b�w�r�^@��M���b�'����s375��e%��~z�K�~4��b�q��L��=t�]������{'f����?�:��^�q�l' f�}K�*w�=B���y�C!Mif�2�Ƒ �;tͬ�i4[�xLw�צ�fB���-�]� ==qLH��0� E�%/��VI�"#�l���.#`�y���Q�[�?e�k�� ����y�?���%��h[�v�mA��J1畔�<���v�!�%�����ziB�-�<�A�m|�-g!���A�<TA�x��-�2�� ��s�v�������T���i���^L*��z]Z2�����=����j�M~ 3�}��Ca��:/?���z��<uK_�d�C��� �����Be��{}��Is�,�'Xi��2���� �+9֕�UP+����<��19�3�T��(.Φ��$C����P&EljL��F�^\��u5�Zt埠Hr���Eޅ8j�'��]��^'jjeE����R��-��9;���x�\���A��!M��+��Ӎ�� �1��K�[qA�̗����ͧ��6���� >V��2f����އ��rx=��}<������!8d=I���P~�oʼnRN���{9�Z��KT��{PI^2���Y-��� s�ڕ�Wh#�,�����j��a��3�aZ����` l;q�2��4�mOmk��;��z�1���۾~W�my���zD�~�����@���H��w J���iɯ�4��$`�7��0nݿOq����!0 �����Ly���Pj��-&����-f�1�J�2�H(S�rh���T���~zާ1V��@Uɟ�ǿ��]���K|��~E�.��.W��½� т���y�P6��%�?\�H0��Si�f���?��m�w�7�J����_����߱Rul\��{(��W���6W�ί{��te�ge�zG���#�pM�H�\SG#}������u��}��N '1?��)�V�̗�a�KXz�1R��G���y�$��8i��X�e��i <�&�=�����=�A2��W�Es({���#����H����j�c��]���<��e��c�q�[�WE~��QυD֩�96��}3��ݒ�4��_0R��Q�^xg,��z���Q��x�J��PK��8O�j������i@*w�Y�l�˴9�XK�v��a��������<���Ct��@��4��GV\ 4�9�=dT��@ .1�spO���/������M�0�I8K��.���1)���)�z������X\�����H�1>ȑ��g�;�[�__y�J�H��Ms�'��Vh���";|��~9㰈����3�c�t��7�)8��~��Se��%�-��%�BeMS���\����A�4�VK�6���e\�MZ��F/n:�i���G�8}_��מ_�v:�̋ЎS���;8�1�-���T�_3Y9������� H��5��"bϲ=MW��=��;�њ���������#rPb��3Yv�V��4�eM�����4X�H��o3#����ρ/�ܳ�?��yN�o.�`0�i�'���5wT�܁���yT_�f �Qu������J�ڼ�o>��BZ����S���^ݜ�5�مS�M��o Z���3$��B,s� @���7�I$�{i�8f������;�D���&�%KBS�:V� v���{�i�O�L�3�kn�G~�/)xh�ic8��R5 ܒ;�]]{7�~�F\H�^��K��B�H���a�n����p��U�L���|� w��̮?�_9u@������*9����tkv� i}m3�E�C�H�+ �*���m�_bȿ@�/3�Uv�ٰ� 8��8:��@�E�����L8�Q��_��� :���CrL4���>C�e?myXVW�QZ�F�P��P6Msaʇk��9��;�_u������ok���-!��%�ˤ��/p�f$7���@g�����"���A$�#fa��O5��(���i0 &�۔Q9����u���)���\L�Ie����~{�RE[^��# ���}T �O�Q����d�IE�ä��@���d�A��vR�FލԈ�2�GA�:5Z���C�gc�5B���"��+W���7b;��`v��ȧJ`MF7t��8�G��<�4��ꠐ�<�25k�i������*O���& �������gb�'�y%i1�k��`�u�� x������ 8\����I2j�쩅���� ^������s�.�����I!�$�%8����䃐^�1\�W�7�����ō2��l�X�s�"��Qv��y{��b:����U�5i��<�J��{�C�w��'dGJt(Cl����s���^�J�}?�ܘ��Q2����F�$��Sm�E��wư�=wU5��g7�Kb3�����|q�wM�+8����(ީ Ve�hsk��,�����ޚ��[��;�% Y���8(��b,�%Kf��)4�KSSP亟��[���j��}�_ s�����BJ� �q/��?�G��h6�]��'ĚA2�;�e�\�@p:{&���sVʚ�W�ֹ��H����q����bV�f� ��}2#o��lN7���B#}^�8����^�=�125�K�ܰ.:{�X�^3��/�� W,L��˙MO]q�;KS��I%d��q��c�lvh.�x�ٴ���U}ت��UJj���l��D{]����ˆ�%��q���5��!���K*� �Y�����s]�EDŽ�6�,l*m�(�뚚lٚ��T]��m8b�:Ek���7�V�V h��h�Y���_�I���[|���nHH�S F �o%<�����QĽ&��%Su��68;Jj1�*<�z�(p���]����q����0f�3e=(43���h+�y�+��k���b�ǥl]��v��7�-��oJ_�f�E$�������j��������p�s���ev��_�-�YKI�#+�f����4�W[���K5�8���؍My�n^i��q`w:fjJ;U#� YBl���(����]IRT-�)6���Hܕ&����y7����c��鵈��iA{*��qZE�(��5�C
Static task
static1
Behavioral task
behavioral1
Sample
22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0N
-
Size
5.0MB
-
MD5
708bc085c28823411081b10703a79920
-
SHA1
6d7946609eadd10960340adf8c9807676f89e0e5
-
SHA256
22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0
-
SHA512
12092e8abc74447fe470b1db637c44a7a96a25e47ed1ec3a963cd678368c8f04a6daa0274a1296d07b611c61a13474c942eeb5f72366056c2cb44798debaaa53
-
SSDEEP
98304:+EfkYX42k+tzlbYNUrje8EECzdr5975k4XjKG7oTOVlCXeY4NzqR95a:+EfkYX42v5lNra8EECx99WQAOVSev09Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0N
Files
-
22b36ab159eb2d6704a68c2c0b890475e59874b6986611fe49c70de2a24b80c0N.exe windows:6 windows x64 arch:x64
d1395251f1c34185f8501d3649cef478
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
GlobalLock
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmGetContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
asin
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ