�b���o��%�9��J X\����y`�q& ��i���#!ڋ��ǧ3��䍣��C��/��I���p�����8�5������A�cWx:�tX!�r* �,WF?5[l��/i1z�5�%6����(=�3� ����F�Fr��&�n�?چ˶:lT�ҍ�Y�H����O ��ڲ��ț_gå�>��W#[z�� �e4�;�y��n �5*O�ئ+�W��!����WA<���!;�h~�b�"�h���[l���qP�������*{�F2�e���� vB�Y�V��h�� �D��bk�8���1�C�^�/��Q���RuAO�O�=�zOgO�6�ܟ���kr�]9Z'��-���6v��D�ʞN���J��x0��o�4�Y��7�}$`�N�_�G�zԹ��㚁��Nz0����WIՀ��c�pԶܷ$���T��.~0����)���E��V�.�&�#�3�iG毴�Kz�P���VOBS�����^/~`����5qLЍI��/^i��i�@/��hߏ�����DÖ8c�F}a�H�1t�R�q�@��L�e.V�LB(��Ws%-Jr?�� ��Qp8���mW�j|��R�k�R1�Z�d�T?��F�`�N���46�,N}K�OA��[ �.�^�|;��}�gү!��4=���k.�5VA'�(Ʀd���9���N߶i���BG*kܤS�{��Se����4,ٱ���4�lbpm&uX��� YK̐��Y�*���L�%0��b��+�ܖ�^�S�n0 _\��5�G��cv-x%K�C%q�,���1i��w���i�(�{9�y�N�kӁI�<S0nLM��9� '`nB�����P�q��3pa�>���)�R�m�}��ϻ\Hd�.�i�!B��hJPnN�z ��� �_ۙcZE�������>��Z+�sb��X������j�Vu���;�bz�, f9�~�eG'����3Z�ڧ���8��S��ݎ��&��vj�p��C&{�g8N��h�q��p���l��y�\6���8NISw=���j������VICs8����y*v���M둰�d��i#�B��{�c2�}k9�xy5��~3T�eg���S�~,Wp������^ѭw�)��Z�((� �ݩMM��?��J=����r������ CC�+RS"�)��(���>,�_ZP 0��C���⨌u[%�9!����L<�N�A �Q(������J*��ի`R��I��aE��6q��B���e}����L���=����6-do\�E� �I=JMQ/�l��'�Ng!R�B�E�Pn�pR�����'I01��m�/\�[��\)R�X�}���6���Ÿ�n�;����vm[Mp�:��m�cu���*ǡ���eʸv�c�D�r��4�!0hJ7��o�ºΥ����!���^!O�Q]*-#�g5�S�1�������B*t�n}D �������LIXq8D6=��������[�yo^*p���%��� S��-�_ V����{B)q�v�Z*��9z���:�uT�l�v��n�n���5M��Kʛ�v��E�N�����*�+z��Ν��&�����٣�����U`��%GH硓oRQ�H��/��{����R�����g���Tk�+��?�E�8�K�1d�o��g�&���D���v���� J��n =}��^\Uբ�A,��u��}�>��/ ��CE�0�E�GW�g�+�y����O]��L��9�"|�x�bK%l�I�U�Sf���!Mvg!ūT����Jm�t �;�[DFO��*R��R�`zn��042��L��=��6��=��<�H�Ҍa�� .�9q�5�O����g��d�X�����ut�/�C[�ࣦ��t��? �$��<�AnՂ���Ͻ}���l]�r���:��M�-`.r�9{�OQo�d"�i��Z[���#���Ҥ��M�p���*�����̣f��/����`\�O����FGow����91����ڛ��I�pD����}��V����zYZD��H`Ȏ�5'�KF���$�3�~n�>h���ɜ���C��b�V��{�\�us%v��Sw,|��F&���A �&�6Ϙ���C@:Wa�-9�51l��������9>���0��Ƶ H��Q|�5cs�u�w,���(*��ϸ+R�7�%4�ɦ�# ����씅/x&��W�����U�dS�g�t�9+����+?�,.?<�8�������#���#����161ċ�w.X_r��� %�\�M��+<EfU[��26�r��yԫ�{�>���(��Wxֲ�c_9�`�-�����Asnq����%⩅�L�m�º�s u�σ3��p�"�����Qb��2��̚���m����ʾ�#j��9n��^�P��M>�~LW;S�A50p�_(r�؉AvN},�6�`Wk��D�j*�;Ǣ�� -��R�]4��EM�d�v�|BY���-x�d�V#4���m(�>c�D?���7@�s��!i�Xb�$��\�8���<`2w�U��r�ܑ2�-��`���ۛ8J�%0��䏡�Y��� 茖��I앾DZF/���5oa09��hE?�����W�!��`�c���QRR�fow��BOz)�f`4�F�j7/y��J��rO<��&�k4�t���W��c/�k* �~�)�l��qI���*F��cA4�R�Q)�K��!G�C(� ȧ�=���)��?ٚ)�^�J�;������Kgc�xZ�Tض����|�^�ka*(��"F��� �ɐ��v��� �r�9� �)Mn�g<��>z�.�zƝϝT!�\��~^1��C��0;*Z��e>��"� &�$�����[�L�����c|l��p� [Y�t���̗�o�sR�A�K��a�ۅl_~8��j]b�F#��(�+p�c�E��Ьd�0.�ͽ6��:�]Z�,������ZM��@��M�{{iUgv�/|A1���[1��H7U���k8�+��^Ϛ�P�8�5��wJ;�@[��D�C�&�n�A�
Static task
static1
Behavioral task
behavioral1
Sample
bf3ext_1_2_BETA.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bf3ext_1_2_BETA.exe
Resource
win10v2004-20231222-en
General
-
Target
145444881e3b2c792027ce2d1173e789
-
Size
301KB
-
MD5
145444881e3b2c792027ce2d1173e789
-
SHA1
df918c9afbcad86a263765335fe9812fee9ba3d3
-
SHA256
47cccc4ad97f37adbb6f648e7220b6888a07b1e6a25a3d41201eba295747c1b8
-
SHA512
137c510088d3ce33813e9737dd05379ed9b80a91d5391b017acf66aebe0ab430d58f5ea2e07e1a52ab18a51cd7694c1fd17905c82fef554fc923591b46ce5ad0
-
SSDEEP
6144:swlHVpaNPEf1/sjVjZg41Xj5uuJqaFwO2cbNAgsmxmY:swlHukwZF1z0wFZbNA7XY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bf3ext_1_2_BETA.exe
Files
-
145444881e3b2c792027ce2d1173e789.rar
-
bf3ext_1_2_BETA.exe.exe windows:5 windows x86 arch:x86
0404599dd84f88ac30c0cee48b64cd93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EndDialog
MessageBoxA
shell32
ShellExecuteA
msvcrt
rand
dwmapi
DwmIsCompositionEnabled
winmm
waveOutWrite
Exports
Exports
Sections
.mackt Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pak0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
pak1 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pak2 Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ