�%enV�� �pKљ���s�e~KFx��%r�ʯ���#Q�2ø/����^*O���ccPfp���ۧ%��B���N������e��� �y5[K�:�Sg�"�-e:��������+�Gy �[����zp��&�(��E��5�n~U�*���g�S��|�w��Z4�;xO��%��+?"�� ?��j��jG�>5C�������� �}d������5������%�=��<G�ZB[Ų7��y�.$*�g&$�/�]m��~��8� �{? ��/x���o��b��l�/�Z�} ��b�v���{��V�4�* u��jBv*NÞ���]u���xi7<�j��R�����ѫS5Q��"x���X����s��ӥ �9-ä���<r m�M(���C;�F�����Y��U}�+��KgZl�A���O����OWI0���a=}+���k�J¨!6�z�[LUY+,�嶚�yFH� KS<��;���7����C�_�D���i�Ae3��,:@AIq�������k`1D�[Z�~Y�<:-a]��=��O�l9�.Z��Đ_�������*_ԅ�n�r� �1�y �@����d3Y:���lX��f ���D�Mg���N� `j�C]S!m��ZS���Ns����P/��4w��7}3'=ʍ�繍�e��^C�Od����3�E��r�*���� � ����}��E��t1h� )iЦo)��/v^~��*�r���wd!�I �)}LW��x�g{�)��&�C^�<�a�Ñ�Hʴ%����٫x�uB!��kI �\��84rЭ!z�[U��b0���Xӏ���~\��;{�a��Ƃ0K��N.~7a��L�r�@�uQ9����3� ��L�=�QG7�����P�68*1o�V{����F��B<fO6�۴�H=C��a�^��B���]�Ymu���J�����Kd�]�<q�nH����?䒓}i��^�G��ݬ}�/���J�/�� ����[��g�?���G�h���K��G�Z-�s�7�(�����<���:9����\Z�#V��x~LЂWz���]O��P��x9�������!Z�7�����,D��Y��m�ZULQ���9K,4�������]�~����*£��}��:q����y��!��AVz�'f���%�0�����kˈ��661�AK#j�J�=;b����1^!��_����)6��e������w'q ��_]+F�i�T �IkC�����f�����s���Y)��wAŗ�bT% vB�7ķk�%�B�X��~:�ey��^{��_%�(�b�6r)��c���/�f�j O��(8��q�D:��־Ϡ̮I9Aj�!�M���\��s��w� z��#ܻ����z���.�0}����jR�<��+K �(���(�P��#�9�05��IE�nqc���oB?�`�0���S��3*�R`���Q���7_>�^��x�M���6��s#��2�ďI����r�>� ���Y�gD��Lĕ��j%蠠oL�vl� K:]���{�c"��y���B���R�[:2�Lp������98C�9��v��u*NmF�"��gVӫ�v�@����������+7�m��I3�U{��yϑ�U�ފ��q/�O_�U��w�+�����|�<J�l�.M����1�e�*`���}���U$���.��CV�!i$��3N-��[E���+qX�B����],��>9��g_�T�J�`m�Ŕ�����x*�b�9Vޅp��S"u�+1���mA����t����p��ȧ�Ӱ�g�r�"z�L�<����X3�.y���\���6���}�Щ�߶�z��H�tĖ���)����>�Y�'T5�r�&1r�:��3P���B~���\�Y��8���#@BM@*c9A)��K��Y�d8[��,IwV\��Oi�"��I�R��A�y�i�")�+J��F��-YtDrSߠ�� Kg֦[))����Z��8DnG��i��,p�1LO����7Bz�������Ħ�h�pdI��̼ݑ���F&v����P������X�Jo`7�#C"J3}g �Iinܚp~1'\���=ŝ|!�L%c���0�~)!�� �ю���O�EZx�p!�� I�WW�W�m�������M���X����YRM��������7��3�&(G�J�pp��e�?��/;�eK������ܲ�l�H�@�ki�/gú� pğ�DW���(z��+����508 ,GT�{��w��Ԛ���0�W'@7�9���T��� D˷�O<3O�xf8��y��EX=��f���F��Z�{���ȹ��)lqN�⾜>/�Xh���|@ڙ*�3'i��*{�w��q�/V�7f1i�e�>N�V�'���{�X����ImI$�R4"��X�!�J��J�H�FM���.�+��ÐQr�L�;m4#4:8��z:"��`R��M���^J� ��M ktH�JV����_�'75���_o�rY�D��|��t�E#��Cf�1`8Z'����'��J 2.�Ơ'�l�Ü� ]�X^�}���n��K�;� ��Z�����F��@�)�d���/1�_V ���;��b���e��J��@u�#Fk��7T� ��7X���j�}Ӭ<K�?��~�X#�6�& q�����$���?�M�'0��~o^�͇����m6#I�{8�S����m�(pt���!+�]f�'��讀�Hit��������N��_�9[p�!|�p�!pkh �D ]d7X}8��^w�7w�1� �{��'�1���QU�9�t��`B��A����Nu�MM:�]v-���xgX_�&s�<�5�m�4�3xk$g����kFvd�$%��} w�j��͡�ynre�]�[���O5�H���xPpx�-�$(��"�2\��Ը������������v�ٸ�iĹ[z<X^�����V�� �����K9�>G��l{F[����������Q{il�%8Ӯ�Gb wk���]� ��9_������-չ��zg��K9��z1?�9/g�L����TCb �% �X
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.MalwareX-gen.24598.13983.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.MalwareX-gen.24598.13983.dll
Resource
win10v2004-20231215-en
General
-
Target
SecuriteInfo.com.Win64.MalwareX-gen.24598.13983.exe
-
Size
8.9MB
-
MD5
91eafd7202247169a13a1c8edbb1cb3e
-
SHA1
46cb481843b6edb40b64644019c59359760ca29a
-
SHA256
7a26070adbb15a6cb4bf329b2f095dd98d91669c2eef908153cef67fea14426c
-
SHA512
5d628061f2d8922547cbe5e87b3055f284910e5e1f59b371954e79d2225ff48bc5fb4c1904482f9e5adf9a9f680868fca73c201e70915e10d0a6c22e862d6181
-
SSDEEP
196608:WYGm20u9Wr4ijaiM0D+d9JwB5egq6FeGYcO4QHF7oabN:D2oVNDs9Jo7q6FP4lzB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Win64.MalwareX-gen.24598.13983.exe
Files
-
SecuriteInfo.com.Win64.MalwareX-gen.24598.13983.exe.dll windows:6 windows x64 arch:x64
9ebea262235794d1d568f42e98d2db87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
vulkan-1
vkDestroyInstance
winmm
timeGetTime
ws2_32
WSAResetEvent
advapi32
CryptGetHashParam
crypt32
CertCreateCertificateChainEngine
kernel32
FindNextFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
vcruntime140
__std_type_info_destroy_list
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
isdigit
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-math-l1-1-0
_ldsign
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-multibyte-l1-1-0
_mbsnbcmp
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.30 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.31 Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ