��M~*TT,n�c�M�=�q��i��I��9�t�����?3M�s���}Z��U�q���>6��Q�k�Gx�Ђ��9o��CS ��/b�*�' (�XmU�p�Cƺ�|�E��TN������b�)� +�J�8T�f�\A ܇����:ߒ/��P+�Nv�;�ެg+#R�D�q�f��Ӈ�-%��R��r�F��d��4P\�|g�������b��j��ZjI������(� ��0s�埼C����4��4��y��L�E_�7�͜�gi++�n�;�@�!�^�aQY�)A�NO0�������>FY��b&��D���6{��=��V��7^O�&0�V"H�P� �a�R�SyS �Më�O�*1�ƺ*d���S 6b�"�̕U{��<[nZ�.\�ʯ����l����8����rYn����({�CEaI'0H�e��9���!p�_�n��N/ev*�;�?��k\��%w@ @�sq�}հCq��Ra3F�m�9%�� �������� Ɯ�c]f�06t�ͫ�#��Hj�{�V)��M� :��0��Cc���w�B-9_�7��U���z����u|zxqc�������w�e�y��|ݱ��wY?F��$R�6� <�����|]�?iS��>N��2�LQ.���f����6c`� �0k�V(S�Y�Y�k�S2�)��Y?7�Ehi��#U���'3�Z:��3��MV�E�?�ҭ���=f��,��ɕ�pgDԶ�c9���k1�XԽ�+<�E�G���7b��'8e���p+�@5y�P-���� �bAB�Z��odu�O����u~}��ln����~j��_����R0��GKa/l��z�w*b�P\�*k=z� ? s�i�_�sO^ �Q�����,1��+��07*Z�ٳ�و�;Dd�ԧ�PzJ���1�B'��3�����������碻Pi������)�ӑ3������I �ne����N|kVþb\�CR�_�K�p�{�`^u�2C��l��ʒ����1��H�Z�.eOm�C# ���}L{���:������%IC��7�(��뜚F�5C�r����v���̀�u>�����'���h\laɅ�H���d��=!s����<���&fS���{z�F ॣ��J:9���f�Pon!kY�^��X]@�-�^@X�j��c�(���$�q������2���a�"��˚%.' }R�W�E�-:��:���z?�.JG|�E�� ������r+r��Y_�6�U�77Yr3�.qڄK:�8�{cbG�wx�k|�������|���/(9��"/!=(����H�:d� f^7��믶�&ݫ8�-����L�;�:���KW��d� ����G��!uOe��d�+���.��t۽S0�L�n���`-GYMкU ��j-��~TU{��Ah~<~V���X�g i֙,&̴W���1z���N�R9j֯��}���Z��7��muѡ�P��] �@���V�Z`��}3q��q���h/�7����c��s�J�r�6�s>�t\���f�!G��-�N�Ӿ�HW~�������u�i���iP��A���GM ��hk)8���6�z��y{�H�y<��; ��H_�)ʔ�s@��w���q��b���FR,�Z�80��j�� ���τ:}2⾈lE�QΖCK�e��i]5*Y[(eŧ�9��la��=8��<��ݾn�&�Tlhr5LX����bg�>�Kh��YY�a���4O�ɦ6y�-2\�_���bm�T0J���g�'�z��5߂t���0�L��\���CtzP4�~1���U�&�^b�����k{ ����|)F2�}���U?]\� (��l��������%��zz.�18NRd�z�]'��)�[<dzz�@[T-�xy*(�������x�)z��Խ�j��k�;v��Z�C���S�`R9w�M��r��R�H �Y���S]$K;rI�-���=��F�L2�'�w6չ\_Vbנ�+(��: �ÖW)HnrA�r1��~5K��"�����x�>�����5��Q�O�kr�b��VNgs�fw�j��ق���c[����u�W��J��m��:W^߷v��L���tO�`g�����|(T�1�Ul����;�)�1�wB�v�G���t�{N���#bh��P����|$sknjQ����4�9�������ű��c��r^�ce��{�aZ� c�� ʤtx����vB8�j�嘂���G͝GbM5w,<dæ�lb�-Ȭ�0���c�p/�������%ĕD�������3�T�OR��{,��]�o�D3���[�d{�i�aM���{| � x-ֶ������V�}���s����cHleo3+���:��})S�Q;l��6�A8\1.��������+��ޞ̉�R��B��P�G M��G��5 3�-��1�h~"c�����<V#;Gz������q������+�F��ء� ��i�>k���9�sH�<��2�Wx��$H/� `�-w�6�P��<U�4�+���ӡɦb�{ٝ9S��wF3¦�깅"y�#ޤ��%*rWcs�J��5��=�qӺ�}�x �����X�-�Ú�b�� 4a�/#�S~Z��b2G�\b/|�G mE]� �ɠu�n@���@�h/���X\�����^ܺ��_���e�?qx�eMwrw���HCVP���bw[�d�D�x�K���*uИN���4����E�l-��?ˋ�ԛ��lY�����ŏ:j��u�� a������bD�� �9�HԔz����P/�kd-vj�# � ./�!��f���,�?�J�J�`Ľ-\oÓ��ʜϑy� R�?m���RZt'?Po�:+�:��?\��&�L� ����[�7 ��h��_Rd��4�0�`��gm��)|8O�*��O'V#�>fX=7��av��f� �'������������Ai������<0yGǘ��<��J��[>|��,�/���y�7��x�s�Y���VyX��<
Static task
static1
Behavioral task
behavioral1
Sample
VixenFreeTemp.exe
Resource
win10v2004-20241007-en
General
-
Target
VixenFreeTemp.exe
-
Size
4.9MB
-
MD5
1940ed1ce48b347d42efe04af172b95a
-
SHA1
0ced2e6c8bf81eb6e393a47d0ef7695f1e52da7c
-
SHA256
b223269434bfe0cea4ec52c8ba1cc954c5a206210b43e2f88c65ac6c194e6a1b
-
SHA512
bc90132bd02a5d318d169f379d4760f56b49b35b3618302a92ed0c984061b97e0548f3a09f749ca78dc6418f8ba82d694df0e6febaf4b9aa469c742fb78d1e6e
-
SSDEEP
98304:uPMFNNXQgxJwvYzbBUDfhdCN6D9JYxFvEWNCZRIL/9PIKvSh6:u0FNbcYx0fhdCi7Jh+T9AKv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenFreeTemp.exe
Files
-
VixenFreeTemp.exe.exe windows:6 windows x64 arch:x64
5ea9c372a41a0f8bf69ee0079a2d5b66
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
ntdll
RtlInitUnicodeString
dwmapi
DwmSetWindowAttribute
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cat0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cat1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ