�j(���Ce���8����c����D2���� �B����a�s��햁�1�Ο�v�Ef��hqj��Ogi��*�(�� Wa�k(�[�"���/i�7T�J��G&�eP����P�#�vbx�`�>�7������"�gO ���{żK���DO`;�F'�?�ӈ�͟��i&P��H;�P�H7p\�2ށ���������72�A�Pw���=�|1�A��IL��p�w ��e0�s*jq����fH��T+?8٫�l's&��J"��|Q�@NV�� ��1��;+j�c^�J���5��U�D�O��I��s�p-���*GD:�j��� �R��\����խ۷Ǫ(p��7���h������� �,[<RH�LGH� �ؿ�y��������7��Bq�^��M��i֠ă�#��|D��ܷ�NȔ�t��2#��Q������D^�����Jh�z�=v�P!����u�NA�dc"�����N�Q��o*3(*����z��nʘa��Q�����M�r֛[P��:�yV#,����c�[IO���d�k��乄7��Ω7��M���}����H����|�#�W����_�v���a�CY<m|7*R�uA�Q�� �é9�;I�+K��� ��#m�I?���F��fo�/����|�� ��x�J������,T���'�"dY�3%�C��N��3�IuI@W�g��b��1�u�X�����c�����1P �����-����o�L�B�Y���.�/M��4�<�3;�I�ē(K$�<�Ehk����i�~s�˷��s���;YX��d�N�xUX��\��y9��j"㼅� t����}�.~������3� ��ke��5-��a�xO�8y�o�ـ��!��*g����8o�2Aj�0��o�+��J�v�v�!�o:� �maϏ4�����۠@ ����f�����GN��g6y��/�ܩ^v��z������CSЃW�[�%�jX��c�h$=jm�d�<�C+���Ϋ��*�D�;.ގ���!��W/sŚ�w1%�15ѝ����d�(�Y�?���Mo��R����Ԕ��!����t�w*9_�6AkW� h��l��uZ:|&�� ��>�7��)��.�9�z��y��`�� �I��i�R��6�+��u��|]�g���9t4����?mgi��%U,��4u֗w�L�EJ��1�_�]��G�.�%N�A���a�gZ����c�X�D�h��Е l7&�{cD���Qp���:yHK��|^�_o��c�X��ep�hzv�8M^P�����n �����d������X���% ;����C?�ے��2�0О"������B���¡���r�P�ִ���u�~�q� �4qx�l����P�>�x��M$��8A�ĕ$� ��k4�G�jf:���lHx������_�B.N��f= :u��x�m/����Ux�;������!ȼ+lQ���,�H��X��_?y�2 �tN�ozL��-5��̸87�n�D����rZ�Uz|H+6&M:���8�T����2��C@VҴ�0T��Qg��m ������E9�F}d��p� ��q��4��}6��D%��ZaMo^�k�����s�q��k���a�Jѳ2��;Q�1����x��B\�c� �E[�����eyӈ��/����Θ"�����<����l"�J�J�Hi���Lpv��K٭�ݖA�&�H���F���W_3;|����g�c�&�G��ƴ�g�"s�������J����^�x�6�y�狷W�@�~<9�����k��<^�:a�'�O�.%H���z0�C��I������[���Ly�D��3��ε�Y�˜�!˰z��f����Q�g�/6�?#���oHY�N�>��V��SUˮ�,O�@�wޕԽn���{Vl�˵.��)����� ��xK��u�A�:��eɊ��T�в�H�P0C�� ��ur@���9ƓU9�<��\A�퇴X�!3'��lm�DQ���~��6�8sN�MZ'&�m&��lvk�P@ۄ̖+ğ\8����1�=LET����2�˚v����� ���D��5�x��d4Zg@D@����̸�r,�)Ё��#���~��X��1pA��!����H6ȚVd��uoG�����ۘ���İ.�/m�'Y�tU������g�_F�*|�J�D('g��HxT&OS��F��<�̤.��х�|l?{��p��f X���?�rRP�}�c1zH����<���u�z�YK��Y��p$H�}A~��ϯ��&���X�X�^��hVa��J̗����Y���C]:� ������G!$?5�VӱU���r� !/V-UqL���eE���o����v�!�� ё�L�ﵹuYP�4��`5��h�pU�zАݛ��w�C�%� ۱���P{�Q���* Ç�����%n�A² �l�0(�X�p������#���RX�D\������qcC�}��� �K�:���"���xf�4�Y��r�x�n ڢr���]�s��ޭ+w}/��}dKG�l!{���{N��`�*'�M��(#9�M�_��߮L�f �`� W��yU(!��ye��X�����yD�T3i�x�ȕ�����;�C���<�z�-��؟&������_"���_ G�%u�����^�2_+�ȃ .����e�2�6�KwcD������΄����'�a�pyL�_x�Vj�Q��fZhx�X V�b����<�gB�q�U����,�ˈFX�O��)���Q3G�3�������my`��k��I�@����ihsB���L�/�8z�A�%�c �.�m ,*�on�$��b��5�c�fJ!�q{1�~�ڬ'������CГ; a�c���M�\h��E� ����!\��8SӢ3}�����{:�h���x�%s?-M�cDF���_��T�N=Aƽ���l�.�6��Ўei�<m�@*��D�%́8��1iFq�/��py<u1���Ư����q Sx��;`*vUVs�.fq����p&�ۀM˫ ����\|=znN�+,�7� W��"��:4
Behavioral task
behavioral1
Sample
Badware.exe
Resource
win10v2004-20220812-en
General
-
Target
Badware.exe
-
Size
6.6MB
-
MD5
fb316f49281ab7de9fb838a9526800d6
-
SHA1
9e10615d4dd5f40ab3eb4a47adedfd14b44bef1a
-
SHA256
617df5e5e7720cc89db1598ac6d033857fb3ca1453146c221c6b97f2ef600528
-
SHA512
a6c20d76ad2778f585821500c431de6241b1b251f6a923cc0883578a695a3974000c4d76acdc158c8e371844b3f2a7233cf9e0e6e5d1bfa8c2700e29f9bc4fc9
-
SSDEEP
98304:+BbA9dwHlG3BEcledGY/KZZ+ioqjAtzFpLyK8tDmQz2RrG3Plkv1LTMS/LphYKUe:8gr3BZY/Nw+pLyfvV39OMS/L/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
Badware.exe.exe windows x64
dc0fecb283b9de56f9484b6ffe995b12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getsockname
wldap32
ord27
crypt32
CertCloseStore
advapi32
OpenProcessToken
kernel32
CreateThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
rpcrt4
RpcStringFreeA
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 785KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ