��7�j_��c�#(|���%'ca���Գ��J�K�'U70Z3�^0�P�|]X��M��ִ� b���d�o��w?��ҩ͈���H�f��<�R���:�ʮ�,d�6��@�6�뀡�t��d]��/��\n�t�5OA���-�X��ל�I2X��~��2�tx�P.#��ƢI{T�q�Kp=إ%���F'D��|T�f�^�<�- `b�`g���Q� a_6JcTa�D}>��qj'�b/~o^ 'Nz~SSwN�5�A�s���Z�ݜ7<�i��;�W����˴��v!O�\r����;l�rYI�EF#�,/���u7S 9�*���+@4����Sa�>��� �!��Ms�L+��ڝF%� ޑѓ]1���s��4K�՛��Mb�b ��?j� ��ݺ�7dٜͱӥ[0�U����B"�J����}����A>Co����{�z�?,���i�m�BHY'�G��wgy�ٌu�q��>����x6fI���>n+&�w �� ���Q���{�iQ��+5�g��1���� �kNc�sB�� ��{Nc���U�S?��ꎚއ����V��/���о��D9#��ͺݼ7��N\ f#�-q��;�%=8"I����@���RI/%�e=���Oҹ����^�ř��"7����Q��b<^J��ė_�,ּ12Ge�sf_ݒk��#g^�d�Rz�����d�j���҅�˴1��?uo ��;��Kԩ��r� �Ky�:�q�#5���,@lE��DZ�&����U <�!��Lؠ��d����t�*0KFK����3�� @m����hק�v��lj��J�G3E ����3\5(�b X�ˏ/�&`�A�7TM|������e�!o�%���Ҽ�{�X��1p*���sy�l+S���Z�b��Av�Ee�4u]�"3�F�%:�KG Q�ͥ�ȩx�s�TF?:�]\���v��b Nu���_�������&����#�BZ� �q�|:&1]�ن�b��$C�9��Ł�e������܅zv7gO&�Eӯn!-�D{���*x1_`��o��0�M����aE#����p�P|�h:T��*z�%+��c3��d��Z3b��@���;%#s��&=��i��[�1�ΈN�5�u�>�JX:\�X�Hrq���=|�S����.J���?��L��s��w}ܖ���Vo� �@u��Rn*�FdsN��O_-�����B�jE���]� �毝%�lݩpO�z�|߮u�����_@�Q�h?�d��^� S���>�I���+��Hv{���%�g~������|��1��|��v!���|�0������9g�Xk>[D}�(/���۩F �oQv|{����vȏ5[�g>���~Y/��A��G^����d�����/'���j_Q �/Ո%��|^��� D���iS����A��e��Z�7<tr�5�3`�cH7۳�ϲ#�*��i��}��(�\����9j��N[h����Up z>�������@1��K@��wK,�h����p�w2\'��G�m_���ńQ�T��~��� ����J1s�R�����3Ȅ]Gx(`2�3���ug�G�Qu&���fp�Ov���W��ʈ�?jz2@!4oZ,*kwR�����o����[�c��%֎)�O� �ݞ����|B�h��Hq棤�`����e��e�^��hv�ܭ,���̙{�@~2v���B7 ��n���j���RHA��4҄�%���^AȪ��ډ� �\�k�,�R*��ͽ|�X����%����ƢP�{����wi^�� �nv�� ��u�a�� ���������8���. �Gq�^��G3�:dC}�fZ������������ȗ���vz�x}��*y4���b���)\^�t�^�HZ+�����LC�����\,�Z�An�|$3j���j�L.����X<����Õ�F�����#'8�Z#����0}��?���^�҉�S�b�4OT�H4W!�]g�l����ʊ ���(91���&����!�]��a�Q�.%2* ��.�W'0��X+I�� ���=�\k��x��b�W80�ܵ��-^�Ι�7�,%_�oʰ3Z� �5h�:+f�Z��Ù�DNF<��M���V]�B���������*`����2��)��i��|���օ�%V���٫�E8�6U�b� \Z���=��@ng([�!�~��? =".���u������m��ŀ��{Ė�6 Y7�,L�HN�gݎ����YK\�03��<Z�]o����J������}Z㰮��J ����gdD�����@=c��:*��ޚ��]�~�a��I������ͻ �&"9��O�����!��bZ=�V�ݖ�AV����uB4b������7]خH��ѝ��mƯ��sz��Ӛ�k�����{�/�Z�܌��d��a��`�x��͙��d�#,�4�ݫ;B�L���X8O#�������Q�v)}_&�ګ��zvw�r�GW�/��<�:�T��R��Q&Ty��<<S�1��<ܽ�֛G�y�v�<H�- Ii��f9�����`I�Hq�3@�� C3�o,�by�����<)�J��ű>���@�t���[ةz���������:C�$�P����Q^�(\�nJ��ny����s�%�}Sp2��b�n�_*u���QѺBtA�̺*l�mN8�%4f?��"�+�X��"�r5�Ivk.��,V�pdU�@��<���ݽ� �Z�d����P ��x~�#�n4��1�Jud�3TシB���J�#�`�R�Z�bt}�k^{�1z�>[�i5%]�ڭdϵ_��遼C̎8�0�b�lpތ�i5t����e�E����!UYG�P�@�&����������իߒA3;ԑ��h^�0�����QR8��Ԏ�:*!b�7����d� i��ܤ�R��?I],P *p]�����CV���E�,S)]��/'�*���;������\�u�����,k`=:�ܫ��*m��T;��gyĈ���n�
Static task
static1
Behavioral task
behavioral1
Sample
Xanax.exe
Resource
win11-20240802-en
General
-
Target
Xanax.exe
-
Size
28.6MB
-
MD5
b08ed0d199cb46100becc5bb85df17a8
-
SHA1
e99fa10dca45bba6ce902a2e41b3385d09f2633e
-
SHA256
8bcd0d011db228406adffcc1b86ed3fa683619b772d92f63df70910629a5d033
-
SHA512
d0f7eb2ceb048f16e68c4f865e8ba788d7e9a289eef367fcef7d316967512add9294b118fdd5d20c8d58d5132c26f03b68176762e9f779d91e05c3d0013158e1
-
SSDEEP
786432:KsVTuDQg4TWbkmUROAkAKfjN4MV7VGyEnPwhJuDpEXiiZ:nVSUhyQ0APK7LV7YysooEXim
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Xanax.exe
Files
-
Xanax.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 339KB - Virtual size: 880KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 427KB - Virtual size: 612KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 117.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26.1MB - Virtual size: 26.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE