��nA%�E���#z(�*:1�L6��- W���"�u�F���ߔ<p0�qǞp��M����U=!�{Ͱ[y~_�IKm1L�\��QS��"��bO���հ��Բ1���W)敔��C@�]c��l��k�2����b���C%�����D�ף� 8N�6���� �=g��n6�O_�=�t�a��Q�%O�d� [=��:,�̑�jS��ݻ5m��|�Y���rsWK?-4�"�P��D� � �������N�RD�?X�EKfy�tV�l#����b�Y^�}������-��F�>u")��Nv���Z�md�W�X��<<�j{?T�z +��Ӳ�����)���Ө&ʏL�ާ�+7��h�-1��`�$*�.j�(�ȩƁ�p����Pœ�.-*&�*k����?y��x1�����B����?�a�Gql�am���:$-kNҰ�����}��u�'����z'�/�`��z2�[Ve��X����twu>Pt�ږn�(~��a�l�}��͖��d(�*�[10'��ѐr�S�Lh�m��֝�D�Â�}�"!���Y<��J�����]Ҡ�cp:3vI�r��oeq}��jB�a���b��`o������Z�#���D�h��G3g�E�l�(d< ?��ч���?�G ���TĦ��@k��%������}�8�b�����|�X_�5�B��Cn+z}`��6����Vց#)��;;�A��+[���A-��cA�ѫD��C~_�����CS������|Ņ�g�X~��>+}���.�8]�p��N����.�[���3�1`i��ep���8..���GY�@�����n~���d����e��8�CMɵ����HX"!r�Rn�>̞�)$q�z2A��nS���}�ʹ�"`g�T�O�?1 �ls�����i\�l����: ��D'/���]خ���#����9��g���95�O��D��������{A@T�^d��sRɜJ�k`��F:�����}����5i4E��=$ 9:�ȍ��������|3��B/��_ 6k,�5���p>]G:��[��n�< Y��T�ӡ��G�ѓ/y0E9��5�z��Þe�orjsZd�^l\,D���ʛ�"�����Q��Ӿ7 *T~�<_��jLj�Y���.~Q���I����j<!�0>�Ew ���=@,���8����g(�J�����n��������kj�j(B8�I��l�4P�L��e�z!;���.��r�nH�k�jn�F�8�s��hַ����@���N���rJ�.�m3Q�d���8|�N?��Ib���+k@��vX&������O}-�����������̅k ڗ���k�1�E���ap(�t�� j�ꌞU����^!W.9� �F��͈�RkcSO���,����h�I��K6[z����,�k����n=�m�BZΪ��|T�0����2�1Ä�ɧŕ��1��Z|��!R+S 9&�q�0�������>�thg�S�l�&����o���l>��w��Y!A)� ��[��\�S��}�_��D�����BV������!�NR6(zôP�[nM~ &�$LK�J��i œW6C�����C���{Eט�gj��Sk�ӌ����'��yk�����]�� G�ɚ�v2��9�mk:Uh=�����K^8��(}�sRN�ߛ�Q��UR�&�*�_� Z�.5]R��u슲Պ|��� ���N���m�s��ȌsqY��`g -��;�*%��4�s���5����f�"���$����#%�2�Ug\�y�=��s�H�d:�����}Io�`X� v�]6�4m�wnks+����^��x��G��Ι"�}͕7M:� #-����|�"y3:FՎet�����i�.q��l6u!�8��)]��)���'!��|���v��D�&�c$<��]�xҏ�t��?1����$6s����~���CJ�n34sQ+V+&��.��?~���� 0cXͻ�XPK�_��T'$A~HF2i�]��A<�n0s�H�}��V=p��X�����vp�OW�{Z�;Q� �D�y����t��p�$�;���a(���+"V>Qk_�?d����i���G`�������#mk���� nXɹ� ��u���h�B�jH���J��s���6�=/�_��N�����X��5�|�>��L��y5��e����u��D�.�.!Ց��KG&�[U��iO����+D$ĭ��'��h�]t�Ʀ�q��,��h��t��!:� 0]�o��B��K٢1�m���~��|3̓ʓ���;�ߦIK?�9k�pn)I�^?Y��Z?���hY'�Y��e�FTc�~Ul�8��ug����32�҇�8��!����4�w:>�A������1"B� �Ae� ��f�R6"��!ߺe��G4p��������u����5���\_�0�S,�w�\��3����[�A����af�����bi�ե/f@�#Zf�ñ9��+tEĵ�#��%��'JR@̴W��L<���q�.0.�?�b�%n���:^�po�d��� I�lXy*iS}7�z1l��� ǥ|k�S�]BKv.��2O��ZS�*ʱ-Kt .��';��prl��QS�U�~�n�q��z�}{�{�t^2�s]�!x�ѣ����J�ܤ�MQ���M��u'(�y2�K{�-8c�4���h}0�C%n]��)�ٖ�j��>��0��:ʨ�[���>�Ia��P�5"���A��Z�N��"(5����ك6Bs�!���C!0ˉ�m��6C6�!��tz���H0�Vxd ZW�A6&Cg��lͱ����J5N��I�X��g(���߯�c�rԼVLK|5��Zޝ�ڮ}Qz/袯�l�q�[+t�u�)J�������ڥsZe-i\'z�M�c��$�g*v��0Go��rk ���n����E����`���{��u��.bw�Km)&�8Ldr�-����ai�EI������~��Ηጹ�&/1�0K�3��8�u;��꼀��h:5GA�7#��%���y��/;�pA��2� �Gf5|F�LDv�o�����p��v�
Static task
static1
Behavioral task
behavioral1
Sample
VixenFree.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
VixenFree.exe
Resource
win11-20240802-en
General
-
Target
VixenFree.exe
-
Size
5.0MB
-
MD5
d01b973626d00211d1b261d8f3ddd52e
-
SHA1
bc39e4337fa6b8e8858f394c21c7daaf82ab6e01
-
SHA256
f0ce3f4bc62c51f8c5a778a37053c004243e844b0d76689279c5b0b5795929b2
-
SHA512
569a437c36dfefd9f130608178caafbc3ce4f24d1fb797f1245b470c480473d4fb77550e98fab3614734e5da7ce613856667afdc01a15fe93c79b86c7a0f3bbd
-
SSDEEP
98304:R+JOLQFh3L9BUu7jTetDhKQA+uNr/vjpbO1YYpagMp5s+M0GkXUFM8:R+J3JWu7jQDvuF/vjp4YAf+MJJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenFree.exe
Files
-
VixenFree.exe.exe windows:6 windows x64 arch:x64
0a82e4b2062ce84249d05f40239c8ab3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
GlobalLock
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmReleaseContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
asin
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ