rؙ�g(l]@�[�5lU���85`T�5<�5�����f��5`��G�pmu9��껐�o��*�y$��Հ���/H����xj;��7�)�@�I���V+^PD<��UdMi���ˆ] �NA�E�yw��b���O �D��;�k*���*��g�Z���д������hu����T�w�<T�l 6��h�W��q�6a\I+�)x��UF�A�m���O'&j ���d��,,� �n�]<z}����52��%�Z_�=ٗ��9lQn!�C��4��%�Ol0��QR�G������� ށ�h�<�.���b�8��X�#�%F������Ȗ�m���������Is�=�t �M��{;��������)�1ŭ�S���ɋ` ��#���-��R*K����jf&��D�Y����:������GQ��x(!�kÍ̽�'��m���ن����[���c{�����A��[Nh�X����sz.��i��#�9{�˕�yk'ȌR*�og�k��W�m� V�l�7itBN�_w�Ў��!z�JdR�J����2��Յ�oܛEn1GY�!�,;�_����d�r_���=X���j8�Z�S��_�ي��i��S��|$�N��Yp�.�k.w� �7ƻ�s(�[��8�OV���%D��BF'���������+����s�6z�~��&�x.��U.�kyŗv�HYO����!r�L���kɐ�4嗙T(�R=C�[���_c��V`���R�s���brQBڽ��x�\�������)�;��G&���}��4[|�C�Ҷ�Q`��0�$�����kC��p�D@�������X���[�f�D��3N��B��>k>�N��Uɢlqj�Ee�� �Ăv�IhW���u��H�ow�%a�v���np�*w�����+�=0��ch�E ��mq��z~��&�DC�[�JZ�zґ���P��tF�P*3��.�������gpq�'U�tf�h����ȁy��R3R<��fW��|A֯R�6�K3@@M�)$���Ϡ?��톊ቯ���Au3���ɟ���tl$H�k�NI�P�O�8�e���\C��lH�<H�Tnw�Wm��u~e�8oZ���vd,���4:b��$��#��T���aŨJ�j�4|0����jq��E5�[SYr��*��˭DX&�&����_]��N��[Q����x7�;Y�0��H�UM�Q9jw�O��R E7�Ō:�������^��f�I�x�T'��G�����i{�]u���ݿx.�WJ�M���Ju�pI�#i��HN�tc�U�q� `�6��$n��gT�������8��9��@�� �O��4��vC1i4�rN��v�X���)y���x���JzE�A � ?`�T�1�]T5&5[�o���7)��.Q�rD'���-2s4�D��G��֛�()�K�x6X��?� d���_T���6�W��)�J��c�V���Fg��@t�^CD�������!8�7���'��Ӕ�q��M�A��`\Ω��S��v�������#+� ��o�����[Z�str ;a�3��8P3�`���*Q��H����e㍧4ݔ�.�����`�?�$x�ҭ6 ݍ�zX��e�<[ѥ �De- �]�����J�Q�a��%�ߥ4��VS����`f�pJQ1Z`N|��F�/K赚��1-��غ|'�hS�����H��oc�/�=��6K:�c�� ��uB�uOgL�\�"`n��d�U�N��B�6�pV��Zt�%I�Ūe�:+����Xy��&\�NXIfE ��4�K%����#���)�f�V!v�>����M)]>X~���y���D�5d��~S*���%����qI��9rq&��mx]���:��x� �_&q��G0��u���i@'/�HGpppU�ʕA���j銪�JV����-�@��Z*���B����C� �-@>�W1��uמFL���1�G�%��V�� �hp� ��;�`�dJ�T2�[�!������,�����*��^cNZ�}��ؐ�>�rN.�`��H0&� UV���O�=j"�v��?��� e�/�p��������@�����?OӭrY����c+�dd������� �6���A?Gw���Cfu2�Ɨp>ׄ�y�1o҅�(�O.��ᗿ@��J�!����u�͓�PLَ2?2G��S���֞ I�]���2�:�=�ޑ(�D�$�h����m0%�r���DQ��W����"~�Ѹ"7����g��]�l7;p�eک���[��s�Q�8�E�<K鯶밤�*�W{*?F��/�-q���X��X���hnu�������������ܬ�^ܑ���906Ⱥ�iO��0�j���!�6/A�(�=5���{ )��끘k��/��Ч���P�?�8eJRko�{ְt�����~��m���4b'<%���9'��u�n�L�����}��4k �>�!�L��e(q��xL���ɖڱ�P�I���I�e�����LN�7���._G��4b�`5 �*��T����z89����sc��Ns�~`�u#�&�(%GGF������>��7t����9#b up�e�w�B-�����y�Qɾ:Y��B�6�ޏ=��GcӪ����-[��>۹�r�.��bjdL1��(t��}�}菣;��>�8����W�<��u)�r�w��$8v�gR�[5bh��R>E��w��NsFa��`�.��8{y��r�o�� N0�R��t%m�\I �5�P�5ی�KR� ��&�+#���.X��[b�ܖ�Bz,~�s��v�v#�ld��E|[n%�Z�XI���� ]z8hL�m��kh�禩�`h��}���,�=��*�hH>���R�f�N�z�os�����䞩+#�cI�YĴ����Q��#�e�b�Dt�z.���WY½� �K���R�?�:�I�5�n��Va���g ��#��O�B\[f&����'�S:���%TM~:k��˽����B�/w��KiP�� �Ƃ��C� ݷw}�����L�s]� )�֢�irn;�x���S(W^i
Static task
static1
Behavioral task
behavioral1
Sample
SKYLINE.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SKYLINE.exe
Resource
win10v2004-20240508-en
General
-
Target
SKYLINE.exe
-
Size
18.7MB
-
MD5
0184989c64c1046deec45ee6aa8909f2
-
SHA1
35406b1f71252e7c9a1359c45c6ea9361768875f
-
SHA256
befb1da5148bff46a040a55b766a0adb9d92950082c6ddb2a7ce08a94c3a238c
-
SHA512
4f5eb1d1a08c2c7231d168ad55562f72adfd6f2935a45a0bc162da8b74a9a86a14a2b5e46ee239af14505eaeccbdd50668bf04dc04f70b9f1bc510e90fc39b7b
-
SSDEEP
393216:t0ASCYmF6i+qs69d0Nv4QMPBUeGltkLYJwtnclWgaz+i1jqVOzpjC:teCYmQnaQMKeGPJwtc4LSi1jqb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SKYLINE.exe
Files
-
SKYLINE.exe.exe windows:6 windows x64 arch:x64
e2537134cf6f4f8a6b534194acd23c6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
wininet
InternetOpenUrlA
kernel32
VirtualQueryEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
CharUpperBuffW
gdi32
CreateCompatibleDC
advapi32
IsValidSid
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
gdiplus
GdiplusStartup
ntdll
NtRaiseHardError
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertGetCertificateChain
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 923KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.u~> Size: - Virtual size: 15.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kf{ Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..@% Size: 18.7MB - Virtual size: 18.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ