�h�����埂�����0����F��.'�r(R����W�����f�}���awYGv#�ըS$ǴӶ����(o]P�0��"������Ak��S.�$���h�/��2/\��{�x`���ӱR��k�9���[��z����~���O�A}�z�b%���F�*���+��C~�B����8<ɮ����X{I�D�������j�����f�kN i%��y�i����`#�=gp0Kj�X���b����1J��GU����彩"n�SVF��nȟ@�.Y��\���e� �р~]�Z+�b�� O���qyY�'��.�Hfô�����]/�� �G�q6���:�d|}��W��7�d���*/��5���]�"�s�j����ަJ���E<��=ճ5W]:z� A��K�h:0l����*HWf2$C.��5�DV� P�:3 �Q�"��r�l�I����p�7�{; ��[ ypa,E�T2��V��(�)}��OX��p2!�8�8�QM�ֳ���u}y��Y�����`�Y�U�0x@ ��SI ��G?c����J��0=�$�1ɖ�����^�4i磫�J ,�blH�<�h&�� �ca5�����W�S�Nl3�=��(W�/�B�bd���j�f¯��������y��-89��OZ\߾k=�1#4a8EZd���iy���2�@���ӽn��v�D)��MG�dXq�꿪�Om����H,|�m�N�5#YҀ��h<�gn���ԽQ7�.�B�a�JNׁ�j]�&0b1n����un����.�"�oŨµ�Gv���<�5��ń$���_%V��F����@=�97m���f����Vj�1����A��ək8)�x̲�c����;>:"݀F���2���4�y�6[��v_y�,�b"�57).�I�' �� �Q�4#-ucp㰚͆?�q��9rq���j�����T;���B��F��s��ar��"����������s��Z����� 'R��m��vP�_ �����J�Vڧ'�S-�+�������}Ƴ���ٳw����V �I̹Bn5�0v2' �ȨȈB���!�i�/�(�����H�r&��\��F���F�L�x'�*]��i������j��}a�#wJ �]��.%fWC�2|f�V4�f>!:�gw]�������� ����SR�6�Bs�~�F��G ���̜�ƶ�72���s'g�1��?�!�m_�$�d��mF�Yo���� (��!����~�a�<�a��<�D�<���3f~�š,�}�=9?T������lwF|�K����!� n��N0t�*It�JyDx��'1A�ݺ�-d����� D/_<�yʍa�����݊z�>�^䱢(��y���mn���)�INx��u�M�O��E�>u��G5�"��of(ZW��\W��t�}Î��q�|m����0��&��˼T�Kµ�����7H@ݠ�z��?������:�y���k��9�h1�սȥ����E�\DڠX`�����xC�v�5�B�|<1��p��D/K�C�ռ������@��#KL3z<��z�^-y���e9�N9��C�пuZ?��J���!>EJ��r4�5�����2|3�HX�혒���"L��/��qD��^�8�N �um�g����HF+�j�~�٧�]�bNv�V ���|�#��7�i�9�+u%���+i�'u�1�/R������⇕w��Y���JX��ĥ�3�Q[��V0�Stf4��'cl��8E�.��g�Ш5XE-�RT���ĭ��f�d���E}7ї���]T����L^vڦ#e���!:i^�Qz�ʄI��w���/�LRT'��#���s�:���5����Lj�q��\>��.Q %����m�;���B Rs�|��d� mI�O���n��MI�k�� �qS*�;,�e�O�[��q:��0�q����@�*Z5�z������-�q���'ZqM�������=��� ��il�fTU�\T��v�zP����a���xVNB^I�S�ވ��]�YC@����U�D��$A����|��t������W�-��J���P� �^R��&/`��.�t`��rw�& �b���;�y�kI��0�MSAS��0���Q덝h;��a;w�<:ԟ�uT/û���ݓ����!�<��3pɻ���j>�+�L����?�f���#z�`om��f63(���G�#B�p�!62���-*_"D8<}Z 1�v����M�F|��������,�\���@��aG��jΘ!��i�R�X,Z�C/���:i�^F���$��� I�n��N��y�,e��r}��_�:�"�s�J�R&�Kp����e`��~��ֺ���>zR�ٻ����+x�g-FZޱ���=R �]�{ i\t����G�R~[2������{}��G�^?%E�܊���J��Y�+��:�Q_���݈ɷ&[����ɴ"���y~�hu�^2l�-��]�ڛқ�HV�[�v,����K�A �(F%Z��;g.V~��{z�>)��/���p����3��5d=�֝�z0ǃ�W/��Q�- F�)�E��!�da�b��Ӷ~ZK��+_V@��y�h��3Q���gHb��P�>��4�����G����dk'�ꨢ;Ȗ���{½�?6�jgЅ������D�WȆ�,���n�A��� Z�^ �����X!���˜[C�V�Q��~d�H7 $C衠�����~S�\����n�����O*�Z����q��7"�,�2��$���>�ꎠѬ2v(�c{�xoS�H&�H��zu��Ǵ�g3�4y2+�DҮ�r>9���=:y�,ɢ�$���90j��@�,�dw"�viI���L"m���v��p�ϑb�3<���4S'3���y�?hֱO�D��4�0�3��s�`�PTq�EoRU�;�����U�&�
Static task
static1
Behavioral task
behavioral1
Sample
pr0xit_beender_crack.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
pr0xit_beender_crack.exe
Resource
win10v2004-20231023-en
General
-
Target
pr0xit_beender_crack.exe
-
Size
13.6MB
-
MD5
947f4c1574c741a056001ff45a931d2d
-
SHA1
81a778cd4a6362aa791e1e447d8fa6972509a732
-
SHA256
bd8bb0a6a24eb52fb0461a2c096a49630a11a33f671c4eedf752c795c6f53491
-
SHA512
fa590756c93badc13cc9d4090ba35d2b4715fe0eba86dd1d6c567d2003e301a03021eae8e8ea0e83e4c2f4be64e2f3691b7e58a859ec673eb21807b3943cf628
-
SSDEEP
196608:UXdor1cZgmC0zqfYirapz5NC0PXi+nx9/G5YUi8eGa5bCwsnzDf0bVDg4xXntl:sdYmYfdf0N+5YnN5bHcIV845nz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pr0xit_beender_crack.exe
Files
-
pr0xit_beender_crack.exe.exe windows:5 windows x64 arch:x64
4114ceb393e5bd19f17d5099af394a77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
SHFileOperationW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 63KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.f67 Size: - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.. I Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qV' Size: 13.5MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ