�����6Y��q�J��yI��z�"G-��oN�� �1��ȤZ����o/a�������ӏFr��o|�l�h�Θ�I�'q���VQ�L����Y�Y�h��}vM��oP��{�0EM��1 ���F>�=CL�HW�6���-����{A>��s�m���AT��r����'��Rcd���aњ ��0!�����)��nC�wj�B���z�z���P|����B��)�75f\�ʜ��E��g�����g��1�zڀ��萴�~r^���+.��t��������=�8��l\ҿ� VK�� ��X.����*�ԇK����hV��_�Y��.�N��G�4�F߯�UѠO�pCE,�(��>�8�Ӥt�b����}�OJ�^���d^Ee�iI�%��~_/���S��$a:0�Jnr�s��!�g �běؽ?�<����W�-{ �p:�����k���ճ�`AA��|�hja���(�R�yNW(o�̙�a�s���2Lq5r�W�e��f���#�n@c?��>y�N����Y�q UK�do�{���z̜���p�������m�y��8�.��6� ����W��� ��?��x~����C~'�EjHsFRSyv������z%���<� c!DkU����3�[��Eq/���j�(ة�3��������Ӽ���;:��0d�?W/�}�FS��[a"��I�T'V`���K��������~��۵% ]��A�,�d{`��YlZ�zۜV<j�Z��ɣ����7y�j��Ĭ}����B�D�8������7rj%{ms�-��k�ԠJ ˾q��!Bƴ�_��.�Hc8!݇���)k�N��!<�c��[�b&��.9���c�)�.��*;�lJJ��7x�k_�`!���w��'C��h�ҩHM�m�Xi�ծ���c�����_��I�Q�i�N�IM7���tK�r��3�������9XG$�_[ו�����7�����'V6����7�\;���OJ���~c6t�E�� �1�*1�73�):i ڣ�:�pzoP�������Y[��(��^�e�����戅4OX�U�+�Bٲ���9�@d2�f���F֫��M]1�G��w )0��1N��9���J��2���D��+C��A�픫�Q�%J4w�<��փ���wKw=���s0b��v���m�H,@�uA�u�Pu=B�@Xli���_j��j�?hb�JUWBen�p'�S��4�6"oԢ����39I5C'B��a&����VR~���U�#��%U���x[Ջ�y>�����XA�-�'cQ4?$���}���aK/�%���%96����� �F���ؗ�U��[Φ�j�t���k��k<�$��}k&(+�����uH��N�(�Η��I|Z���[ʑ���\��+�������'&7���`�Lw*y�$�x��vp�'����&J qA���쮌Kᙡ��3a���n���N����G�ct�� Y�uX��X��������%�RA�����װ�S����lIqC�^��' z�HG��#:o��Dٜ����3���.��u�F؞�W������v�I]��h��<��$[_��w�}A�*��.�6�le�������?���� ���m,I�P����F��������@WT�+�]����S����gkÕ`E��N�u�W��8 u"hP�V��!�:��Id�Y��nAh��C��Iln�ݶTP{����,�x�l-j l( �0�nc.�aϊ,j%��uU�D���� �%� h=Qې�yK����t��.���v��n��,B���CoT����4}fb?;���m� �f�n�I����&������y��<�����Ң�!�aX�?[+�|�tV���LX�d�)���4Z���{Ż�x����FPi��L���~���-A4�$H�m�p�'�b�)��"U g�-y)�4�;S�Vp!�I��xʣ�b�,"ڵ� :X]����^�^���ٰZ������O쭥㗼D7S'!��V#��O}߮����"�RE6��ܡ�������*Rv���-�`�����ť��8U���@"�K�F\t��~���+���S`D3��n��$/:$.$���e�M\ W����� /ASLm��l{�f;�p�������խa�2+~�ͧ�4�B��]:��f�h���l��;�.���2���� �������R6Ӱ:�8��>����N.��z�������F_Uze;i#�����GM�B&</�Q��Q��nm�����aE�M�U�� Ow�Ov��jy~)w�����k� ��ͥ�"�c�Z�nR�rgOxѻ)�5�œ����m����7Y��z�!����X�Q�f��X��M�#��~F}�2ک�!16�vC���i�^�%��E��GQ���jz�՛w��`��)� n�*E�#��G�DW��;��@�u=���f'���_��'g�_�����cҞ�)X�v���C�T�C�`Ƒ�[�#j�9!�nO|<�'#Zˆ��@��Ap����U ��+��|�>1#�4�ܗ��W������ZL�t��� jXW����˛2^1ӧ��"�^H<R��l�6�x����f(R��,�h ����)�����ZA�4+Պ�m� l|�SW�B6���,[9�:Vh=+���Q�}�z����o�N��w�r���;U����1�Gkc��Z�@�����wcU�����x������$�0���Hִ�/�����=�?Z|�Jm�����e�bhx�☏tם�&l�������)�p�S�$������ݖ�m��t�d��vz����~�>�i�v�ы�`��IP�8�%"`��c��"����OCX���4�Ļ(#_x�̟h��1�1�d!,Y�i7ڬ2��/|]ᬌ�4�+M�܆}�L�R"� c q�X-Zܝ/ڬI�-��!�aT��z9d�ng���i�,����d�%(�&�*'��\�U]H ��S�8�H"Tw�G[��E[��i�`��8��㷬A�ۚ�yH���D���t���f������<��t�{w�j[�� ��&�_��b�<�5<!'���?��պ\"fh��J�<{�ò�{C�gϥ���g��&����pC<��эW��)��Z>$�V���#��/<�7��$(�W/d#�'R�0�{釠���L�7��~a�"=����Q�P��*�w�R�B#1�}�b�ţ�����5ӽK�%h�x$5y�����&x����B`�pڈ3o�E���Gm@^�u����!�f�N�n��_�$K�q��^j���Y�F������\PM֥���9��3`Z�*:�l^���T��Y{;����0���OD[����}sF�1���n�>З���У�+5w�� /ԫD���>���L���8_A'�`�����GL��U/O� ��[�PLλ��_��G���6C�;3�(����n�.�4$��P% �P�a�i3iVNړL4� �(�ir�kq`.&�f�
Static task
static1
Behavioral task
behavioral1
Sample
H4X-TEAM.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
H4X-TEAM.exe
Resource
win10v2004-20240802-en
General
-
Target
H4X-TEAM.exe
-
Size
4.3MB
-
MD5
c2c24abcea2ce55b108de5826db70dea
-
SHA1
097e6911b989a1723ef7736aff731e627a44cf83
-
SHA256
e702e51b557e563e6ff66aea444ac5e4384262f0a8ecaf04519a106b467f0132
-
SHA512
1bc7a53da87b3a1916ec4563834ac1165f13a4a6f8f23b616915c4814d2eefcad6051ed2b63b123b22f732c7a5dfb6a4beb2c7ee0dcadd42bcabed0c121fc056
-
SSDEEP
98304:MyxvCt8jjvHtSF3aWfv93ewxvQpX97ZH:JZCt8flePRz5Qpx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource H4X-TEAM.exe
Files
-
H4X-TEAM.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 625KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 138KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 424KB - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE