�xb����!Eĸ������7��M��I��/;����o�v�Wʄ���Tn!1���)��J?�d�d�ʖ"�-�{Dz�r����_�������=tIb�ʴT�毬�Ś���� �1[���[Tt"�$=U�@%�ISL���@�f�����jH@N�&��ݶ��g����,�v�a��A"�~�da��W6��Ϩ�S^�YS/�h�� �"��S���yqȢ�'��h��� G��G� �m���oR���7 �0+W���:��4Бѓ�{��%,�tӟ�A�?{�2Z��W�1�:����5/B�xQH������Mډ'(���u ����jhf�*���X�J ��?��^�U�5�6f�Ӫ ��)Yw��E�D��� A;����h=ȧ_���xZ�FJ�w-�O,��[���Q�'��ӣ~��/���#��)�V��b�p���N�}z�+x�K�x�����6��#,!�m�Q������"�gֹ�/���k��K1.�Zu;I���wCM��֑� �����*:[�A�_��<���e ~�K�������G�Ѐ� p�:Mo�C�o;���������K���f��l��)N�_���j6L�K,a/�\>d��h�M�B�p��[U�ji ��;�����ovKв@�T����y8��� ��t��\������c��_M}ߥ��$k;`�5�ds�����,����� ��j���B��Ŷ�\7T�>���}��8Oj�4�?X�2�բ�?N������� >�zdꬺ���K��U�5�����[YO�R Ϋ;�r�(X��e�ģ�{/���z���[G5��'�_$� ���a��K˃�.���}���+h �0_s�T]�q�l�{�Ϝ�dx�1�dut�{�pL2�F���=���q�Z�١R�~��PC�g�����I���x�ƹ�s�`}]'V�9��z��H�(��;�>���������_�rsSt�2����j'����_aʩI�[��\��I`��v���_et���9����T��oצ ��Lϟ�����>�������VJ,+����ZY��^�r�F(،X��Y#�e5zI# ��9�q����So���وĦî��Q���viu�L�*0��ٲ@����S���I"n�x\�oK��*� ��c�D2=H.��ߛ�!���CT��A����gY1�n�m�h{�g�W���6xWj�c�^�w���E�i��8�����UT���{>m4��$xՙ�v��1F�{r��1}���/�9�'��*d� ���UߡF��RPD`�_�'�'�������k�hS*����_��;�⮷v�ݚ]�Dhȸ���Е�����/E��lv��[��>"�&����A�\��8nS��~X��7��p=�;%����X{��~o�劽��n;����c��WC�%J�h,�>l�{��D�O��C��K]X�m�!� �}���X7+�D�GW������������5�S�[ѳX��yҬe��U1��;X6uR'��������>�7HV�6Uj��F,�a�aY�[���|��h��?m}��r�!���p�^-���[�9W����"���Y�F)�H�q�����g��1� ����쩾�l�!�GBQyzf|���F��-]�/h�hm��M���}5��p��k��"��c�ҋ�8�z�ȴ7�L�k.�HX*�J�b���GhP��_ڻ��G���"3���ee��ע�.�c�8��u���xn3���68멘����oHβ�os�ȣi�p���4�V"w����`���_�3��+@'�|2�&x����z`DJm^���E'^-ά�Wޚg�[l��� _=�.�3��u1������r�`q��FG��T(��Y?zqd��RQ�wΟ��.�JD��Dh�VM;[�RfIT�,gH��т��5M�ҷ�.���Dv�W��C���`H�+M�E�z�R _ �:���#����9Y�A�Cx'�Z-_��:���%��K^r�����Z�FG�\'�k#�C��z����O�=�❮3�r[B��x4R½�[d��c�tY���|������M'�e���������#WwI��M��H�IV�S�Ӯ��W�Tkֻ~/k�q����{�:Y�_vW'Z���w]���ܧ�T���4��0�0�K,��+P�^,*��`��/@�q:���j����Ԗ�3�V��N"��l�@���hJ��ZN�Ô����3i:�Xm �����f��}�v=j�>JZ�,�i��k)P� �ez1�PwׁTshȬ�y�����-��W3�"(��V~�� ��V��O A�[�(��-X"�~21o�A�Q~MF�;b��W���^�L%O��Z7�ovo~V�w�d��ݛ�}�]��-����Y� �Ǚ�ļ6�L��z'�؋�KOW�a"���9�o���O0~�4���_(�� ��" ���ê�1�+��`@�G��qW�� {���뚥�B}a�\*���c$9�42��^��j26����J�}a�z���~��/��=����� ����V�N]�5_�jO-Z�n�'�C���ѝ������i?�ة�o��C@��gb�I��L����eBN���\��y�"���&��z�v�dj��HYY�apJ�B�^sp=U�S~⫏´�'���8Q�l�+:{9�IR�u�藏 .[=���$�z�pSeWhVޱ��tע�_g{ ���ՏJ�\��ã<q=����t����Z��u�w&\��J�Z�6�Ma �FTn(��c�mo�i�=��A��O��Xf�G}��+�u!xt�[��-&� 6k�R�N����'Tg�֝��|y�'�2}�n�O$��ϰ����$e�i��sB����������ѻ�J/n�$)2q�x����4tX��R��*W%��Z���Y�lU��H�C(��M����4�� �����������8i+~�h�G��]�8-�"8E�F-}���¥��]�r��b�N�C5�܄��o��{;&�/�)G�o��~�I���G�fW��K1�N(��8����q���S��nx>���Ύ�^~}��&1#��[�pe](��`��Ndk��e��jA{@�dA�h{�XՖG�j��}Qd-��;�ET.n�<rUaԑI��K�O�<Jt�9��aZ6���"��q�XO�YH�%p��C�a�;�/�R�{��,������3 ������VM��3*ς̿ڕ�*)>rW���R��H1^WC�,ҙ�I��lpOZ��n����F� ����ͯN���z/�Uz�4�xNc���E�C{Yj��aJ ٭�j��U�c�����ě�݈8}Z#��0�P��/ۭ�������t�4;:Д��n�}���g\x��s��h��ɴĊ<54��QN�d�y[�{��G6���Js;����
Static task
static1
Behavioral task
behavioral1
Sample
Keygen Xdecoder.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Keygen Xdecoder.exe
Resource
win10v2004-20240704-en
General
-
Target
Keygen Xdecoder.exe
-
Size
4.5MB
-
MD5
a26afc4b230cde67dec5e341aef0e90f
-
SHA1
f5a7a08bbd039184c3e89f4ea4ef5eeb392b5fa1
-
SHA256
567c4101aa7ad812b7bd42d87a5ba7d9c4f82dd7096daa7b079cfa70649dec2e
-
SHA512
06e71d53d1e0e0436be193f05c05c8896e9184bfc7db1842195452d34a8c9a59f26b38129a4216eb301c96e367babb8db7b1e50b2a258acc5f0d6c981db4621a
-
SSDEEP
98304:13KI5OVU8/GsW+exVVxHjkxuiCllBHr8wBY:8Q+Urt+eHVxHjqui+r8AY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Keygen Xdecoder.exe
Files
-
Keygen Xdecoder.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE