�?��]Γ'�v����)��_WTPK{���+[�l�1�2�W����d�6�A����������]b{�%�<ƵH � &D�^N���$Xd�A!�BB��I5�|~�?j��t�ZͿQ8y�� �Y$�pԔ���k�]k;q�p�ʫ��"t��{"�Ӝ 13���ノ�M�S�+�3 �:�_����oܪ�&A��r��U-��z>M�LO}e͏�Oн��.�6i ����ރTA�d\��� hS� hġ��.'�vU����L��Z�D��ֺ^mYsM>Hī���Ԃ"�fqӏR`�d;�7O��֘��v�_��45�bN�%��H��F��X�B܇!�;"ag0���z����Cg����i�8m����N�''c�6C�o~��6U8^�@����<��ӱq�z��,�ݚ!���Za��R��C��� ��+�yR1����*����ͥ�[�r����,����REQ�ӻ�G\V�Fl�$nmJK�|���~��q]����5�,���WM���\������3����s3)A��A��#�L���E_6.���*`��^���/�^h{6��un�A%�r�~�6�L��Y�������=Yӷ�E�^vzX���� �x�����FL�Ԕ.�b�c܋���J<BZK�PZ�I*�`��{Dd��̘�Oj�i�tN�4�1�ѷnR ��p��Z��_T�H��5(s�Y���>�,h}�����r�:�7d�����%+��XƎ��#KYʃ��ś��CRf�o��H��(2�1�?��a�T�S� �'e"��rt�1o'Dx��o�lQ�n�Uc�$�Q=�)!ʏR�+��� _� �(PO�P�"���y��h yB [�������v�.\�)ޫRp�5�%�쪙W�a!�+��uT'��({;�o2!����N"$E�br���'���������_ �V'�!��� �EKl�31PU�Cnl����;�� Z+��|[�Y�����)R䘒%s"|fwo�����7��Ыw�H��:���V7�������ar H��9_ /2�T�pS!3���X��o�g����uݧ����~b�QL]�PZ�.��s<�fz)*ŏ����s�՝M��Os�tf��������Yג��q^�kV���-X��p���|�S�#uT���Ɇ����:�>k��=�5�|_���.�'� Ԟ�ʇ�ظ�MQ<�Z��NJ-F�Ϡ��:��C�F�o��a+)n�˕L59��wXIN�y���D��2P_K"����篟�CoWb�%�n�IF�>��r7#-������-{kx/мd��1��e,W}�h <K?S�4��E�����1���Q+�px%�X�7+�k�ï�6ӑA[�ۍ�x�Ǻ�bD���g+��Ӟ�V�|�|A����{9�^:>���Su��u�q3@����Ԧ��D���u��IM�d��R b� ��:�EfT���T'dFW.DL��\{��ƪ3�5�4�67I>���1���(/��2f�7����2� �W^�0�>�����5j����=���T�3� ��M��ɦ�,Ԛ��K�*L^�XT�-b�^y7Z��m�7�>v�vY.�Ic��!�����.Hηi��3�+��Bhf ����w N@X��Ԅ0�M<�����T~�Z�v�˝���G�2 oQ���jX��˔��V�r,��u��� w��Dų�y�A=��p�|̎�<"���Fm�0=撟qLG�+����Z�:�"�~#T���<K��G6�>�$_�"�3���li�t�K4���n��A�7F�a��a���� v�tS�s> ��ӃQRWȒ�ّT���S� M�G�! ,�� h������R�l�~+cV����j7ԍ^c%��JX?^%h���w��{����Ԯd)��.���&zh�EV�F�Zv����!�6��%���(�V�����<g���7|���~�2���+�4�F�"�q�8���\u� �������8�Bs��~�]��� Xh���a �M�h�Uc�«�4LGق|71�2X����n��ݗ4�J�~��T���p�F���b�����3��S�G�g͊�L��P�Z�U�L�-ů6�!�jD��I����j"j�J~��IN���F~������u�����! ��l���Tx��?�c�c��D�������/��{ ���'�X٦��2��b�7���-�H��߽�C��y�WcܚB��` X`-�O ��^��W\�� u��Fe&N 0$~��՚�Xcƿ�Ӥ��26�U�2���f#����|û/������p<b��{rO�`�c�%�Ә��jx+Ё,�4��]��{��S_n� S����R���>�kĸF�s!�U� (��ah�w�U9R��n��B;��8��H�4��(�c�mܥ�8X�4�+ιYg�����]�:]*$������C֧��1U � ���>��i֛}����j�p�#�0�;�$B�/ %1��T���� [�#Y���;��m��>��%8���r8дv2aA�u��_����u��r����\4����-��B[���8 �_��,6eX ��������S#+T�R~6̪_��H��ʔh3�/V�B`?;s�;D�����~���<�Xy����t�~���@�üc�e>8�e=�C�X�_}��a���3ŔG�$���͓�AA[ ޏʽ� qC���W�����Q����Ϙ��-�Ȼ�τ�4��9ӏ,�J������<X���R\X|���oE;�O�ԓj�J�C6�p�h� �l0�J{�͇���N����'��|cAJ\�,W�����9��W�1A��HKQ�7�Y�G�Y�9;V�.�L0��D�Zy]|�4>��_��ݡ�0�����v���r��Ȍ2��Q�Nv�E�'��Np"�{���@���!��ADe���]8��B���M�#�v�e��{+�_���>f�� ���B�b V{/u]�N���0FiDQP��ީ i@ђSu��e�!��a��!7�9��
Static task
static1
Behavioral task
behavioral1
Sample
VixenFreeTemp (1).exe
Resource
win11-20240802-en
General
-
Target
VixenFreeTemp (1).exe
-
Size
4.9MB
-
MD5
fcc1af62cd1fae4e1701a6ebdef02e41
-
SHA1
7820bc5f1bebe9dea0abf27ff6c834633068547d
-
SHA256
e5765b4397eb41257dc13b8ef222966692eb4fc034c923758134ca7fae7da5b7
-
SHA512
0a3be5ee23261114d90ce20549d2dff531cb2f379337e759c84ca49f34f346a9b5f0c211c2c01e0d1462312b9e168264691f49f21c1b39aa50092f19d17b0d15
-
SSDEEP
98304:63dQt91Nl1uawvs5WZudFbVulSBtGcc8ouhC8SUMQgeaol3qiVpxjEH9N9p7Hdi:6tQ+awv7kFhuletnc8odLVeaS31LxWl0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenFreeTemp (1).exe
Files
-
VixenFreeTemp (1).exe.exe windows:6 windows x64 arch:x64
73777a28683286a81334f6f5e49faa9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
ntdll
NtQuerySystemInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ