`g1,p����'�E]��7��z������]���gW����q�9�;��0�"�#C�dj��Z�y�������ܶ��+��Aw5l���<<v��ڸ�%�ap� yܣ�-#�ܨ���->����Q虲�5�I�*ܘ#f:Pˣv �.B+�N�`9uq�O��*�0��|8|\�G)�A����S:r)Dry>��GA_�� ��� ����\ltv��OPs*�ؓ2�-��Y��.��̔����ǂQ��|U�[$4n:�q��XZ+S��t'�����7�mվ��߷ "���vO*5�����ͼ������*X�4�;��|;�(G�>��Kx�@��G�?+�Yk�o%R}�\s� k���m%xy�j�ȤJ@�LkӣOA��$��xv3�``^J���J��rB�2Yj� ��ţ=�ӒB���#7�Ѷ2d�D�R|���j]��Ӓ�����7�m���b�7�C�4j����Q��}Yd�E&� �{�}����io���&˾F6r�;=��2�� G?g(C��<Jqٵ�R�/x�iW�l��hzx�Q�Am��higCUK��l��OnV@�p���_�M��J\�Ƽ)7�BS�<�l6=��F�!�����7��8����R��?��k�y]�mf�奺��ŗ�RV+)����1?���7j�Ô5�C|Dc�E ��X����N�1;8�g�K�S�EQ��k ��A{�L��M�Y�����l����9���xP�9�,�ib�����%�uRHlD%[��S ��ܠ¬�_j`K�[oLfQLŌ�d�c��U�2Q�`�xL� S�� �9�B!��f��ܠJ��Gl�Μ<�9X�����e��Ķ5��s1�f�1�ĠV���ʇh�о+�s�C��(�Fh��n����8r���i�G�01U�z����E��������*>����rץ�4,��w S��0f[�pڨ!�6ܟ,Y( #t�inM����uU�<a~��ۣ|]��s"F�>�a�����z;��pQ���3^����.����� ��ㆮf�.�_襙b�w���R|��o��%ҡ�|˷�_� ��<�\�N'��%a^����ɦM��Y�v��{�pRN�[R���I�mD(�ҿ�a�z�~���:�N���Ճ�;+ Օ��@R}����'��7k^�TA��� -�$l*?ޭD����5�!k&��Ү���t��Mm��A!_�����NY�s���,��!':5�y���� 4G�)թ��f�{�I��w+n��%��X��o��<ʕ�9z���+����s>st&yv����"�E��=�D}��,�r���\���5�UG�sI�V1a�`������������)�7j�� ���h���@9�hw�uj��:�%KarJHL�T'�C�&~5{�[�o��U^�2S�ى�OQ��m u� 3"��h�� ����(Ů�U>���X��V�mht�t+��\���h��Ŧu.�C\�o�FQ�p[�C��������$�#��#��i�b���Ձ��)�8���~�=���`����!b��g'��ǥ�Ny����'�����P�o5N7�I��[+$1Y��ԙqJ����S�,j�3�b�n�kk<[{2Ne�(�����HF�����K}L P�����z��W�r8�!��ě\1vu�aH���4��I{�;���jo �D'���e��V@$c�3�H4�0W�0�S =�FM��� '�ޢ��/!iY�����E? �n� l$��3D9�K��]�2��S�U���Ux��b��du��zK����{������hW��^�2��<�"���%��X��mOB`|��`ٜ_�H�yؗFÐg�zaw�y�m�6�����-[����b�>x����,�ZÁ�y�q1��R��;|��G������?ۃ��æ�rJ�s��l����.�A-=d:�c鉸ۓ��o)��H(@]n����i�8 �KOuQk�%/x�����s��3V��]�j��[Ŷ�����hc�#�)���}��K"_am�f�����j����t���*�a��R'e���v^#�Y���z�d|2��8V'S[���l�mF�j��5� ��Н���k�C�2�����h;���4`Fw�=����ݮ��>���G�y�Tm�M���,!�˗�D�X��nz���od�+$�I8�T<�4�I�����K�Q�S�1��mtS�N ��ƻ3�l�8`>���9��k�5����5#>h�U�� &�~��d��Q#�]�J����q�'�\i��"�"�*�d�+��u�=#o;M�s��S� ����q�F9-�Z�Xp��>ƀi���>��#V��z'q�ш�xww�����<�Ɓ��$��.�'�]���/s�>o�R%��g�Ix���x@^-_�݇�{ʔ��M�kF�:������O��.����X�}�Qv&1��T-D��%��w�a!f���z��%�ї��kw!$&��ځL�k�14v�z��9�1�R��o%Bs����J�&�E�`X�d����)yN|�"��S~�}09!�:s�{�� ~�B�82V|H"0�P�����A,汚15�2�Q��?���8�'X2 �h<�CȌ���?�{�F��? ;���8��c��Xˬ�z��F�.S���7as��0�`5]�秂�apBٷ�|�M���� �wb��s�6��~:Õ�̎��n2����V x1/��>7�&��"����1Wg@�Br��������ۖ��j�!iT��^Z����ҫ�c�AKΦ\��i�B��ɼ�_����� 0 ��%rʞ}�^�.����I�M����mE��`�t�����gg��E���).<&�$���;�b�m��wyoc�-�q7��F5�!]-Fd��C�=ޔ���Eه���A�eKR���O���$[�7�+Dm+�����!g�V��y\�/�xt�#�..6e n��yP�!j]ڙB-6~��naL�3㟃��E9h��.c`�WVp�D�7�P+��9|dT�/\d��W�KP�m��=�Q�0�~B��x��U���ޞ�?�v��v�J���F��� �.6<
Static task
static1
Behavioral task
behavioral1
Sample
VixenFreeTemp.exe
Resource
win10v2004-20240802-en
General
-
Target
VixenFreeTemp.exe
-
Size
10.1MB
-
MD5
65c97c4f745c6e4eb98e517ae43a4436
-
SHA1
38d864e48ec260ee85ad2a76334969a14e5f172a
-
SHA256
805f85af3dfe0bbaff1b71011bd975b54e750c311a954056ddfd4637a7a5852e
-
SHA512
da7c818f5b59d3696596b205db52681ee6d6ed3e4f3695c5cabe3fc50490b73640765f919f66d88cd723105e19787d871216c82d0220882acf996c67696aac75
-
SSDEEP
196608:oxpEfmVD5NARTMWBZPMKbZiVVhjmYlZmrVVNgMd7ODra46dMp+rG7C:oxpbXydMWBZMK1iVVxmlrNPlOrP6ip+x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenFreeTemp.exe
Files
-
VixenFreeTemp.exe.exe windows:6 windows x64 arch:x64
c2ec2c0c8dd6e27d48d44899ebef4481
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
DeviceIoControl
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ