���}�2<#�~�s� �|��탲X�?S��3�Ԥ��������F1S_JT��d��ȓDT���)n���֡�İ��O�5�{��Z���Dz���)m���G@��5�=���=IN~iY���OƊ�Dp�+B�����ё��*ļk%c���)u��d��3q}�j� �T��N���/G�T�x��w:_���R�"Q}�я�;���ۄEw�U�E�*� ��3�e[�~��7��b6r����+���7�l�y����m������>����_u���͒�Elh��(���O�M ��:`@^vt8=����^Ζ����*� �š�)Kz��"�.���o�7��-����,̏�4.X~��]��� ɜO�����"ע�f4�Fѽ�:x�����~���j�ޜ����˥u5L�$��7ĕ���0k7L�a�u�P��j�{�pn�)���|cu2⥎ug��� ��T�n�}�h6n�f��TNé�dg��A ����fA�r�X��}ٵo2@a�tIw�G��e���R,���&��� jlj��o�_��+V�O�ΰ�A�·����G�/uJ$�K����?l�'n�뢻�Y��� ��Q^R�rE��+^� �H��|L儑u%.�2�I��Ԟu�t��1%g�U���Nf�)�9�=�{�� �;��$i��y��ׁN���;��RJ״%�o�L��o�J��0d��q3 R`�v�~��k��d�<�ӷ�����'2C!�b���<�}I��3P��3ףe��uFݖ�[��ўD�X!+by���V�t�S:���:ɜձ�{�A�&�Z���ir�������<SU�5����y\=A,���f+Y�>͞S}Q2d��L]��%��ݭ�k5����/"��t��X�K�2����5� 貇I��d;�0ަ�i��(��-ɋ���xV| o��U�,p������ +�*��&��;�\��̀�Ì���6���-�%@�NE�_e� �4ρHZ;���Դ���`A�-sڦ����B*��x�*_t���|�,��(����q��e**uL�ʫ%�~�g�<��I�z��O��{z��pܬO�%��L���10}�I���O9a,�4��͏ht�^LbWP�����{�����N0�ԧD�ٻ��+��!rOp!�}b��L֎�<j�T����]���9b{���|������?��QB:��+�}�J�O�mX�������$�]8�}�I�������Z<A��&�<������x�(uX��m��8�9�kP����j��ԏ��X�2G<C=�OfP�$�Ѓ� I�i�������a�{U l���y}���Tζ�<��]`i�Q�e��e�jə���p���[2�6h|��z��?���A��*4���:@>7ح�+���ao�:|����"�#�jf�U�����y�I�?Kn��!�=���E2 k��!�����,"�YlƫΟ�Äƽ��Ǐ� ��)�ßO���,�9��(�� xAIf���-��j�Bڃ`y��OR� �n)"as���@��G�Ƨ����H@��f��F�2��AZ���?��@����ݕc�<C$0�(d� 3��Ҳ*5^�HC��2��q6z���Us��ڜf����*���6�UL���P��2�=���V2_�Q�138&�e��ϖ-�%q�'�_T�M�9�Ƚ;��23=(�:FN���%�6 �1��,t�1�ȸ��՛�!���ᥤo �kC�p��]��r��gٗ�g�t��!���ML�_��/ tXZή0�&c���&X��+�z���eK���8Ŷ�D,;��B{{�� �,a�?��/��?5�� ���Nفt���Ó�~(|���P �s(J���j.Z��̓����������-��M$b�;�Py[�0�/����'�}������*� �~PU��N��I��h�p��1~�7��&Z���������^ :�v�e�hB % �;�}I��R܁�A�Lx��5aR�*}��l�@�k+�'��ڰz��(/��s<�h-П%�N�ra^��o�-F'�����������0��9�]�g����8�ɣ�Zm� �r�*�"E�LRHd/1�v���xe5y�MDﰌ��{5ji�PlsZ���i���u�[X��C#���T>��Nj���k��Fվ�t�S¬�#o�yS��_�6��n�\�f�l!�ɈQŤh ���8����<��`'B����$�E�����!�dH_F��j{w��C="/����v�DG9�{HL�"�DM��� ʫ=��g�z�ՃӰ�q�|����r�g�f��{d��@����@��>��C��A7j T�V�;��,��H�M�j�L$�� B&��t�K��������8J�v%&"Oi��nWm��Z0�S���c�B�AE�p;ޥ6������T����Lr�� E��+��I���:G�d���ѩH.���[|G詶��Ql�>��6���O�O�/`��]I;l�B\���I����f��7�3̀�f�'�*��ә��\n�7x$��/Z�O�TXx��� d~M|�f{ʿLv�gL���� ���*��_O]�� x(F�M~J����Ƽ��U{N��us��'�B��6��O��Wg����ֵ'�t��O�\͢Ώv���M�z)�Q�x���CGjո��������C ��n�T .�m�,�3V\��c�:����U!��&��{��ʑ��s9����t'8�#�'���gh.�c,���s<�esۢ��tP ��d��4IxC������b�M9�����Xm�m2�i��أ-�H٩��3#�ς�l�1aߐ%-Lg#������壙 ��}�Y ��ʲ������������1���~�?�+_��]~b%{�#��}7X��M�zh�Ly��I}���Fú)�P0a�Q�v��� >!�c�Sم��Q��*�N}�;�p98"���$8�S�d<G�OGw&�wDz������=�N�Ncǒg��F��]�N��k'1��p+��1����Da��k~:�-]`�{y{����*��~���B
Static task
static1
Behavioral task
behavioral1
Sample
eclipse.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
eclipse.exe
Resource
win10v2004-20240508-en
General
-
Target
eclipse.exe
-
Size
6.6MB
-
MD5
2eb5987be2119cea2a089d65a5917493
-
SHA1
dcde236cbb6d3520bf4c0954e7d8c286b1531321
-
SHA256
1cdee449f45d4990e9afb12836f586604ce8435f90e641796444d26e81a9d9d1
-
SHA512
95336ffe3fb0efb63099f2c28215869aa0838b459c774bea8d97887486ac7c7510411bcecac5cfabfeb25bfc7208957b9089e35411e67a19454d340cd7bc1ff4
-
SSDEEP
196608:tYyojz2QgcEqDPVp3qUORqCZwJ7COLHpi0B:tiOQtb39eh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eclipse.exe
Files
-
eclipse.exe.exe windows:6 windows x64 arch:x64
2e22e5e3d8c34070629a5225d352638f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetTickCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
dwmapi
DwmEnableBlurBehindWindow
imm32
ImmReleaseContext
ntdll
RtlVirtualUnwind
bcrypt
BCryptGenRandom
advapi32
CryptAcquireContextW
ws2_32
WSACloseEvent
crypt32
CryptStringToBinaryW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 519KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.niggAZ0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.niggAZ1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ