F:\Xenos injector source\Xenos-master\build\x64\Release\Xenos64.pdb
Behavioral task
behavioral1
Sample
Uni-corn/Xenos64.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Uni-corn/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Uni-corn/uni.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Uni-corn/uni.dll
Resource
win10v2004-20240426-en
General
-
Target
6baf7885073855ea0b23532ea7ea41df_JaffaCakes118
-
Size
7.4MB
-
MD5
6baf7885073855ea0b23532ea7ea41df
-
SHA1
87a1f2f04308e9f4429bda68cd94d52849472815
-
SHA256
d7cedf24540cda302381580eb6f7142451f5e16da35ad0a80c0f0c051d81d4c3
-
SHA512
4bd09f7e437ea6868919ee8b318f6b7e987eda94678ff7176f9a8dd73d7beec3dd925875c41a54bba811a778b67f39d5f05cc25cf71e019ee345ac00a477b510
-
SSDEEP
196608:93KIqRNApn8XRO6u21n4scJrRI6fM/xhwLDyY:xruNAQUc4sArRpfM/x2f/
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Uni-corn/uni.corn vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Uni-corn/Xenos64.exe unpack001/Uni-corn/uni.corn
Files
-
6baf7885073855ea0b23532ea7ea41df_JaffaCakes118.rar
-
Uni-corn/Readme.txt
-
Uni-corn/Unicorn/Settings/Theme.ini
-
Uni-corn/Unicorn/Textures/Unicorn.ytd
-
Uni-corn/Xenos.log
-
Uni-corn/Xenos64.exe.exe windows:6 windows x64 arch:x64
03c4ff9bd31857aecac9e62e0e5fdc80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
SHSetValueW
dbghelp
MiniDumpWriteDump
kernel32
DeleteFileW
CloseHandle
RaiseException
LoadResource
FindResourceW
DecodePointer
GetWindowsDirectoryW
DeleteCriticalSection
CreateProcessW
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
GetCurrentThreadId
Sleep
CreateThread
GetLocalTime
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
FlushFileBuffers
GetFileAttributesW
ResumeThread
LockResource
GetNativeSystemInfo
GetModuleHandleW
GetLastError
Wow64RevertWow64FsRedirection
CreateFileW
InitializeCriticalSectionEx
Wow64DisableWow64FsRedirection
WriteFile
VirtualProtect
SetEndOfFile
WriteConsoleW
ReadConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
EnumSystemLocalesW
SizeofResource
GetCommandLineW
GetExitCodeThread
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
FormatMessageW
LocalFree
WideCharToMultiByte
DeviceIoControl
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
VirtualAlloc
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
Thread32Next
Thread32First
CreateActCtxW
GetTempPathW
UnmapViewOfFile
GetTempFileNameW
CreateFileMappingW
ReleaseActCtx
MapViewOfFile
ResetEvent
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemInfo
VirtualAllocEx
VirtualFreeEx
ActivateActCtx
GetEnvironmentVariableW
GetSystemDirectoryW
DeactivateActCtx
GetSystemWow64DirectoryW
Module32FirstW
GetCurrentDirectoryW
GetCurrentThread
ReadFile
CreateNamedPipeW
TerminateThread
OpenProcess
IsWow64Process
SuspendThread
GetThreadTimes
OpenThread
WriteProcessMemory
VirtualProtectEx
GetThreadContext
ReadProcessMemory
CreateRemoteThread
SetThreadContext
VirtualQueryEx
GetStringTypeW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
HeapAlloc
HeapFree
ExitThread
GetModuleHandleExW
HeapReAlloc
GetStdHandle
GetACP
GetFileType
GetConsoleCP
GetConsoleMode
GetDateFormatW
user32
DestroyIcon
LoadIconW
ChangeWindowMessageFilterEx
EnableMenuItem
wsprintfW
GetMessageW
CreateDialogParamW
CallWindowProcW
DestroyWindow
MessageBoxW
SetWindowLongPtrW
SendMessageW
EndDialog
SetWindowTextW
CreateWindowExW
ShowWindow
IsWindow
DispatchMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
SendMessageA
GetDlgItem
DialogBoxParamW
EnableWindow
GetWindowTextW
GetMenu
LoadAcceleratorsW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
shell32
DragQueryFileW
CommandLineToArgvW
advapi32
RegOpenKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegEnumValueW
OpenThreadToken
RegCreateKeyW
RegSetValueExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Exports
Exports
??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z
??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z
??0HostRuntime@asmjit@@QEAA@XZ
??0JitRuntime@asmjit@@QEAA@XZ
??0Runtime@asmjit@@QEAA@XZ
??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z
??0VMemMgr@asmjit@@QEAA@PEAX@Z
??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z
??0Zone@asmjit@@QEAA@_K@Z
??1Assembler@asmjit@@UEAA@XZ
??1CodeGen@asmjit@@UEAA@XZ
??1HostRuntime@asmjit@@UEAA@XZ
??1JitRuntime@asmjit@@UEAA@XZ
??1Runtime@asmjit@@UEAA@XZ
??1StaticRuntime@asmjit@@UEAA@XZ
??1VMemMgr@asmjit@@QEAA@XZ
??1X86Assembler@asmjit@@UEAA@XZ
??1Zone@asmjit@@QEAA@XZ
??_FVMemMgr@asmjit@@QEAAXXZ
?_alloc@Zone@asmjit@@QEAAPEAX_K@Z
?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z
?_grow@Assembler@asmjit@@QEAAI_K@Z
?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z
?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z
?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ
?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z
?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z
?_reserve@Assembler@asmjit@@QEAAI_K@Z
?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z
?_x86CondToCmovcc@asmjit@@3QBIB
?_x86CondToJcc@asmjit@@3QBIB
?_x86CondToSetcc@asmjit@@3QBIB
?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
?_x86ReverseCond@asmjit@@3QBIB
?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
?align@X86Assembler@asmjit@@UEAAIII@Z
?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z
?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z
?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z
?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z
?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z
?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z
?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z
?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z
?embed@Assembler@asmjit@@UEAAIPEBXI@Z
?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z
?emit@Assembler@asmjit@@QEAAII@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z
?emit@Assembler@asmjit@@QEAAIIH@Z
?emit@Assembler@asmjit@@QEAAII_K@Z
?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z
?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ
?getHost@CpuInfo@asmjit@@SAPEBU12@XZ
?getPageGranularity@VMemUtil@asmjit@@SA_KXZ
?getPageSize@VMemUtil@asmjit@@SA_KXZ
?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ
?make@Assembler@asmjit@@UEAAPEAXXZ
?noOperand@asmjit@@3UOperand@1@B
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
?release@JitRuntime@asmjit@@UEAAIPEAX@Z
?release@StaticRuntime@asmjit@@UEAAIPEAX@Z
?release@VMemMgr@asmjit@@QEAAIPEAX@Z
?release@VMemUtil@asmjit@@SAIPEAX_K@Z
?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z
?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z
?reset@Assembler@asmjit@@QEAAX_N@Z
?reset@PodVectorBase@asmjit@@QEAAX_N@Z
?reset@VMemMgr@asmjit@@QEAAXXZ
?reset@Zone@asmjit@@QEAAX_N@Z
?sdup@Zone@asmjit@@QEAAPEADPEBD@Z
?setArch@X86Assembler@asmjit@@QEAAII@Z
?setError@CodeGen@asmjit@@QEAAIIPEBD@Z
?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z
?sformat@Zone@asmjit@@QEAAPEADPEBDZZ
?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z
?x86RegData@asmjit@@3UX86RegData@1@B
Sections
.text Size: 747KB - Virtual size: 746KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 258KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 321KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Uni-corn/XenosCurrentProfile.xpr
-
Uni-corn/uni.corn.dll windows:6 windows x64 arch:x64
21f00f46fed83f10ef8ff43e9f7690c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
HeapFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
winmm
timeGetTime
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fopen_s
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-utility-l1-1-0
srand
wtsapi32
WTSSendMessageW
Exports
Exports
VPiz���ɑC����װ�1����yO��b�YS�z�� �::�ȉ[�C�VxF���S ���:7wPH���w�f�Q��B�9�j��?³qI�;�3���]��ւ+Q1�E�^�Z��IH?��3���ԯ��xS�ɯYH������s`�泆�����`���8�U���-)Dp3�W��Z��l��zܡ�c��u�A�B�<a��zf��.���]>���M� o���B5��rtN�f��h BN�1�a�s�(sh$��T�4���]�x���(����5��� l���)�Mm��>T0�ª�ާ�5f�3���&,�zv�Z���#�Y�a�h����~���Ր�e� =HR�+�!I3��dq]���8mw���\v`g���6�����'t����?%�|�}����H����Y�X�6�\K�V���Q.�] T,ÓX�Y���C쟞$7<x�@ff�wid �or�������6ی�j�Xv��@�*�#SJ�)/��6��|l��,�ܡ�z�KG�G�4�S ݏr��I�L�d�E3 ��9��?6�;�ۅ�K&�&ey�5]���Uc�J�bK�qZ����Y\؏� �%�����*����V�+ �.��� ��UK��T͏�(a?�T�u���o9��5��稉��$۔�}�oDo���}^AP_�����0U��W���f�Ӱ���[2V}��DF~�}p�H%E�ġ�����w�>ˌڹc]�MtH�t3�i0���q��Lõh�=+ ��8�?�e�_��Df���9����L���(���0�E�PPQ��P XK.��SlF.�)�;��)���1;Ұ�n{?e��\����� ���(�L�s.4�CA�e�� �Pj��������4@竰�s7����O��h�#<�Lh�����<���Ԧ���{Q��l�s8T��"� X1�,#�8�V��f�1��yfQ�b�]!�Zl��~�n�� �0��T���!Oem�g�Z�I�ty�2n�v��,���@˟��!��EĄ@�����������9�L�Z�b#9#_#8D+jf2{���zwK1\yL�X]3�4� �x"��F?Ȍ�W���LT�t��Lj�2uv�3�H'��X��#���TE]p��.Ԣv��&���H��<J�7��7�d�k��N�I�s�n.����>i]P3"�5��VU#�f���/��[}d/ϙ�s���e{�̖��j�U; ܟ�7�~+�@�$��|�"�l��� �e0�Í,(��o��U5���ݺ�y�u��C�L,���QP`������3�\�}=�_f��P�,I��J�+*_Mç����]�u�y%�������@��;\����� -70��/g�!����2B�Ǩ�^z����Z�,��y�����9�`)A� ���p���L(�*`i�� �ܡZ�vr���U6���o��hC_b �w�尬�M�Kʴ��t@%}�t�<� %��n�䂱��U���q�1�W0W�9�M��#\���K��#\9����q���=IQ���ؼݧ�p-G%X�������]a��CL�� 'VI/�ڌ߰����i�{�UT&��V�X��$�ꉴ��6|mF�d���=.u�H�,Y�E("`�#*+K:�c��Qg��)" m����@�zPX�Ij��$�(���' �5��|��r����L>B�ʸ����兕m�u����<^������n Wc�ȋBg.j�;F�u�jx�j�ꦺ����+1c�sE_��4O�-����e������]���s�<.���� �Y�72��T�5ʹҗ � �'>�Y�d�9�t����nh���� �k���<�t���㿥kO�R��,Ì_�g���as��y�E�����Pu�Uw��4ل�ߧ3b)EI�܂V�~C�u���87_�h���Z˱�L���� aH�j竾��ס�{`�Qc���; +�hL��A��]�jjDr�s�q���'�3_�s'�r����D��h�aX�48{�ɉe� �I3dy�T��Fu2�O0u֟N��6�a\��A��{�J|�"��V[J'�]BC�0��`���F<B�Sc��e��ns:�����a 6i�g����4!���YE��jΦ���h��S�͠���s>@ �������@�&�}�0k�h��'�,W�>��E8�R��E ��~��� �_���^��UqW��+��_�:������ru���3�p�b��*�h;{��_�@Mb�O�z:<_`7���Ѿ��Ӹ���1;-��Ԓ��R��O�eH8������dn��@l)S- #��HC��o�'�H��I�C��~��x٘��t�� ��E@ʤ����_]�ܒ��������^��%������M��3�rR���_۳�e� �L��������8@�cC��6�9�BK�n��vx����%���29�[ ���R(z A��=T�����B'C�J,7ϸ��4�XQ�'<K*� ����C�ݚt�yo�=H�Jk��Y>�J�x���@��X�8��ț��T߇�cΔ2����iM{�4y8{��yP������[1ܤ��2^�#f� ��4��i ���)ܯ���v)f��C$#�)=��u���{"zݖL���H���d�z�;���1%�[��S�+G���wp^�� /f9$ͫ4��}z��LƢ�=5�Ԫ�`rm00���u�R��Nq� F�M`q���O�i��$%8#����_����{��0�xI�����M��_�04��r≽�?�e� ߧ&}v�^B�����l�e�������|��J3���N ?�=���(�#�w}3�O�6<xz1�o=4-�'�n������)20��q��GF�[=d��.��%�����N�],��!Y�*�����-������c)��\�0��j?0/�]:��i6X �n���bp�����[F���e����hu wğ�o�p�f�L�F�?��-Z��#;��M�o��QǍ���B��,���Н��k��ҔX TXv.�F{S�O-�l_�8x9�Q�@r�����ۻ��GN���G
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ