��R�dmv*0�hEd�iA+�Mij�K���U�K.�-F�t��<.hS�d#h���p�c�������Pd�5���p+���R�`�4ELz ~�"E�jʬ����Ռ�J�z��t;��G����s &� IPiL52�k_��̒x1Y�C����H�AU��^�^t=�����'*���y"�b��Ini%��;�0��gw��0�ҋI� �j3�D���!�UĔS6�;x��v��b�/F,�� 6|TI���ZT/%Nj_�G_�a��T08[��p��ៅ��r �C�QIg&�>i���2���!l�?���FN(��-?K��#�z��b*�4Dž�բ,��_J���9�� _�s��������ug��n `b|��4���UQQ�p��]y�}���~��&[�v���>җ��5~H��ө��#I��t�9@sԚ�����e���yn{?�22R47�≞�tf#��,W�IR����=]۹�2^^h�L�m���'b�Ld"Mv�Օ���R�i������j+�u�l�|uX4[Ѻ���^��f��� Cb����;hP��X�� �J=r�o%O����O(&bP�{Q[��-c��� �H(�2��)�$3�h&�J��ɢ֓E�r�o-�z���+ �\xZ#�l�0�PG{��`O����#�M����*�w7�*���R�שk���yl_�|��h��� e�����J>��I��_A��O#g�@%��j��7C�!��|b�r����?\[�˄�i b���������^���J�2�J+��R={�R�] vU�Y$ae#Z;���M[~�;�GS#�Yg`���?�c�<%xB�Oi��+��r�4;Ԗ.�U���~c�����e�P�дn���4��lSd���T��,S�aS�}z\Z��N�<m���\� il$r��^&��T�#���70"|�aOx@y2�?�g��\Q���[y�bd�&�LD9*C�Z^�Л��\�CEP����K).��V����fU;��� N�i���@SѠ/;FQ9�e�|��Ph.�d� O��� se���bU�J��I�a��ʓ��.���9��73������}i�:�#��4����G�BҸ=���N�A�J������A������)�ֈ9�(^�UQ]���M�a��$(f�В�P@� !n�y�QQ�Sh�![��J�J�~K���Z��r�I�w��^���S{�������7�cn����Vk��>s�?�͉�ߔn��~[��kXXOpu�R��x21��չ��́��ˊ.@�>�(Լ8}?IsS��ۯ{"GB�V:�t1/߲����H ����w���`ZP���M6�V�Xt�R���:�����r~�m_g�Yhv��et�9ۯ��\2�ܝߢ�'�fi8|5��}���m��g�&�*q�,��FB����K��^�� ��,����R0ՖǠ;��@Gz�>��z��!�����7X�^, "�����AP�ʹ6c� ��������1�J��DH�03$�/���)y⣇E��D��L"� �h��|+�e(�u ������&ˠ���>���1���IP�i���6 8��M^vG֠%U����AT����KG@�r˖Ղ��:��ӝM���N�aQ�Ӷ@��>'o*��T�x4�4P�,�6�Bs��l�{�ޭ�UB�� ��6��%z��>p�/� o.��[%�W�[��Gz�\��^ٱ� Tt�ތF�нCSin^5����~��>��;+��0�Ě7�ϻ�a��T�.�ٽ��i%�cy�(;�2ښ�;1k~����x��bR�1���*,PͮM߸�kz�R�)�1T���{���9���nWMd۟pJ_�J&߂O��� m�����WQ������s@�t4�s&yJ��^BC��������J�K����ĐZ�n�B�D�]���6������6ir��g���:A��G�i�����6A|�R M�"���r���o�&����V#G��!��N�M=��d� �C��ߝ&քg��&�A��{����țޝT�s�z������h�߃��?o�# J1#FeH��� ��C�h�3}�~m�E�`0O "hqqX� ;�� ���Oާ����c�~Śa"�/���`/�x� �?�_}ʄg���Q ��o��`X����x�Ȱ���E�4��(Bu����^"ғ2n��LL��1s������r����ֹ���� ��ń�<���r��z:%�����zN$�,��fk|�n[�n[�h��漙���F�%��5M�PϜ��>lb��R��G�.b���=��̌O�j"��h��}I��%K`�Ca0k�5/\����\$��@�9����Ȉ)FW��d�a�61#�O�3��\�D�M4�W0vZ�g�=݇�1R�q3����fo�]�y�g��98"l�n {@3,�$I��˽6�0<����+��Nfu^܂|ĸ���d>������t����]�gqC��Bx���T�,szfN-!��x��C1n�aR�P��0��@��{� ���_8-3�v��Z�Z8 �n����}��3�����U��$+�=��r+�����s���ge�&���pl�9J�b�0�X�;v��X8�ɾ���wݷD�S�/I��"ps7��4�;��D0ns�Jh�' ���[�7��ΰ�O���s]U'D�>q�KCA�-?~0�A�.���/W��� ^@�e�lȀ_����>��rr|����Ж�$��{��i��mѳ��X��1�]0�#�Ԡ~`���d��'�1�8pq7���$e@�ƛL�sg �U�1��drb/��fm���<>,;5L�:�RvkQL���2�s]�����BTK**b&�������Z�k�� ����%��@Y�B-ڝ��2E{���4��>�^�� IC�����(�7����d[Q� �R@��B?V�y"5�8�-��#�����U��+C���!�xH��pY��Y���!��sR����������MV�l>B3f{�bƤ���/��t,Iv�JX����ǣ���z5�a�K�x�����3A$����g?M��^J3'q�L�c��
Static task
static1
Behavioral task
behavioral1
Sample
EngineV2.exe
Resource
win10v2004-20240426-en
General
-
Target
EngineV2.exe
-
Size
5.6MB
-
MD5
57ffaac302fc8e0c9a36d6bb95447056
-
SHA1
76c58876183a58c5ec9cf123d37d9d051c0569cb
-
SHA256
d7230b6425aa681bef44b7c3a9d5999e0e4f4441f312616ce148fa9ba397a249
-
SHA512
ce20684e5f1699d832874435da988c9ee560407e6f82a32615f673b137687ef85e99a1c45b2d72981d2e29f94728042b98e53bdc3bef39b7fb9a506ce78626da
-
SSDEEP
98304:P7mf2nZaaL8bFYS4xR7Glkey3G4tbqMjPXBFhEYvdd55vNNjaRcHvb:1rL84dGlp6bq8PXB/T/7NNW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EngineV2.exe
Files
-
EngineV2.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ