�i��m����8]ǿ�B�si^g ��w� *��W�S��[&/*I ��ܷ��!�����naOM�4�i�Z���&�|�f?��&�h� �zR�\���f��qc�U�� �ro��{���X��G�+>Dt���-:��^i7@Ū�C&�q��e*O!_W%u�����V�Z����w^|Q]�ޖ�y�>�����0a���csL�Gw��5���ژ)Y�mh�.8D���g�ͷ��1T�sؼ�(�|�S=���\� Ü6�E�����ND&<fuh��i��9�����(\��`!���D��v��sh�G)�a/)@�u9u�/��f�f':�Z+)��^����w��I��P�L$ͻb��ǹ��L�n�{D¬M\y�<���`v�qoʣ��ц�r��J.ۋ����f�Op��=�gM�g��x*b<�A�5��X�^9Q��U�"��/�� �,i6�W�[H<�͒�A��+j���FJ���_����w�6B��F��7����;�z:���JE�z�]���=W�?ʞW�jqx���fz6��/=L�*�=7@Q��;��=�T�=�jF�J'@� P6M�. ߈����s��Y aт�I�)�����Z��o� nfv�v���*|6>�����+`E ��D��߱o�7eb��p[���28'=WwޥT�G�0����L*������&��b �wV8��X�U�|%�̤�͘k����;�f��ѧ؊gmZ�P��=��o����ػ�X��Ez�dm��V���$��6���~��f�D������uN�y�����#�#v·1U}����'��(מ�m�S!DЬ:�|o;]G>�1�/�M��\���m�2/<�O��3SK1͢"jD���lN�\Dt�a5 ��TJ�����p���g�2|I z��%�29f��X����;�J�85���2� ��=�mIh�0�L�94�(J�J�40���@��E ��,1��j7K���4ٱ��~��d7 1���N�g��Г���L��E4,e���=�.�H�+��?i�EVD'�� ^!z�����H�)J=��Rv��q��g��/�d� �1�}[W$-Zun�� /^YG4��Pc2�-keH3��D�b�_��8���j�\K*} S����k�]����_��eOK����%F��Z�UN�!V��Rv�a&z��V�i] �tw�hW��mCm�Z٭�Q�L��MpB�Q�\ir�43���j 56���W@ږeE�^D��<M��0�\0� JQP �H��ֈ�1��|�4�s�`I�bʻ,�Bh�+L^βA'��Z$m</e\��3L��A5¸ _#t�E�A��C?���e����";�to֠��H���zi����}<�d���lIm�?�5.6�(��� xG�K�%�����-�R1���x)�/�^����a��#���`��q���b�6_���V�ӏ�����GL4M5�O'�Y)ղ����!|<$�ߚ���`bz�]���^�˞y~O8c�~�DL$wøѐ��z@}�G�S(+�6���c�s�[P�VØ���:��L���=˒�#v��C���tn�aYK�59�T-|�&�U�2�7e��9��;�(j����h���E��e������{��8� �����Edz�Av�(E/srx8�v�@����y��r�[X��W�� ��U4���W"�nR'�� ��gq��$r���3Ʊi�x9�h�q%��l� �Y���ܩ�H����rn���؉sd��>O��2�9���=�w�i����,�LP����D��|�2#���DF��q)�2� �wP��T� +��M$ �;�����V<DdZC ^6.��14L�fgY<� >�p5A������-�I�]�������xG4�}V�qe@�<�@���D�{MU���b�$T�B�;�w�>���a��X~K���6��j�������gs� ��[�7��Qa�k$�B�:�������%ˏ#��G!O�\ 惯$��kj��Y�cά�s^�$��zu����c�,E�Bd�X�F�]#�"�_86�_Kݲ,L*%�p��\��Ʃ-�L�h�{` ��Z��0��O��M�6�^j��vp��e=�w:b�m�TM�'�T��e&�s=�������7��h����H���ؔ��#�����ۊ:���`%���w�$�c��\���o�1��{�Xl�9,J2�@n�%M���0���ϰԁ�`@E���>m��UF� �Ӣ!�`�6�����Љ�=�os;�]S�T�%�X�<��s[wGו�ya��b��Oɼ&/�טL���s�u��5�b]�(\ݥ=i�����Uk�@��F�2�蒞$� �5J�]�N��¬ur*�vfΊ�|�6��n�X#�w{�!8��`c`��|�M�E��lF厺ԿW=���?��p[�����{�%��j����iy��*/̬`Sm�O��DnUr�ˌ����J�$���� ��fs�J]F*0)Ktb��X?�?�c��рU�8�~���aƮ)����@�Ʋ���z͙A�>/B��zv���RaI�O���%��fLb�[�� �,J�́� c%�ϒ���+B��NIVuѭ.yЅ��X^%�(��D��aQ�W��7���� �EU&%3 �|:�u�?z��� &چ����-�bL)��r�b�����ro���s�ɚ~>%tc�mՄ0��E��сE�����(�H���xB��Dv��(��1�8٬�"0?&���ۮU���{��)�[�R�H�ʔh�-��if������V�Of�'��J�$��_!��k�ʆx�a��$ A�Sy�ս��������c/�����-���a�sLg}Y���Ǽf���m��!���cSW#I�s���%�e��%W�����q��kS)��` �����'�afm�ċ#FM0*��7���*�$�ge�Yj��M�МU��Z5߾�����f�$�gX}^���]�bߗ�6�E� i"��>q�<A=�Kk� l�п��:K�p���F��ɻ�<9�U�F)�7�X �m���χ{t��85���:�1A�
Static task
static1
Behavioral task
behavioral1
Sample
Sparrow X Hack.sp.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Sparrow X Hack.sp.exe
Resource
win10v2004-20240802-en
General
-
Target
Sparrow X Hack.sp.exe
-
Size
7.6MB
-
MD5
24fb5c1db9daf51a5f2cd11f8299275d
-
SHA1
f81e968acf114a6a1bb939dda884b65064c9cc26
-
SHA256
4b3d8ca3693c0c0410d8e887b80e845b51da8f13161696876ca88c7fda5df997
-
SHA512
8f1fc8e828d8a48c746bfa40a9e33942d747501619713b8c7a228f8008d015508172366bda6055d460cecec08c3bd213ef43e93aadfc1461c07b8cbd6a182315
-
SSDEEP
196608:rL4+FI4dawmT5s2XNTSWsXw4/W2lLIe4MRDeqSQrCBcW7r/:rlFIprNhSW7+5jDRrC6W7L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Sparrow X Hack.sp.exe
Files
-
Sparrow X Hack.sp.exe.exe windows:6 windows x86 arch:x86
7e2a3ead65f24962372aca13051f7ea4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASetLastError
crypt32
CertGetCertificateContextProperty
advapi32
CryptCreateHash
kernel32
AreFileApisANSI
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
shell32
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileA
d3dcompiler_43
D3DCompile
version
GetFileVersionInfoSizeA
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
imm32
ImmGetContext
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
_setmode
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_fstat64i32
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 759KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HxD0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.HxD1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HxD2 Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
��q-�u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE