x�=�^�W��6,��22��mUKcM�����V�p$S5 Dc]�-�����1�ڌ��5%���䦹֟�,��②�����D���"�ʹ���� -o;�/W����+q9���ʇtk�Qk�,� �?�$]�r+8�*�%-$�=`�D�J`�b4`�Q33����Y�x2�b .�[㋭4d-#9L_9$?�l/H��S0�����V��Ȫ ������� �\�f���J5�f�ߪ�ԩ����X�v�\�6R��A��b����wa�-��:��|a�n� ·?8f�|�@�P�U<ݭ3����c�P�f�B��<��`���˸�VQ���p�:=��́�%�4gpbv��;�xP R����e���q4��N�hU�Z�$��R�T�fv6н��<q@F߾J��������'�����$��z4"���;�+&>�f�`m�#���g>)��ڎ�aQ��J&�ܛZ �6+鹺q�#��/���݂�<��c?%Xf�����ՍrA4_�2���Z���l��IA{ �?���L�I�QQ�����C�d#.����=$z��\�wB���;�ZS &ni��gh�3�2uu���� 7�*�wǙr��Mu��/��j�����V�8O���o']����������'��Nh;�Rg�1*�~�*��.�C�y=ϥP ������{���@(�Bv�!c�{���6NҟC&������fP*Y9��uV���W��K�5kWt�z�,.�n�D͕ �ܴr 1�8ݜ?�#�f2+��4o� C�<������(�/W����=p�A�f���r픅��f���Q������2��ά�8|֬�dۆa��Z�*����ʲQ��m�Ǫ3�ڒ���iIU2�/��ĸ�:�������M��r�{���Q�)���O-1�zv�*��_x��f0�~D�)�_��L{��� N�n�����E*>(T���^s4�mW��M�9(`S��P/��I2c������䫖�ڄ�e��c�'FI&�&���Q+�d<�s��q33 �gw+&Q����;��8W�D�`k��Ѷ��7� �NŅ��ݯ���� Go��N�b�>�Y%ǣ����ʱ�f���6�^��/UTZq�92��������6�h�����/*\��̉��ڎn���*+�Z�kK��������7���i>#�-aD��1��Ȋ�� <�5j��J��~2���x��ҝZ}K�j�8L!��gVH��=�::ىW����᠀�s�� �W�Kb���=����G��f^:�cƪł/��b ��1m����O��{}��i���B�IO/Ӯa!����j�&������!�s&!b�g$��jY?�d4��h��V�r���>��$�\�q�m};cI����r�3w|$�� ��O���mʫ��r��O������VzG��Q�_��3Fw��H���9��zכ�cTq�����\��\϶�Ȱ[��D��#��{Ү�V�`0I@��eD��2TK��zu�Y����� �[,�:p�,�+l���RCBc�c_EL�4Z�W%�y��i�g8מ���m'�#E>�i��6 �m�R:�T.&��/��̀��Td�ȗ�]����Pi�&�c00t@%��%�ޑbbѥ(� v���~F�G]2�M�Z�<gW4���Y7y3��W(��Ŕ"�Ϙ �J#>�j�(�nq��u���0��\���Ѩ�;�ٙbV�12_m�w��� ��s�!����Â��zd�H?3f��b9����@)�/:��U��-��i���0����d�P���ܭ��{�:hoi�=�B�$��rg����j�l�L���M2���Q%�z�����<y�u�#� �`SJ~=â<�O��T��I��k��F�Z�^���#\�8~"�������f3NE�+0���ˬǂ�� }�<w�aC�E��n`�� g{�~�ްj-^:uRq��4*�َZ�v��G��!�`�eZfԋ�;��yǼJ�'���+�rD�TF�?%�OJJL���.d�_$����3h�q3�~ЬM���r_\&��U � �@��8���f�߮�$ 1 �<~Ya\Z��!�/aHmE�����O�2}�N�{�0��:iE��+�~����U\Br*VS��J-!}G~O��tA�WΣr�mm�'�eq1���vO��+!� ����Օ���%��O_��{[��3h%'�h�Ld�ڵ���T�4�N�1=� ��%_�N-aN��m��-���q��V��uz��M*l�"3"B���ݬ�;<�����U���+4G5�`��Q%�g6y�Vm�6��Ш)��"����e�n�4�Dh�������Yq9ߦ�w��2�D~ǭ�Ç���x�2L����$�\O"9�]�r�����V��W�c�|��4�T������^w�W`< }���z%#��z��%XΒ�9�ܱ�X��Ou�T�i�(�9A��եF�r5�o�=�̄5��PpWVi��W/ �;����"����{3A�8^!>��Kp��0>�B��@� [��,N�Р6]�������j}t���~�,4d�~Cjk��KIl�)�.�y�ԉ�}#W�uwzF�~�.Y) ��XR㻗v�Hg�H�_� n�l����-�r~���������ِ|9�t!����%CP�d�-"��4{d��YMb�j<D�Q�X�xwR�C&�f��JZ2H" ��\:d����>���"���0J��,�1�����G����8������]�����&��r��#�]�w)pt�� �3d��̈́�*�&�1�Ζ5�k�^�p��%Z9lǃ�#'��c� m�����������M���OZъ�u�MH��2;���G��R�o�?��s��KU��E� X�o�/�m ��8����ڼ�w��7�Vro�/*տ�Wט$��TdD�;����e�qo�uj�ޢ1� ��O����e���_[��#���s���QP|s_K��ԨpH� K==m���;<'M>6i�].Tި��� ��c��}�|��~ȵ��' ̉$^�{F0@��о�0a���"��ԒT��Y�Z�*Ѐ(k'��
Behavioral task
behavioral1
Sample
Winner.pw/Winner_Free.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Winner.pw/Winner_Free.exe
Resource
win10v2004-20231215-en
General
-
Target
e39a32b10147bcca1a108345ca4b07a5
-
Size
5.4MB
-
MD5
e39a32b10147bcca1a108345ca4b07a5
-
SHA1
6ed6730bbd1384e427c667f128018a4f3056955c
-
SHA256
fbf28d6d474a48ec5a3595fba7d3222b7c2a4bcb0afa428da930588e469a5706
-
SHA512
3bf677536719b02a8280336db943cbe774029654888e4413842d70666f3f8bc9f74e851c2b4d409eca52e4ceb1695064f6b73091b5e9ad4a2c83ec98779d0cf3
-
SSDEEP
98304:vO9x3LHbDNCmkhJH5YVmS6oSt26aajb4OB+CqMbrfMfLvEKJUbt4:W9xbH3gJZYVt6vt26a446+CqMbrfMfL/
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Winner.pw/Winner_Free.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Winner.pw/Winner_Free.exe
Files
-
e39a32b10147bcca1a108345ca4b07a5.rar
-
Winner.pw/Winner_Free.exe.exe windows:6 windows x86 arch:x86
8ab28f7c16d514d5964a418821bf3fc4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
winhttp
WinHttpQueryDataAvailable
urlmon
URLOpenBlockingStreamA
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Winner.pw/cfg/Legit+WH.winner_free
-
Winner.pw/cfg/Legit.winner_free
-
Winner.pw/cfg/SemiRage.winner_free