+b<����aVM�O��2�����H��2�^�L��:V�!��<Y�W� l~3��������q��δ��U,�P��!��ԂfF��i��(�c@ .�$ʍ� %��bHZi� $�m��f탦�o���#������\6Fg��z|�&w�0)�8n=y�B+vl�[q#�M� 7�J��������Mcq}�. y�8�$2���8��ZD��H��\���}+� ����N7c�ֻm�*����L�A���G6Rw (��㒮T�Z��M����%H�<�|�kIa�̉V��ti4�?�۶CRK���F�� �*V�G�a-y7n�X�i�(�x��fܠ�R������ ��vje���w�:o�lK���� �nh!�� ;�3�c�2�w�ړW`������j�]c���[zFA.`z(����f�S��ܻ�2,�(v���[l��|�1QC�O{���� ���Z�?֮�r�;Ɋ53��݄c �3`���ē�I��&��R�j�Es�M^^f�u�:yQh7mw���,�w�~��k`�0��Om��t��m�×��u��ȠGPG�j��K���o&�'�KjJ�OJ2N5�d���`�����OX�j6�y�3�#�C���>r���������=ã�D�On��1�0�:���_+a�.�[$�7:������j��ηY8/%�Ŝy��]!�Ds~c����u�O��� �� �b�?y�6?�u�,��{����ie�v݇;���ϛ�Fd}��@k]IEr��¾� ����Q=�u�ɩ�3$H�å5�\}ʜ��� �oj�F)^4�E/�/���U^��������ė��D�PW��U"�1� �l��}�)P�Q�ȫ�|��މR���3Ӑ.����ߌY�c$�2�7�.&�K�s�D�8�Q��+lV�r�cp�Y!�Q��� �ۮ�Hp���v��WZف�?�S�pV����禟���[ �V4/y4� ��}���KDe�l��K�<V��q�����-�Ri���m@˹'��g?8~�߫���,�qC���8�Ә��0=���#GG�PӃ �~c�ߺ�����:ĸM��ښV�l�ך��I��� ���f�1Y���27����v��\�Fج/���q������C��;\I!���F4�jbҝ6�Пu�W���%�N��yLm�jɂ��"�A5+Nz��4� فY�Ɏ��s��n�����l���Y®�P�r�� n�F8j�X�LE� LN ��_e$��t�03��E�L���E7iG '��zF2~�t�Ť۞q���&�~Z��:����%�GeV�%�k>@�����۵%w�. ���搻&����<h�mqz&G.8� �� 5ef[��h�_�!���NUPω������_c�pj4k�ZM�~9�����j>>ݰ|�L���1Rj�@ 3U�s3C;���]ra�Z�^�R_۲P(�����@�zg��j��@"���|��i�51K�͕�ǂgX��� ��|�4�}Q�-4��K��U�Q��N��(�dB�4�P4f�$Dc-�vى��ӗQ�g�g5�BRu zFV�O�e.T͖��Ka�͔0��b���Q ���c����S�GT���AvYőY��P�E�:'y���nB�]i�T�aX��w��k��C'iz��[�N�'���f�$�w�����*�B4�19���� ���-���6F����U��r%�욆ѥ���hxFg������lQ�����DP�qbj��i�o����z��""m�5����rh 0��R�n��X�H�7����X�8�^��5j�D �ݚ?����|@g�����\"M:n�;��O�����V����A�s �W�o��dg�̎�)?g�q��*��o4�vkLW"��#lxAE��%��Z��`�\�" ��%�������PM�ec�)�K���frW�9�[p���Z�*,��XCz�����J��d�$\3���B�����H@ٵ ��hU�� ��8�J/�@"P ��sk���C�fݔ5�9ڇk�������%]۽��x$���ujwɧL?��D�>E�OT�6/hE��d��A�坋�)oN���>�T���4E��h'����;�qx��Ua��f�`���h��֝*&�e��\s�<8�?�𰂡��!e2 �_HB��[�+7g=[rP�k�Rr?c����Ez�HI {�+I�؎�KdU�_����4��Ě�M�������(�8�|�%����Q��\p}U�@@���25�Ӑz�#k���5_��n�x�N��m�#{�c/��9�n�^$�@p���[l���DݰJ�W�$�Av��9kn�=�|L�Z�K�D{KG���0��*oh��??��T=q� =p��3כ����I6���j��{I�8yJ��8ey��������k�dgm%u�`���q�W��Öu�/��������fD����in�1~����i�L����&�.�L�g�+u���4��,������Ɠ�Z4�f�Ӳ�،�UMé8|?���R�������@o�=������C���/�m$��x��G������������3���=э iw�s.ՕP���&{����c$��^HV��� �.�PJM���層�#<�LΏ�e��;���.뽜H{8�E��9:�㏏VH7���\����j�E��:_+���B�M��S;S�M��)���ۄ:�}�*�S%a*tE.!�J���4n���JB��u>�1�U�ւF�M��w�\�L��̔p���1K��*�ScpT��"Ȭ� ߵ���S`���\^+���M#������*�@c������@�2����VCK1_k|���Ay���S��|���0j7}r�V�����m�V����/�u�}t�/�h-q���Q�Xk���@l��w�=���2!�V�����[��(��&�"�Ph7r��,&H�x+� X{!����d �s�x�of\����_b +Y�|d2Ma�k � �Z�>�Y��H��rךt}.^�9������T_ND����0-�^�LA��Έ�C:�'Y�i�!���d�X~�Q�g��S��yc꺕��?�Š�5w���`���S�Ϩ�j7�uT9���yu��FqR�L<�j�O��]Ƥ��t';��*Hw�W1ш��c,�#�g;a��-�11�ե�'6�I�$�Ծ���2W{c���(�l��^�u��0��7r��c�Y�R�q�����-Ekz�����p�P���#���mQ�;$S��O7Z��f����.G��>������8�md�4���XB<���e����AJ��1�F�&G8��/B|[�'ѷ�?����?��o�'����BG�a����Fd�ņ�����Vz��f�R�Y���?��ܬ�~�b�(*��@m��p���ꏠ���wQ�Z��A$F_-# �E+� m��[|���'c�O���y|�|���mf
Static task
static1
Behavioral task
behavioral1
Sample
SkinSwapper_v3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SkinSwapper_v3.exe
Resource
win10v2004-20231222-en
General
-
Target
SkinSwapper_v3.exe
-
Size
20.2MB
-
MD5
49b76699d33fea5ea65f9de916e0c5e2
-
SHA1
f73278911ec21635d1a98b65f52ff11f286424c9
-
SHA256
b9e330341e060f2a04b2bdce8cd295fba0ddaae40110fcc59ffc5b33d3807f7d
-
SHA512
a2d8455fd807eb7602dbdfccc095467450d2d02048bc82e57b85c4ae7744aabf5f50342fc02d3618bc29a17ab0bdb88970b36d0d6247e71d30eec0f4ef0b4697
-
SSDEEP
393216:hcyhMqkyzYHssotReMnT+b/2X4wWtzHHf4iejk+ChChWKWX0jcdW7mVTmdu0m9KM:hcoYZAtke+D2NKf0Y2WXtd2mVTGH2KM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SkinSwapper_v3.exe
Files
-
SkinSwapper_v3.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 17.8MB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 193KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE