�j�Y��6ދO�-g���݊������i����gL�d/;�x�9'���������YP���I�9�v���i���ɾvlY����0d�w{�Z�γڽQZK��b�#&z6.�yD�*�F:�¾F�:�F5�jfp�f��Teq�0:��!P�M��Y[�B�����RH�.�S��0Υ�o.z�`W4Jkp=�J8˓5&]�kπ��玐l��{����A@8�O��!��͂@� lu0����L��TNS�P�)(9\^x��QX���JZ���M(���}s�N�]C_��|]� ���W��}i�����]����AX��DY J��f �I����MsE���ˬ� %V�gE�D\�Z�:J�4�� l��(3wry:u�Cr��h���,�}��;*Ĕ�^���ˠ!=����䰢�:�6��O9{��w��.CNT,�U�X��eA�T~�A�i��jS@�]b�}�P"��i�{&R�̢���D0FY/�(��T��yv�,KZE�a��gM�Ka��Δ@����X���/���6H���n]Cp���(E�c������m2���Cw�oL�v���Q����iie�$(L�5}+52��}�,]n���¯o/rCf2��KM��R��UAۧ���" Uv���A�d���HĦ|�f��Y�" ;���.l郈������O�3u��b�ߍg����?�YwO(fb`}K��%�bN8� ����?��E�� ����C�_xP\K�e�r`X�a�4l|$T �@����L�{��=��z�������}j��2��%��c�t9#֯+?����P��d��-wߺ�?q�����< GK^��̊]Ě,�c�?�j^�m�#�h����K����e\��*�����r�9��g�Sy��kv:r���4�c���pG������o��"+���s�-z}zNF$��9Yvg*�=�L�횰������GRbu�rz�B�P�g� ��[��9�Ogl���!��zp*�uߓ����Y<<&�V � k�.|�a�fc/���NY�F��$,�HΣ�A�r��lh���&�jZ���?���/��d�9S�w?�8#���u��bX�D��i�3�x�;����@����R���oa�P>���Ѧ���S4�7 �d6sc����/d�P�w&���J��t[Pɞ�J�@"���( �ȝ��[���e�E�<�yڼ�ex���zCmx0�I��*=�<��m�5�xJO�t>iƥ�z�x���q4t-���w0����H���D��XBB�ُ㖌�ʆ��r��t{C���jT�/��5$*|�������?FZ�t,�y�j���!��ܺCw���Yb4Y9���g�}�:L��%뽎YY���,�C���-�1:�U+@Aa7x��氝wJ�뜚���O&�u��8 V��{b�I��Q��8�Gk61�m����k���;%��?��AҤ��ťkm��/4���Ƙu������\�M��k#!q�N�8C4�R/��S>q5ffX�1�)�N7�rE��I��v(Q��:�ԜC�1م�|p|�D���5��8Fʆ-[$���ja�>�+�C�D�� 8�{�'EZr�#�Wh�C'��[�W�N��в������4�_�Υ�F{p&�?�Ϧ�C�6��ȋ��nE�\��v��5�6��х7�mV�%S��J>l���+��)� oRU�PݠQ��'=�o����H8�PA�D�6'�ښ/���v挻tBG���� ��W�촒���`0�1I�ƶژ�`�v���'��s�����c[�� ����+����k�Ή��a�DN!��c��-�j�ԣ�q{��@����/�Ȩē\V�0����F�/����NRef%�}\���L;@�%-L����2R��$$��Bf��o�����h�o6���&��Qtć�t}~��q���By]b���M����EM�O� Al4�p1�S�����P�G�ۖX��h��q]�D��`e�A�QC�L����|T[��[��Y�������<���v�v������A��p���tR���Cmc�={��}&� Ni�0�0�Ȟ7m4� ��|��� �)ٟ�vPg�-�d2��� �Z�ʩ��� �`mr��-��P�8�Y��e�����r_Ã��P֎�X��K=-�K�jKF�������I�F������ q��a��:�|>��D�>�4����P�e����l���0P��%M��t<1b�&:���8���\���ͱ�+� 33)ȗ��Xf}ʼnժ;ߣ�'y[� /N�0j_n�ͼ���������禭�-��sQ�T��Ф�/Y ���t���hf&�x6���Q��P7Pe��Q�:���)��?��Y���z�ޘ��M"�#nnQ#⋄zY�ҢOW��Y@���6�, 8隕#=��W��:3��Z�.Fc� �Ky��^K��dJ��u(Fu��;ǔ���et��E@�h�=��E�-�M�Q�1z�}; pOTͭ��>'�H�P34: �?9a&_�������m}�q_^�k�-e8�� WWvzQ@w�$�� ��W��Ĉ��8���ް�a�N�U,!��kDK#-�<C9/U~����I�ԝ^Wa ��B�Dd�X�(���~ ٷ�S�g"���=�62[�3��OɳִL��'���}7@�3g } ��cu��]��� {�C�ΐ�`h����$�'�x��)��G��N=$K����ȩ/|��,)��㰱�i~�Ŋ�lV���v��N�<�I�n�9�P���~S'���U��a�����&��4����O�5��z�l�^6d�~μZ�9���G�/7��,�^����^g�3h�Y.i�)��9��bnP�X ������-�{9�w1���t�AV<���>� S������6��-�h��'��t�M.k쥫���B�W22!��G�M�M�D���-�.a�\�!�����i��oj4d3R�>K.�!G�� ZI͋���3�e��r�j��S[p�X"�$����q�w�$�����Wg��ZZ%`�v&ሤ�nt�{%� m���:���(������m|,~��Oskm�kH{�
Static task
static1
Behavioral task
behavioral1
Sample
VixenFree.exe
Resource
win10v2004-20240910-en
General
-
Target
VixenFree.exe
-
Size
5.0MB
-
MD5
aa6aefce36b58a3b1b0326ff2549fe84
-
SHA1
ff9a6dee05c527b0bf341b3241af73a31d05526f
-
SHA256
dc2469812a57462aa19282c9427047cce087e4360966a8fc44a8af247a898eae
-
SHA512
99801389bc1920a14374522d550b3db5753835fba7c53c14cf3117ac03744ef5c735dd4f9aa707b7dfa6200c134f5599214a5f97cb032f0744bdbc62f8357628
-
SSDEEP
98304:9WY6h2+UuT4WfOjqYoIR5FG+OGTebIQoH5neOSzbjcfcd0v/DIQ3:9uh3UY1iqYoIDzTHe7z0fcd0DIQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenFree.exe
Files
-
VixenFree.exe.exe windows:6 windows x64 arch:x64
62c353f2f08c4f675fc4ec7ad579cb66
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
GlobalLock
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmReleaseContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
asin
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ