��|M��Q;ќ0���ķe�u��T����so����#�F����r�T6���m��ޡ�$�U\���vŮ��a�Q�UD�\���8��8��e̍��_�d�� ���>���%eF�X�^[��"(���dP�J�1�W�X*!kyQi9�+���4&�GŴ{��;����M�ot`%?��� �v�˜C�#]:�.v����Y�vC��qeMs��C�+�� p�E�+�����Ru�:�x9a(~�ɻn%���P�v K:�ז�qX�ŜB�t���;g3ўXM~t�Qi�}�R|g��^1�D����_^C�&��UT�xY�,>�b�����P��%�z�U���e�Z��j$s�q��e����@������f*�'|&�i$��K?L,��d@���C<+�ҰJ�8R�7�'�g���a��do�I����,�ʁb�(`����a���K�rU�YOV����̬٪߃K�m���C�c�����r�+�u���p��e�]�?��*��� tIGy�M*��9%�D�� ��s,�'�O�D#%�?�Qۨ��dU%-�E�G >v��)�\:�+ۦ��ȩޢ3�M]�W���@�`��A��|�͍�@����t�L\տb�n��s%���&n��2�I"���G�~��z�n?uj�Cb �!��(a[��P[�dH�L�J����H[�b��!�T2�U�����)$ˋ��e��r�⾣.�k����R�n�$�����cX�\���Z8�7������C�L���\�Z�A#\qnp�|��a&sf�_�TNO937S6c�t�R�_���yt!2�;1���Ur�h4�j���ʓ��7P|T�|�H���Hc`�?�q�o~�*S�E��^p��)�fcG>��l�����^�{O������gb9�a����<kc�f�t�.�} ��T<�g���ZP/o���%�@�/��|�l����(��h��Y�`�u,U_{_��{���;@�� ͎������T-��!t��18 �����奧������!ߜ�����F�Y��_V�{$`��S������0�Z��Ԅx+���.Gi=�Pʎ�L��6�c���[^��fy���YOm�d 0 2��1;O�lY�����B�Q�Yӡ��Ee)-�S��D��J,F*k~���6`�3l�+�� �a>�Z)�}�����(xBU��ȉ2��ծ��ad:�%�9w*W!���m!��CBDF��H�H�Fuw��i�֙1 ����vh.8r�.Q;�p�%�K��7Wa�t�ʐi>�;����i�:���hC-�@)���hy֬�a��?z��|g��5�`�y�=���3�ί����N�:����LBg�è�ކ���%Z(d�������Ѐ*�_��ca/�@r�c%}��"q}D������!ߊ�~��_y-��=;�-ܣ�Z��D�#3_>l�����'zѣ҃�� ��!g�=h5�ZE�NL5"���������1�m���a��R�LG+�vv�e�iQ���1`�咅]{%����ሿ�C�p��?��������E\<� iX���/�Y��q逈�>1�U���nn$�L���������p�V�u� ƺ���5�L�v���/)��h:��1����·3tmF�.=ȌX��L�"����������>+?ӫ�ۿ�I��`�f�/ _lB4� [*I=���%4< 06Ww���Y�$܉y܃���(�R�/�h&��E엄=��!�tp�F��>T�|�W㝐�Wݮ/i��V{t������6�4����?8��jw Qlfw�(�-�G���/�ۤ#���X�v"D>��r�R>ef�`�T�:S�v���~�S��H�)�`i���M��0S��������nٓi��+)�'M��K8yaSQ4��һ��ì�R���OQy cqc7FU��G5ʥ��U���·qԀ�S\�h"c`� *n�=sF��}i��`f���X6���������s6:YH=�������y�lBf��Wc>�nTE:� �U�$��7���6�`!ic���U&?����hu���2�n[g0~|q7��a�����Ê�b� ��L#�Y� \��k��k�'>8̾��T袘t@��r.�R�J�َH2K��̂e�۶���f�3":c]ɞDJ�ަ�@�d"Bղx˞=��z�E8�V��4��&b�6Ġ� rpM��L���x���-܄܃��Nߞ��W�#m�D�U�{z�ɯ@L{��_=ˢ�|��#��RBL�������+ �������u� >��aI�whz�G_�����#��x��Ρ�=���@���z�M �P~P���[���Ǔ�4�q<�0�����<�i�Uԕ���P�M�,+P������3z�^j�.&"��/,�������c�9|������F�Z���<�M���)dA�圐w74�/�ot��e~�咇�b��H����k��]�%���?4�\r!j<�#��sD��.� ,{����T���iK3��(w6�9��|^=�Bn9���G�����D����H ���w�ߣ���dԲ�b�&%ϴ����n�@���H�&��j�Ox�Ł]CP^��P|�ʩ:�m�1z���(����{S������I{<ĬV��nu�+P��b���q��_e�R�vM������v������ӵ��8��$_�����<z'��@k9E�E���o:���;��~�٠��xuB<������&�'�P�QM��aA�����~�qM��h�� d�2!r��Wx�S���G��4���YW�iՂ��� "C{[��$����%�������) -K>%P��E �����I���"��pF�v$R4�����g�A=&H=~l � �n�! �ϸ̷by�謕��is���*�VvT����9$,�9�����j�%!��`��Ǥ�f Մ�NJ�C��Y��pŅ�/��%��Au5�O�çrբ��V�����촚�n�ɍg�՝k�5�ȷ�������آQ܀(}O��v]yܦ����T�$���û�>�el���)�C[�����=�3�O٭\���XڜaO�m����ݿZ�^��&�~�>*�LK(a���|����bݥ�Z�����ױ���cu⧹A�lJ)���7x�|�gQp�U�߾�h�����RH�)�,�]�_��;c�0ĉM�ߛ��@X�畠v�BW�R`��V�C�f�$ �͞����7�\y�����5����o��Zc�:Ļ����D�+����w�x�`��R;Z^�tJ]-�0�<��'4�����N,��#�0|+G�Ю�0��d�|2u��ct!�-z1�������ƪ_!��E��V��Rf�;J?xm�=p�j��E�}�o���'ڥd$W�@��Ϲ����DGHצ��zU�#�;��Ӫ���
Static task
static1
Behavioral task
behavioral1
Sample
Xanax.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
Xanax.exe
Resource
win11-20241007-en
General
-
Target
Xanax.exe
-
Size
33.2MB
-
MD5
9f7d92ebb896f41a861c0da6a1dcfa35
-
SHA1
b7d53e7ca684eb77fe5e1c542ed7bc86b4469c03
-
SHA256
301140e85d0887413ff368e5c9531194b9358b14cabe5b4b458dac2f012c026f
-
SHA512
5f3d882fc585739ca03b7acdbbbace91076e483bd5775d28872a766fb2ed2ef7223a33f3487c3c8f93b305dba6a8aa2dd1d8d3be56e22e1782b10169f2b96b0f
-
SSDEEP
786432:DpaO1UVRW/Qg97ujytT/GjkvDsQUj00EKDGCIyn8p7fs:DEO1nxyy5/gzQUNSFfs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Xanax.exe
Files
-
Xanax.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 339KB - Virtual size: 884KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 428KB - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 139.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30.7MB - Virtual size: 30.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE