��(��_�����`�x����M��i1�_@������#iB��H�φ��]�K��t��������؇?� 0�6�� �k%��m��]t�1˵���J���ư��I��# ��a�oC���:���4|x���i��+wF(c,5��a��~�y���Xf���=+6� �(ğ���8/�l ^N"�O��R�m��Zѥ�D:�4��s��V"�f��t�ᾳ�= x/Q�'(��v`���8d�B�.;jb{6��`�lj ���e'�+�i�`+�dS)��7V����������+�<��N�W ��}���7zN�q��=@b��u�\K['S�z�da-T����Γ.���/;sCzjs�ge}��L��:�'Hh����e q�)��<�S���A���C�[�Vy�T���שa~�֣�-٘t����c��Q��D�@bM�f��L)I�d�i@vD]�Fe����j�ѻ�9N�L��&l�����}���&q��wu��a�)^$�Ҝ��?��5�����3��J����Ŷ~�]sue�(��ؕ�(�|��� ^����T����������-�)�iYZ�'P�Wo�b�I魊�����t�a��*�6#S��T�'��3��B��l5> ���c�Q�+�����?�σ?��j�2k� �qq��!1J�l�d��c�UU$P3v64)�9ͤ��G�b�-qU����EN~������f�Ъp���Z%k�i�6D��|��B��up08��S�ATK�1=��>��/p�v^̩��,����5��Ef+++�2��; �8�urS��DǐoH�����D5�A�,ʽW��ܓ�'ކX���3�j����X��Luh8��U�����O`��σ����F(|Mv���;gpy�03&]�Uf�.�����ϛ֭�oä����NC8��n��\ʷ�;݀�㇙z2i%���e@$Զ�-����y��A��w��*��q��}VҶfu���I��7��;���Ym;6���x;Mc_���*+�.D��<mg��������+���_n<3F��7ݽ��f��C Y皃����6���m���m�ָs*��g̵j�[�&�ϥlG�(�&x��sr�?9�u��,=��<�;�3���܍넿j�o)�5� �N�bW�0��r��W�Aj�<o=0d��7������V)���&.xO��F���L�X�'H���R�ʨ^7�)�`��w�LO��PtC;��>s&���N>?1���[�@D�����v�ӗ"�di��g����ɯ���P������~����o�v�at�p�� HvU���������)���(t���;�jP�`�f��5g�f�� �3F�h���9����۞���}��"V�yp�sWP�BD��V��(��1�fmY�ؔXg�&���=��q� �zEϜ:O�t���"�f�����V��A܉�z.Ax�'އ?����A]��曕:�D6��%%�z]��� 4W�ǐ����.�x���sF�k&u����V�\D��SN��]~Z��>-<;ηW�s� �gt�������Ŗ�,t\Qf���:���崊���d�!�1k����L��p3�YpF��.���CI��s� ���-��T)l>J�!���yb:����0�x��I�A5>� ���/^7)L���܍p �-�����墨�{� ���n䩊_a�VWI �h�T��� �-!jP�;AB�S,rK:Fv���� ���"��& �_P��B�?bQ(oPx������q3$R����v�qH�6�:�[ ���1�ć���(���ePMӱy">�y�.jK�^�</������.�Z�|�s�x� -RM�$U�s�@���*yX!c&j�,�t�-�;K2.�0�|��*��s٨��`�DC�����(~ 9�`�'lI^E_�,D�.<&���\���H5��8��^h��m��(u��M-?;�K�oQ�=e�|���{�xä7�}{X���|ɴ��a��� ~Xv֗M����e�g<�̹.�Lj����+�ʐ $%X�>u")�F���t�洗A��'[�p�����j��w;�w�lZ◀�o_�5�δ;�(8y_m�g����>Tu����+�Q�#l�1���7���!5T;���1Yk�����r*�GI�)����}����Ei>��t����ݯ�EBQ&�Z�Ά�d�4�C="V��.�"%�J�L����3O��fl?��9%i{����3�=]���>����M$�wkɼ�́<��tI9��z�7�Y������l�DPkf�#�� p��_P���0/$�QS�+�K��w�&,OT�F���t����ܙ����ӨB �O1�L�;]�2�b��ՙ��S�\K-��z��g=j�Z���b�7D�tʧ@2��g��]H?� �FQ���w���\z4�d��J����8����@\��]�4G����5C��pE�e�����'j?go�� 2ʛ����c#ŏT�L�%y��P����7�~^1�1l%�>|�)�ݿ��)�|sË��(1C�ƚ��I1a-�⮞�1��_�� aK��۞r��"����l���~;����_���0�{M��'������7�7N��d�SC��v�<��e���ΡF[��x^U 6tT��*h������V>#'3rAR���(���W�,���r��0Nv�h6��Pr��g4g�������ɼ��h��4��s��M��������0�����s��� ��x�}���`�����y�>��.;��F�C0� �<�>�Mؚ� ;yu�;�ʙ�]����N?J*�-��C)�C����|��G�;_ժ�����\�ƛ�҆�,���ڇ>F�7��g���#&z�M�~è��n���5ﳸz�Z)~�V��}1g;㝢`S��0�X���Ű��9QD�nߪ�א�{�(�&�1��m�Q�V���s�i�m\�Z���.�w�c%ǯ1=dX����4w�M�~�HXt���#no��# �-�vl�M]�g���� D'�D�� ���.����ԃ��ݝ���
Static task
static1
Behavioral task
behavioral1
Sample
utorrent.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
utorrent.exe
Resource
win10v2004-20240802-en
General
-
Target
utorrent.exe
-
Size
5.5MB
-
MD5
b4ef26cc5e0f79b0bd6bbd4ec82724dd
-
SHA1
e649683bc7c9b96f917f4c5e569ab1bc33ad85a9
-
SHA256
92121d5d4ae82354b3e00e85b4b776456b13396c1572eb11f0dd96c04e7bdfe8
-
SHA512
4f56a61cca09af33c06868e4de85a9a6067750e6f6711071563f43eaadf9a796c63b16315cc6e73c5a55d15a26d1184c7cc0cda25af3b6f93c79026c8e3b161c
-
SSDEEP
98304:wI3UUZvwlsxAH02c8FM1gZf8d8mKpTqyf/E8ckaDz+gOKtGCidtJ9z7+:V3ZvwltJc8cgcfknMtMT9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource utorrent.exe
Files
-
utorrent.exe.exe windows:6 windows x64 arch:x64
cf97793e374e6bc8443952574dfa52fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
advapi32
CryptAcquireContextW
gdi32
CreateRoundRectRgn
user32
SetCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetCommandLineW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmReleaseContext
ntdll
NtQueryInformationProcess
shell32
ShellExecuteA
bcrypt
BCryptGenRandom
ws2_32
WSAEnumNetworkEvents
crypt32
CryptQueryObject
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 886KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gay0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gay1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ