N���:�=��7�B��e���>�k�N^�͘q�;�|o�շ�0�VN���1�X���*����FY�e�5D��j�Ɣ��enP?�m�xKj_�L�����:��1�*~��O�y��C�����B���9��͞9Z���&}�4���T��d�h�H��aKc+ �ɾ9�r�y��J�����w��[�����_��ig���Y�њ�0) ~q���늞���+ᓴ;�>�$%��N;�T�_��N$m'fmGzhZ�"9�{ /�92Uh�l���7��KU�P�F2�Ր�m��%�b��r�֠Fs��&�MhL������X����=� ��bc��\��m�z�K�S��L�fͧS� g�*a.\��6�Ծ��xL��L��a��dH��5�#P���-\�聅�vES�W=���R��TX>Ӹt ab��Q+Hm҄�ވ�kz���Pp����o�R����<.��W�V����z�QM���/FE#H�k�4�*�T�eD^�S"Pc>X���8L�� �%���;���E֗.v{�1|�wCb�M�[91Ô����+��c)8!�I1�u��o0r�#�� ��G�ct[Ȑ[_����D� �,k���( WU��+$�T�i�7��7[���ݍ2��'��$��)V¶-��O.G�y��J��I��e�u���c[m�6�N<��y���+�v;¹���OCc�v�f@��wձAqөf$̼Q��a }!�,��XB; q$�B�z�f,�̦Z�ʾ�������m>�"-�U�.~ E@���3��$�!I����(���&�ѫd��s֤rMm�!6T�܆``���Dzg��۠��kt�y����%;U�Fc2'O�!`<�&���l��?^���F���2���'w �﹂B[P�U����l3���8E���&.� �k��*�I�V�wl 0�{zC�+�=l&��)��Ls~�cw@?��lJ���>K�,�ԗƍT*�m�v���H��(��?�M�>�g @-�W��>#^�ǥ�3���T�������$nN��^`���i�G�C˰�9!�T���Vi��8c� �/�|6�p�%M�-6��ʠ8Q����Ϯ����3��; u�/z�Zm��_���A>1nR����;��S{�l���/�]v����TT��pr0�#f0Y�r�ft�.�S/߰�.��"��u�X�$a *liM0��Tm ��}z�B^�qTr�Bެ4��غ�-�¹W����]:�8���n��L��T���)��y��LF�k*�x�؛Q�����@�ۤ����Q��Jed8��/���*���=$�T5z�X �j]?�w�y���j��2Qy������tmBD��>ԅ>S�Lynq0S7��N^��{����"F[B2���:�~�������<�3�0�O��c%�c`?����rj��$�e����+��FZ�3�U��m�dH� ~���_=#qQ:�ah���;�:d$*.m\���`fUL�}}\Ȩ�Z�b��D���n���"Dh�7k�56y�#G��W)f����4/�G\L�,"�fJ��������̾w���E�>.<0��AŔu��A�Ӓ��� &[�7|';hg�ҽ��lJ5!�haZճ�_��R���w�G_U�����]\��a{�T����-��V��Q)���Zp*�P������/�쭦^[�7b�!#�eF%�>F;Nɼ፺���|��#h���t�t��������NJ��ޮ!0t �a��d��BdD�+d֜EA�am�-�"(ucs�M��a~��R�*��muN�w�G���Tl���R�m �w����:e�l�Iؽ����G�.}��)G�r�a�"��SSl^��LI�S�5��d�eT�H�����lvV�}����s���5�����Y��4�t����� ;=�����D��T� } w�s2��!\Bg��H��='oJ~�ŀ�g�_U�2��,���@=+��e�N?\�b���5�H�0[/'ВvtCedF�Ɖm��@��;�����28�H$�����)P��qj��A�a�w���؝Lm����N���O\nW;XqK�{�ǩe�`�'�����Ξ�<5 P8�TED`X����sl��c�_hJ����'_/}��%����ʘ\����U�4 ��m��r�5gO�p������}Y���W����i���8Ͷ���[�E����H)Ն)�<�v.H�\!K����_Q�Y�m2�^N|���?���Ȋғo�K��W�&�����G�l:]7��#d���NDr6�=�T��_�7P_��(�K�$d �$�@&R�a��wq�=���� ��QK��=Clhd�/���dי�f<>=�r^�F�E���L� R�=G�9�d�Vxw� 4�Ԝ�K�jq� ��1��5� wt/!X��� ��?�p����̰S_ ��pC[ud��vp$A[1�%�,Sb[�~��\h�m�LV�ъCd �$�B�����Z"۫�d�}�J� �u�H���B(YdR�{��J�^M[n�'m���zc弟��p��z���;���7��]�N��<X�&.�P���@a2J*����� OL�r�Nu����������kz��5F=��/"�����]���#���k�pu��M�� u8�J��"oN�@�GB%}�i1�猠�t����`�>̱�n��/ˆb�����M��nEz5�E��`��`-���z �u`���B��n��zh���iz)A����2Lwy䣑zG�ya4$As�<���8�6�a�֮r���b�<�5b@z�Ӌ^$��x{��^�RW������^���#��Ӓ��3F��Yz/�K|���� ��+���}kY�Y��+��c}������r�d�&���+���)&=ݠ�#4�d/���H��Ru�o�(�$�!¦���@�K}�Euq���xo��0v~|�]��vIA��0�����F��>�SAh��� w������L{Z��Ӎ=�w���n��Joٻj���\9������f�QH�V�AcɒRV�� /tG�f/ IM%���X�JE���ʛ��^��}�
Static task
static1
Behavioral task
behavioral1
Sample
minecraft.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
minecraft.exe
Resource
win10v2004-20241007-en
General
-
Target
minecraft.exe
-
Size
6.0MB
-
MD5
7e9e79d045d65f567694abf27e97e755
-
SHA1
245ee15b7ead65561c8a3adcd8137db5a28e58a2
-
SHA256
1531ea041e501a4b4909b4c4e5c73c4f13f0f27c54028895239fe00ca585a579
-
SHA512
000f13f3521cf70dd3e3eab43961d4045fcaf12856384ae121eb8b38cbaf238e6a075519cfd8a60942406ca5ed8fe04e039b20583ce729b08267f56fbdccc82d
-
SSDEEP
98304:Jq/NxsiHbb2Ss1Fw2D1WMrC1lY8s6YUBQajTXLVUWYO8lbBp6UEp1Hgq:axTbP2FrZWj1l6JUBBVYlHMUEp1A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource minecraft.exe
Files
-
minecraft.exe.exe windows:5 windows x64 arch:x64
9c047f97bf425177e4cb4dd38adb1eb0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
comctl32
InitCommonControls
kernel32
CreateThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
shell32
CommandLineToArgvW
user32
CreateDialogParamA
CharUpperBuffW
version
GetFileVersionInfoA
winhttp
WinHttpCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.89640 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.89641 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.89642 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE