��j[Z�"�&�-9R�(��K�j?�R_�ߝn0� �(N��"ч�����h�[ �j�����A�I��1���'�?��H��Õ�EL��~|�Ѭ3�L��F�=�Ʋ��E��b�ev5�~S��&���R���+!�G9v}����~����g�4Y4��������Q�AC('��ށH����l$�X�i�x��K�&�@JwlI�u�ߪ�21�#����$�>K������<�nw(�k��ߝw��<e�Zej<l��[��g�d,@�N�]OtqݤO�G���0���~6�N^g�<D��\�p����@w�[� F�wO���}!5�Or-9"Qe��r���?#�#@vb ��m��)\���x�WH���ؐ��F��]��Ν�6���B�^P��|f~7�� f�s�SX�����o�Ϥ0���l?Vrd)%�L��W�K�b�Ў�l@6wK$f����5H�{h��=�ׯ��?;-�����9�`|P/D�Hq�|�Bຳ]�ǐ1ƨ��B/>�B�*��b�WN���t�~j�I������1��!F�@��G���,Q�0/y>ş���]*;��a=�,OM&䏍�-|;��o������V��ҁJ~ֻ��a֨�XN�0�n,<e�c;�*��F{v:��ɖ�DR������Ғfr�y���]���&hgTc;Q�M5���,�?�v��y�b� �a�D�!�n�0�G�ļ�z����]���r��~?Sd}�"��&!�-�H}��4����^�^�B�d��/c��(�lsD|zi=�����i5�+��^ `���qNQ��[���1��q��nN4���,q�s2��ȶ)�6U����o�q3�ʷ"P6�cC]e��V���<iX$>`����Mf�{���^-����w���nԨ �8;o&�̣G"������a4�9�D��U��[e=����d=���W�3�4�?Ŝ�-�X���T� ;0��_����i�ͤ�m�&�7]�GU�q?G�K�tȃ=a�wJ��XopmH'P��*3��D�2���\�l�e�A^�jr$�}���?���r����|+@��e�����w���x�=ww�{���%���잒����>-ڹ�́�vp�߂�c3��L4������b��c$���,�A�SuF𒆟ȿK<AA�:�I/E��$[`ĩH@mE�������@Ѯ�K"_s@/�j�Q��"�_7a)/���n�������p��n(���i��Y!:�]T��,=:���FZ)�P �����{nf�H���JQ7>�����*^�����w,1թ��$���.�`���M��a�� ��O�[}�G�d�D,*�U�E������p�C�`��ۥ��d��+W%����m8C(P�]KUM+��S��_�%�j�٩E�b�h�M�6����un�q�K��!�I�yB�Iѐ�3�b$��>�@�������X|�UZCj<Q����1��͝1B�j�J��i��ڀ^��3��5��Z�{���2��<v���p\� ��13- ��w�YH�Z9=@��J�rB��'5 ����$����w-�����L���ߡ&G�b���x���������%'ilj�B�s�d������ĭ����n�aRU�iSJ���=�(S�M4v�&ce�Sr~P����Y����ޢ��wC9g�!36e��}h��Yr��"~�җ~�v��}�FQ���V�q��p�g�G��}sb�x�7e�h#��< O�W�H�����L�Z�hˏ�}�� Ý<�%;��j���Բɟ� h����OR�K���!<��p1"�p�A��-�� >�0�ڦ���'��������S4Lp����[��V�B�S�*ej��Ǫۮ���@x�'��Yҟݷ>Y��2��}�&�*�A+L�Ao-��G�,O=m+�M�ڗP AhX�v�{X5�z�u�E��v�W�xZ&oE5¿lm�� R�iUFSZ���h�`>^��6p���J�������_�oiiK�T�;�#�502����0=*�7ŧ�,��;����t��( �^���p�b&�qI�`'�mY�?:XRO9����`����-h~?4�l^IE�x�ˆ�R$�Os��F��a��H��!��nxl���ɪ�{xR+��a���7ҩ������p��Y�zU�j�>o�!D�1,�7�����g$%~G��(q �3 ����EU;����'���|z=���Fh�\������Ok��2z��3r蓣F�{;�h��ur�Z0 i\��~����q9I*�r�b`Z�/�7���P㪑�oA�'V(��H_�)�9�@�)�|�̓�;%�wu����U!T�%���6�]D�\����f��Ӄk�h�:z�iuN(t�h�S�Ûޓ�D�Ni1,5���m �Զt��n�ׇ��ʟ�o�t�YBAmgt�~s���Ԯ��,G�n�y�Q�*QͱK �r�#��C�X����흎K= �hR�^��[e�銪�*46���� �'�Xx�CN:� �<r�'�����G"߆�*���Sr�)�e�O�=J���\bPP���H�z׀ԇ�H~ ��^��nG���=*�1f��ʽ~+���>�Z�l����ΜgJ��l"O#0������T�9^4��|�����@ڧ����EՉ�X�W[�;���za�` ����K��tnd�-Z6㒛�����F��X��}���Ł6X��l��:���~��#M�|s��)��qF���D�4~V�����tz�r�y9ʏMF�x=GG���`����Np����un�)AZ��j@-�.b.$>��ۤ�Bf2s��}y��O��|�ヲ���F0�4v{�M2�l �J�b���-vW%�q4����o���O.b�JdK��i���ʭۦg����m+8���0*+g�;�雳�n��2��z��Wa[좰��d6�� �_�P��_���.-��J*�ۘ�I!�/ن+�M���Zm�� j�3����@����(�v+�La� :x��ē�Ad����[��9a/��9���OߦX+���D���������v?��E���
Behavioral task
behavioral1
Sample
Hv2iXfV.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Hv2iXfV.exe
Resource
win11-20240426-en
General
-
Target
Hv2iXfV.exe
-
Size
6.9MB
-
MD5
4d1a5ee1e059c12e0ad0e546e56c720b
-
SHA1
c9ead8ac48f800dc6b858335cd8041e2b9ec69f9
-
SHA256
03a16bc8237f3d41a0229550e039ea4953c46becf4dacd57add96117ac30991e
-
SHA512
d5b59387fc1f523d2783a3efd377deb97eef93eb15b8b5e4d9bf1770d88aba2912389e3f9c8d5ff97635502a947587c9fe0b74c33cc457072bbb87fd32d7397c
-
SSDEEP
196608:Z20xefZjuu3haidw7bWmPP9M4dMuYCxsjv:U0OBFFwv39M4wCxY
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Hv2iXfV.exe
Files
-
Hv2iXfV.exe.exe windows:6 windows x64 arch:x64
57eeabfb09f9bbf59c60a2eb2cb9a641
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
TerminateProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ