xR7��>|�u#�#���p?�핈Ѥ��k�頴B�&.��0I"v1#��S�G>��_�f9PH�zp��Z�.�h�\�}�ٽ@�v���[5&-�fU�NѬ�"s����E+�Xn[�<��]��;J�y����""�����P� ���g~6&�C�9� Fye�%�e����ԌR�k����5������$z�1�Of����m�ѵRO�x���V*�u�G���!��,�§qNe���B��m8��|ŲRҹ����Y����_��9�G���y=���m3��A0�1��'H����B�����jp��s[�ue���tDsb�a�uyh�d����+���_#��y�^ʨ�`G�rf��`�K'Q���۪�$�u�T��t,���?��=��P����}m����Ț�@ve�[ ����|p�Q�D` ��x�AG+!���ƩQ���!6�M�+�h�4� � ��O&��m�X4��ہ*�Y "�$;��Tn�q��L�LT@l@MR��g���'T�}PF�����o۠&�n��@�{) ��I]�w�����K�M�jh������`���̀2�ެn�&��:p���ۉ�{�`��x� �1H�z�e���G��@ dQ5���ⁿ�ͽ ���V�t�ƚ�����U�M)�b���w�5l�~�:QxH]�Ww<�<W"7z�������㮑������R��~�w��yȅ�#���C&P��=z[,t���0�Áw����_n\��'��Y�f[v���P�(k���F�g�q��2�D����AZz0*�\�j���`�l�;�'��w�y��?�;�0�m���@3���lS�J��2u��>�;�� �v93k϶R�tu ����3 pX�Pl{��# j7>҄�q~�xS6��Z�3S� [/��d�������5�p�:�ю� $�!���<����K����|L�hcS�,�F�_?�}�� �� Ӓ:-����~Ì�� 8}�je�`u�W���|صIr�Z��S�5����x^���&Ir���"��*�K�����,)�'}_x�?n���j��̴���ӂ�[)�K�dz`1x����o9s%��o3w���H�{�h�ذ�}�A %�r�s�"����Rѝ�K�K�(�~�ѩ���s[�9�����1 .e~�����K`��������{y�/W~�j:L�I�EԈ���jf��J�t�t�C���w��T�*��;��{zz�[��%� ����zT�Q�����L��W���c��4�ahZ~q�8*g�,��̮C��i�c���>�6�͢��>�-_���`��U1-��ta^%2[����d!�4��&��`&� y?@��Z�^�T�����;O�������"���ʯơ��z+vbGQ� L<��%��s1 �C���N��Y�����H�a�ý{7pd�Nk`2 ��z� 8�/z~��Fșj�W �05�n־�\�Y�]�����Q�c���\��������U�|]��WT�����{إL�{s�DċK�߸6��� ֲv���ODۧ��~9|��pƾ�7����u�J7v�$$#0�h�#���)���=���2��6���Xu!6�-Z}���aJ�Ŋ�SW�y��7��ĦvHb&��p�As��D��5�A�����iVN�-��X`3rm�~�/$��PS�e��7����t0�ݟF��wY���w]t��9����m�'�im���"P�~����lO�c��R,�F .�Ү��-�w��m��,yy�Mg��|0���U_t�0+;�$�4������%�m!�T�0a߾�WcY���_��|"����|`��N�����W|5)��\*'�6�5��������nB�i�\n�4{^�B�aF��N�AS��"3M��6�$J�(;h[�K���!���P�&A�"�|��I#�e���E�4��U,ό��rKX/���G["�uO��0zn�X��9q<��3�t�k�3[Dc�R�O�Y�7h�`C��9"^���d���������<t0��i�]�� �j��|�x1'���R�I�["o��I�S�sÿ��m�:~�el�)E�jb�~l����t�I,�<E�=� �fU�[����7�/���*<z�z��G���QZa0�7j�����n�X��ю)�뎑��3IԪ�_�{"�ξX�o�:9�����������39{ %��C3s���C��{�|���+S�U 7@��z�����~i��z�\I� i��Nc�\<�szX���5 ��p#�k����!���L0]a�Fsr뷙-w�����66p�՞������;�E������a��:Se�T������e�U�H0�* �1/��`!���ȸj����:����*�Kg��Ƨ�ʘ�j6�i��8eyVx�p+[�{kl�P�A-��!f���W�B�4�~�����6T��B>B2+�De�h�J~R�_)eO�)��^/�?#4Zwȋ]��~��������m���b�`m_�/�(�a��'FQg���5�O��(0X�Z��.��'(0��c^��)Cy�$�-�����7Ȗ1�yI�d;qL'w�/�ͥ���Ghp�L2��l��e��xi^S &�(ok7$�Y[�qr���VQ�N��c����;��cy�I-����j��ē)�4,s��v�� =��#L�}��:dg'Q�f{�I�Խ�{���y��6�^ל��#*} �n���:5z��]/�%���S���+J�7�4Y#��}�����^߀oQ�[����%&c�����U�+�˃����]������GΑ ��ґh8�X�9,d��J*ҿ�R���l�^���8�� (��Ե�n]=*F��Ű�aUrx��t��������q��������ڇ�ڛ ������jCx��yf��ĕ��c����1:� ib����~,iR�I?��S!H�*AP�{����$��/`�4���M&Z��8�>��j |��~N��; c�/��u)*s���f Ȩ���Ĵb~���*���/@��- �q�å��33)7�e"���oD�̍'������pF�22���9��9�7اnR�hRv*#�x�%���
Static task
static1
General
-
Target
ProjectYX_Free_v2.2.exe
-
Size
7.0MB
-
MD5
3a89c3e16f7ad7da0392c4915a4ba0ee
-
SHA1
db229ca2b0580532f8c339eba5edfdcb289cc349
-
SHA256
21afe823077fbb670f498719abf65595e0144cd761057338aa809fc70db5f5f0
-
SHA512
9c7301127f86048d3947492fa4c76d0a378f222b1aacf4bda572ab83ddb386ff4070e8b85f0a9826a7e67cacb6569c5b6267b4abc8d35e30dd65f64d4eac6ecd
-
SSDEEP
98304:GDi5FoY3CPDCuUD0H+xqlQ8cf8NzZRtS3ogfbCUkfHGK3RDOmvygT199gFq0kJ5D:Ii5O8CPGYHUgi8jbAWUkfHp3Ra9k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ProjectYX_Free_v2.2.exe
Files
-
ProjectYX_Free_v2.2.exe.exe windows:6 windows x64 arch:x64
a52d8084ed859a9e201beb8f8151deac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
SleepEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
oleaut32
SysAllocString
imm32
ImmReleaseContext
msvcp140
?_Xbad_alloc@std@@YAXXZ
ntdll
RtlLookupFunctionEntry
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertFreeCertificateContext
ws2_32
ntohl
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
mbstowcs
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
sqrtf
Exports
Exports
Sections
.text Size: - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d?! Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7>D Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1/R Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ