����ʓ5�9S���NQ��jM���k�&;��p���I���͖�TE�����U#��$�ξ��R�@>W��φ<�$�_�����8y������m��76��Z���F���B�5��'�F����E$/B�ݫԅ������F�˕�����G�Q�����z,��]1O 1��ZS$�ش�9����نd��`3V�m���cYn��t2c�|FH-rn`��ៀ�#��w������T��b�!�����.����b���B랢���'T�Բ%��)��1�j���M_G�R��!Oc�մ�#���g���heL�\�2d8�/�rD�����[�� �M�|��r*�*wy��i� tr�&��B��� �4��"e��ʉ^�16�)�Gb�����,{���1\Z���4�{.��ި@���[�~�ҡ�Ҩ8�"'��������ۯ��N� �զfy�R z�~�z�~����v�V-�3��)Q��P��PIuh&g�����������R)x/�.�y=� s�<T���L؇Ze�q�uhԠ3ICsW&v����Of�y몝"oQ? �3��6b{#���<=k�����|`F�"�������h�Gu����e���&[��~�C�FuE���by6��%c��sOL��q��*&��[�n����e�0�������Ӽ��o�FI�onC ��6�����W�]����z��:bĒ������g�!,����p��,iٜ�xC�s��V6]<�ID֘����L �* U{��N4<��Y�m�W1K~@�?�����<���݊�Y~��5���=�XY����g�ZG�e�}/�@nD���N�K�����������]������7����RSq���`�3�@+k���L��-��L���aw+&��Y���L�]�z��Qڿ\��ˏ/���Yt�V8H�<]���S��Π����t�H�w���K� ʥD ĥ*]*Ԑ�E �����S���� Gũh���w�~�(c-�p~WXmuT���YeG1$�k�\)CDŽ|��"����<�v8Ry.v�͆.>N_����#z�����UĘ�� �2���x� y� �P���|�㒽ȶ��ɧ�s�Q�mV�j��7P����{���û�� ���X3B�d���8�����`r�l���A���N@���g;���*[c�@������:������?w�k���} �k��� ��}���N�����Ҕhn1���T�U�8������O^�o�<X,���`��y�VG��̟!�Һ@Q�l e}�U����x������@�J���w���ϪK�.1^�� ��oؘ�O�2�#���z�n��/�Z�.<"^�����f��!�]����п��gz�3͐:���l���O�� 6��W �f�[P��!.�-k�d1|����K�������o@kbk���_2XS��~ ,���}�5yV8�JA�U���{�Ȉ��!��x�X��n��=v ������?W�_xyr�9�;�;��!>;��~� ��#���x~�D�$%$ǵf?�_4�a�,S���G��[�GX��Έ:�l����͉��3�/��j�^�E�k��u)���L��y��O��B��t2���t3S��{r ����O=��֜��~����(ص�x�mS��V����2 L��l��TF��^G� ���-���$��*���ԇ�S������b�|#�p��k�\����~���ݥ^�� �t�\<���^d�������PU����m"|%�gL��PJ�����}�~?ב� � V�� \��1B�G^��o�(�o�j�����r�����XT/3����a�٬�A��gW��7�x�"Q�u�CV·a[�g�V�j�Q��WӃ_���l����^V���t���f�� v��U�Z������S����D����ⱳ59���J�<�rdf��E�.��9V �ը�8�ߎz��8�*� _Fe�\�����̠9���O��M)ޯp���D(�2�����L�O�ME��.۠�B�6e`���Z��he���z8H�MF�f%a�@��f>u��E�e�h����y��}w[�6��x!�qi�>w�;=�7�=�>\w v=9�X���/�yhQSL��4D�j�-�(��ǖa�`���қI=���F�_.z��?/����c�U�������E���떱��dqߛ��V�`1�P�ZM���n���4�� ���3�����ΓWWO^�;���������v�:��t��̌��X���/N:*O�\�K��,ြ�S�ɔ#��V(�/�ړ')Z��C}�M�����&����ِ�����o�B�.���υ��0p��"uc�Tʈ�HPM��Ywڋu��[���#Z�p���c�����W����Ng[g�sP�������� �%�t�N/�V|�~�T-JJ�4rR�"�ܦq����g41&���]������e«k�ɕ���d����7���@j�d�XLE�h=>\���cɸ�����0P���u����3�# Q�gx5^�%&�E+���5��Wb��sxDs������^�ʞ:�ٶ��F��>���K�)�1�!�������." I�]y+̩ˋ�����k�\�ǩ��)�PK�j���l���0���u�+u�ǂw�O�ҳ�j��W��T�����mQR�SI̞%$)��+��$w�W��xұ\⪥m�����n8������Z^��&�7l��p�X?d���{kgL�s�|��4�Ձ/�,x�w%o 7h1T��$<[*���z����h�X�K���4�ë1у�����k�^Z� �I�Q���3_�0����z`K�>%!��|�����e���8�&�!��A�*)��8�� ���{랁D��!�c������ʷ%�����ӥ�����G�UnR=�{9�r#��ʳ`t�}ԃ���?�;D"�vŮ�L��\�o�xuT��Ԕ��������������5�$�|P�4�:<�>�
Static task
static1
General
-
Target
VixenPrivateLoader.exe
-
Size
9.7MB
-
MD5
7e3820e10bd63b390ad27a9b6bbb3ce3
-
SHA1
44e3a6dd7c399b1378a299be0e07440239e0eb51
-
SHA256
087824660195be554254ecaea1a25647ce1b742666d3743360a3deedb8d4f587
-
SHA512
6202c782f00684cffd01a935b79b54ee80c79e39816952f5f2d430732872bf0fa11e12bc94ec5a024cbe3831c25445554c3beb878e3a47d23af2b697e6afac22
-
SSDEEP
196608:z0Yp9cXju2/FpG5HZe1WetXx/xpBQj5fNqfeeiDjeIlrcm:zlcXL/FpOyx/xHWmoWIC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenPrivateLoader.exe
Files
-
VixenPrivateLoader.exe.exe windows:6 windows x64 arch:x64
de6f07f715f9b5fe314fcb45ff947c72
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AdjustTokenPrivileges
msvcp140
??Bid@locale@std@@QEAA_KXZ
dwmapi
DwmSetWindowAttribute
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cat0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cat1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ