�"=�����czD�sJ����U|A��0t,gu�����{zS�Jmۅ���RN�\�-d�Q���?C�[h=-�s�`i�\�I���� 5�?דW�4���+�ś�<���rB�H���a`������(̽�<�.��߿o9��Y�d���Z'�G{�%�w0Ε�G�fW}���$R�A�2i�1���{K��U ��(�7o��y��v�0f����O�u(�ظ��t��S� J +��]MKC=U4,�A�W=@�T[�O����)��I��p���D}�=���DdE�8XV"��(��2��?�VT:�&/�|�c�W��n��0Y03ΎϪ�?�qH3)�tn��%�9�w9�;�}�n�xsN˫ʈ8��D��蓣k�#C�x�uYYU���vE�̸ͩ��Pl��lR���zU/�ծ��"M��*�����D����u���w��\�6�İk]���^�����������UL��������q.���i[,�>�2�b�F J�U�u��M{�~�B`hx#X���`�_s#uO.g+����8��@~4K����%#�f�(_�5�i�U�&�FF�3�d�[�Zbu�~���a ��C��u��ۘ��Uʓnx��4jj�R�=��7\sB��b��┭\�����DF����O�J���� ݽL�G���|tc�P����>K�f]���X2�p}=�9��J���i�0�j� =G���}�eK�e�ExP%EJ ������}Qy��9O#���U|&�I2*��R �N�yh�8h���ś�M�~4���I��3�^$b�U9��/>�����,z�v�c�G��B�gQ�X�U�܁���4�~@����q����1e���f�-�X�P|���VKʤ�#���O5�o�|��$AttMI�#<#�輾��a��|Q�D���n��`����b�kz?��B9_)-���,�mH�� 6$ݷk�f�n�$�����j�4�6��s���6M���0U'�����}5�\ƐcǂNM��T�k#�gN����=o���ё4.�)��:�Q�ugЎ a�-��lǝ��!X�r-��ьa%EP�2=�z2�&��#�hZM���#)�b1%�z^�����*� 5�ǖ�`FC)��-w�]d�����~�@��"�PKַׁ*�9���%�TTP��A$����+�90����!hK�B먰쒂��9��9�T�0M�g]9��h7B�NvK�����7�˅�5�^�`�^��Kf�6,D�Ѣ�Amw2OSSb��2�]�9��?à��cFV���q���.�35k�������[i��睢}�vm?=ܭ��o�4� D�x�-(U�;�m�g]�q|3 Ҥ�D�KR�(U�K���w�u�@��i�Q �~�h��1�vp���ROx9�0Mw:<�^Oz��:�����f�1:Ļ7��i��$®A���m����&N�R��bV��Z�i݃�~�{qج ��^��ńJ݂�����<TI.=m�G�� �x����A~��7<���� ���I���L��Mk��)�Pc��,��B��!�Z�;f�uQ����0�w4�h>j����*m�e��4J��b��n1i��M[����՚>�8�|?j3�E���E}�nnN�y��`qv������X��c>:l��K��sr�JNkȲ�0U�^��^���\��!�N�����{�`�$�r�q%:#�:���M���Xԯ���UG�3��m��@���g4.>�Ћ�z�Y~k���uɂZ;�:���55��p�Ș>�R�|����KT�e�?��za������A��h�ϣ�92��<*� �U-��L ���*��7F�����U�و$����g�ٹ�������s����2h@��KX"G!9�����2�ݘy2:k�z\ �ѹa���&(�L��g.�^����n��?W�}ά65�a�x'YΩ��T�b�������ѯ���A�����D(+ �}��vu\�Ӂ��i��I�4�Z�c��;��t(��;rtQC��m� L����cݽ4CW��<"|�EvL �.H��9����"1+g���{+{}�DT���q}v�7��$m�w�h0�ux��l��I2\ss�7�l�͡�t��vnҪk���\T5�TV��R���9���i�yJ��9Q&�?]����W��T�@/�5b��0ƽ���B�(1�`�3����/�>�wahȲL��c��)�e�S�`��`6����z�ӡ���7R�0w�����R[lj�D��6�kD���� �-�U#����&�ymQ��3`��ۏ���� F���J�:�B_Ip��ߐ���B!ˤ4�3�ei��~�4��I��)�.�N�N��HC߸�v ��I�e�cK)pOJ��V�1w,�U Z�KK?|���բ� �x�l艞 i�7n;�k�(���1?<�P}�&P� V�O�;cp�n��O^H��&��(HѻjSD��b�8B�O��;��`v� �3z7Iv���17���s1�~�)������p�_�Q�L>�\( �z3�]�;K;,����"��6�.��x-�WQ������й(UA 3Wx������*����k�Ӊ�����Ю����!�{ @f�ԉ���fdhs�(�g���B�n-Z���b�Đ7J�1��rW���\N�ȷ*�Th�>���\���d_�f�s�v+�9r4%�մ�c��@�A�nF �N�t�#c�ѭ��#�9�Q��ꙮ��Wz,���ș Zp ���Oγ�Q<s�����m/r;ܰ��:;��[{v��O��?ŏ� oҥ?c��/y�)ԇ~��[�����5�y�IMx�҂r�!���D'�-�w�������UB�@�H&�, �Ǹϕ�f����.�W�W�"� 1�JN����Y�3dL����M��n���P晘�`WNg%�vג�(Tt��pbJ�/����Z�����B�)�O���;3� �տ��&B��r�I�hݴ�V���wGL�)V:���ӓ�I4u�ZY�C�I�{��e��#ԏ��G�c�G_� �d����'U�·`\��%�m�Eĭ��:]e0 �o��֢�KFra����a��g�3���+
Static task
static1
Behavioral task
behavioral1
Sample
DXII-PUBGM3.2.exe
Resource
win10v2004-20240611-en
General
-
Target
DXII-PUBGM3.2.exe
-
Size
23.7MB
-
MD5
db5d28e5bd443917edb2309d3ad89777
-
SHA1
03ff2b892564ea40442ac019f48659cb3ae821dc
-
SHA256
a1923c782fc1df845ddc0ead6b74ee7db2e06a8ab374e48ca99086ed7c9a6303
-
SHA512
3e12f49e4658c2a02f36b89331ecb27db53e1fc9e5aecd738a95640cbb8dcb593cf93ddf479a52ab9d4df854a9c7c1c45197e8dee8a53926f84e03d6f64f79a3
-
SSDEEP
393216:RAgzd5u+ZDN8ftyD9zm98xOMM8ZQMpauF8/gPDO9B92G3W//GTHT7F:Wa5uvfMhzdxOkDQuF8/gPDSuuTd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DXII-PUBGM3.2.exe
Files
-
DXII-PUBGM3.2.exe.exe windows:6 windows x64 arch:x64
a908d5a7183ce9640e223b6096dad19f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
accept
wldap32
ord46
crypt32
CertEnumCertificatesInStore
d3dx9_43
D3DXCreateTextureFromFileInMemory
d3d9
Direct3DCreate9
dwmapi
DwmExtendFrameIntoClientArea
kernel32
RtlPcToFileHeader
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetActiveWindow
CharUpperBuffW
advapi32
CryptGetUserKey
shell32
ShellExecuteA
ole32
CoCreateInstance
ntdll
RtlInitUnicodeString
imm32
ImmGetContext
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
Exports
Exports
Sections
DX-II1 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DX-II2 Size: - Virtual size: 20.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DX-II3 Size: - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DX-II4 Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DX-II5 Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DX-II6 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DX-II7 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DX-II8 Size: 23.3MB - Virtual size: 23.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DX-II9 Size: 423KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ