ʚ��7`Ӎ��#��w���ܕ����wg����ī���M���=� �����jڏ^r���єg�{q�o|s.�-�$�Q�Y�a]&��t,��݃W����^Ԓt�@�� ]�u��6��a������Z�#��|<t��7ŧnAӻ�f�$W<Kq��Gaf��G�cT����;�8-3��=� طו�zԅg����ǘo��Z�@ �Q�ec��]]��,��w�*:��W�VՑ�qO7tfbe�Xo��fJB�&�&z�݁u�/Y��-�������*g�� uL���|bQ����7��9�g6��-qW?��5�5x�Bƍ��fW��e�&Ҧ0��g�����dM"��H]���33��z�����/so��/}w�"}��M���VR_p���X�/'|ʟ%�]��ӥ�є�3O��.���F���j�ƾ�v�t��yQ�5�s�GQj����nա���?p*��r�_�?G���u-}�BĪ���<y����>��h=���H��x~Z��)����P;���Ѳ�����u!�DXТ.0��X+�#��6d��p�!P;p� B�DF<����\�J��u��@X�f��rm ���y�����G���W_��� N�h�4wN�n/�k-�)9c��������6wgE��@������y� ���ͺ��A��l�'���� ꧦ��e9UPRx���)ar8�`9���B����I���,L���� �6�s��y�������}��#.�?n����Xx��^W��c�͇�c����h<�s[#�����j��Ƕ+䙧В���j��)&M� �T6m7����LF:=<��iO��VE�e![�q)��EI�.S1CvJN�s+|��ry��iѻ�9��r���f�J����>��C;U��̳�op�����K[���z��K�!��p͛��ai=s�0�nm2�BL~�H��їx[���$�p? �Emdh?�p��Q�l}`.�AqS��փx��rx������n�앇tZ�[)�I�}��A<O9N$}�>�4��<[[�r���K���1����X4k\.^�`�h �~Š�qIY�X�ay���@��7P@��*��h�����v��U��W��y��R��{�h�e�~Y)��Rb`\@�%��gf�+��|����I/�˻Ai�nvZ�����k��}T�g��T�憮J�����ʽ��� Փ3NC�&c �/��L�V�֭�A�=��&�/H�/��8&�XI74f�=���y�LD���4���8�ԜOt}�`�p�1���e�dXo �����ƛ?���"PS-N��y �zp��F�R���ˇ���w��ַZ��S��@9�Tũv�9(���(R2�2͘�!���CjN�ap�?C��I���洰�\'�&̺�։�om��yz0�/y��D����+(�XU������PXޣ��Y= ���S��I�->��Q��Cн5����� �v�;y�zL$�hd FV>OF �v��?� �v�>kz�<��1$��Mק|0���n�࠭&%��Br����c6zY����f���i�O��Թg�=K��z��l��\��Wn)gݹ�P�Q�<,2<���b�h���*��T@���4��&�֕��� �� t���h�}�:~�:謦�qԱ!*�H��"�;��+�P*�kWaƆ�O�]�Y�����U�(�w[�L��~�촭��n�0���{�"�����L�)ؔE�]f� 㴑x������h[����B+���YEeu�vi�k��+h��� [��5�K����� ?��4��u��S3T\�Hw��#frG0v;��3������1�ʌad;ˠl��r-uK�T-N �T��q�S���綀K�r�<�Su��7����t��h���|�#^"�/e�hw��g��n~�d�Wܠc|�R����/2]���]H�����7X��l��� ��I�bZ�N��8���j���lh��}Ph�IjG�?w$L�z$�@���(��+���X�}�Z: E =p��^��.Б|]D��}H�j ��m��Z"T&'�W¸�B�hS��u�<B�h�DEc[ &v�x'�]���M��k�=�E�Lt�)�=7���=aW�s◁A�v�R�}�P���ѻTcR����1XT�y Ȑ�@��6}R7��\O��_y9�D�7{��FK0s5`&{C���2u:���fGR_�Ҏ��r��A��y�B<�G��<oyb�`Ȏ�9�[|�C�p��l0Jہ l�B!e����qL_���&��=��h|F/Q�`��j�y]�q}������E�m�ב�k/�wm�l��z��Zm�*r���/@�ʚA�e��Ʈ�_$I>H�wvLvH#��F���;����?���ү]�maܽWs˸ڒ����vˋ�tgz���̵��3�����*h���W]���4��^�������� 5��f��� �=� @|ǝ �z]�����uRl�&X�0�n=8��^�Bk�^2j�r71裆/��K��U����O��c���S������ϱ���|B�ٝg:-c�v)�:o"�E0��!��mL�жt+���C���G�CD��y�Ha] �I-�� ��aS�5>R2ɣ�&��+F� _u�>0O��,����w2]ê��9����Q�L���[F:�`�%�Cr�G�L>�����/S����[�TN��W����j�h�.�0{bn��v��Wr�U:q�#ӵ����z<D��1�V�#6J�r�`�0�j@��.f��A��Il�s���R����.�4.���̅��ڱm������J�̊D\�{����?OZ ��a�<2��"�tT>\�|���hY�r�����m�S�/_;Af�� 2^{;��?8�O���xԼ@���UX���|C�t�y�Uw��>�h�> ��9�g���H%w��"��ܞ��uC�����z ��B[q��3��I�<�oT��� �㞮v��w*��1#�-dlN�-�3F���!`|-�����r���m���_���(�����R�3��-Ń}��ه����}��z3_�!2��t�⭔��(���Q�ޱ��
Static task
static1
Behavioral task
behavioral1
Sample
Kizune Free 3.2.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Kizune Free 3.2.exe
Resource
win10v2004-20240611-en
General
-
Target
Kizune Free 3.2.exe
-
Size
40.6MB
-
MD5
12261144d4bd4c1f656a6be3ca2321ac
-
SHA1
a92c74073198a678444bcdfbeed66fe69f2883ae
-
SHA256
c2469a2c722ec435378da43f764a07815360724996794614a595e44b443491c1
-
SHA512
1edf7c26c299fea83faeadd6ae88443894a0430b04951f29898e3d7939aeb6e03ee7144513a49d66b0545e7888fdbf76f9f56c659c6108d3b097d5a08280a979
-
SSDEEP
786432:RY2fkraPHTsprI/+E6VqTIKgOiVhELHgtiR5VHF2XPA/ab5:hf2mY+/N6V6IKDehErGiNF2X4Cb5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Kizune Free 3.2.exe
Files
-
Kizune Free 3.2.exe.exe windows:6 windows x64 arch:x64
6f5cf99d51649c7f066a8b40600def32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
CharUpperBuffW
gdi32
CreateDIBSection
advapi32
RegQueryValueExW
shell32
ShellExecuteA
ole32
CoUninitialize
oleaut32
GetErrorInfo
msvcp140d
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
wtsapi32
WTSEnumerateProcessesW
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertGetNameStringA
ws2_32
WSAIoctl
imm32
ImmGetContext
dwmapi
DwmIsCompositionEnabled
httpapi
HttpCreateUrlGroup
psapi
GetModuleInformation
userenv
UnloadUserProfile
gdiplus
GdipGetImageEncoders
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntryA
vcruntime140d
__vcrt_GetModuleFileNameW
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
floorf
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.)\Z Size: - Virtual size: 64.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.P4k Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,y} Size: 40.6MB - Virtual size: 40.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ