������t��&q��z7�6��F�d��咆��*�=M�@e5�?���b'th(Jdz�lSzE�ˎ?ԣ3��ʁm������<�G�W!����V- IW�|�ɣ���n�٥_:�7��YX�_AM�.��Ǻ�X��x۱d�I��}�l��n���$�HpJ!,��P�a�l�b'���gYeXI���t���ſ٭�XGٯs�|D�E��<i��^��Ȓ��y��9�˩2�U}��w�{�L��R�Иm"�BA�]����HѮ��2�(�:���SL*����h��8h'��˞Q�$�<J�N�֭|=� ��.�p��T"���0��*V��G�,�ms�.��v��4�t��*l�GGu�L��n�U��cJ��N����@Yٵ�i탐������P$~Q�0 �O�#:<�6��&�`�� ���&[y��x��=�5+6;(f~L+a��)yzP���ƒ��)���t�Q��.�ќ��=Ïueq�*����Lx�_�C�ꔥ��X��m}U�opcd^�Tfm��1��'[*{T�"��`��_���so_>�{;��w�!/��������9�[م _�"x��)�Ґ���R"b��Qht�دK�@e�ǁ����AK��`O����.���f�����cAd��/e4�R���Z������N^Aw�� JNB�@�����į$��z<������T[6�!wiU"OMI��-b�&dP�{1��nW��Q���'(��D����ؾ/�qY���/P���F�tz���\�7��,:Y�f��5�~�1�����;e@ěA:�Χ����x e�(��4�ߜ��ȹ ���!(P���z�@��g\ӕVw��@s�~XBO�ϐ]A�~W�1��������6�S��˝�Ƽsuo�U�I���t�v��j$��#-,�Sd�$)��+�������i(�����S�����6u���ǺA��Ug���/����;�#�(� ���d�o(%��]�xr�t��V�L�F���UD���`���i6K�"`O�d�~W9wO�������yk,�n����bE�→�����$���DI&:�9*���<�D� ���>O;^�(���%2jL�@�_��p|A�SC��=�p�.g�n��� �6X@q������<w]tl΄�yւ?x�В!����o�K�5ʖ9s��Z�ݢ*��V�?�G���� ĩ���!�kLQ��[�{ph.��f`ɼwcz�#g|�������`+���Ŗ$HS��G�Vgn�I����w@s_:�'3`�� �ն�g�G-t�����G����L=B���lNjTB\캹���O��Uv�;r{Y������|��6[�o��g��ܷ~6��U�:W\��+[��VHF�\�ʊ�'3+t��c g�<AlꮴC1h��4pU)��%��3ΑPS[�W6w�$��n�����;���Q��s�Tp����s���#{���G���P�T��r �qh�s�|���*�E���� ���`j�m��wbn�nO0��xK<�~ b��a4ET�X����r��Q�������W%/�17�P���4�!2[բۑLR~ab��m�'f�چ���V��#��c���qj?v�}Ʊ�=�1��/���JÑ9Y��+����Kp�c��?s�3�G���h�X�)��5Y��A1�ٍ��w�+:�m�f���AseeIA8#yfr����՜/M���-?�(���),�6��I�#K� ��� �:-"0&T�Q!�,��tE�7�P�hiMv�8�����]S�A�V"$qP��zcV\E )��&�*����+ j^?J��B����Z&����N81]����9)�}V ��7Q�:�����y��1�3D��W]�T.F��!� ��f�"�+12�^��y�XX�я��}Bmw�a`vS?;�ვ���Qa��� ����� ml��saM�$W6�}m����K�s�{�I1���C.!��r��^���&Ͽ���V� ��yⵁ�e/U�=>vR���R/�0�|��X����x�^F4��=�g���""j^n�� �`�w�s���IG-"'��w�}���Z�\z��rY��c��?X)�O]���Ħx��csޏ�fx�;�Q�AF�&��] _d���ks���p?���&����i���<̇GV'4�=A�h8��� u9A�g �ww�_b����T�-4��NK^ ��v���ղ�f1?��&%.c~8w����d'M4I���þ�gIH͈-�;���}�J�\�G{HKg����]�g���M{�i/c����]K��"� �ވ��� ���}W-;��1���7��!�C�,���u�0?R�8��z��ab_���� n�v,>E�B�4(m�����d?�ا� p+8�y[�4T��A�w\���4[܀7$�c��X�qA�Ë�OT���U'�6�����f"|�Ml��� T7���2��G n��j���"�v�?�%>�4Wo�E-��:`HلD%e��>�s��|j?AU��<��5��A%��O"���*� ?��*�\���Ҕ�<NP_x|X��{ޅt���$?T �)������M�do�uH���{�+/��A���u،Q�s=փ9���d�fkѷ��Vyp��X(�KT�=���A���մ6��s�f �"�p� `�� ��&,p��#��ޔ@H�:)z?U�M�����XG:�^G��@� �t��^5S�Bq˲iӢ��0Z�]���E�0��ژ��n�g9[����>�>��K����:Ϳq��"����t��RX��k"��_�´0ȥ_߀���:o:�ԣ�Q��6�m��.U�ۈ�B��m�$�����MT��҃���M����p��\+��Wܢ���Z�t�G�Yb�m6I��H��u;P�������>�@��I��Y�o|w�����_�J�U��cUab���gg��,)�M�8W�z�X�������}|Gs� �̬d� D/h���Xc���yI?��:a�j��\��+��g�U��:��PO�[��<��1̂�B�}�x�
General
-
Target
SHADOW BYPASS_v1.1.exe
-
Size
7.2MB
-
MD5
f108870c2ef10eb72235d211be926fbf
-
SHA1
236b037413b0e1148bc258988bf434cd97b3d487
-
SHA256
00bf30cd492b029052078afac05a3271d6b2404318154585a7ea66ad8eb56d77
-
SHA512
04795a2bbf1a65311ad39561bc2e835070a5f1e6f1fdda1822d52742cbe5122c3075a154e8244e5a1f604d599301d277242dfeffa86d25783da93a23cf039228
-
SSDEEP
196608:UC/igHbWCox1QgaZrPOndRK0evf952vpxLneqkE5Rc:UU9bWCOfaVemH2vzLgEc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SHADOW BYPASS_v1.1.exe
Files
-
SHADOW BYPASS_v1.1.exe.exe windows x86
c7808e6c9b01d46d2620db3d0bb17060
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp140
?_Xlength_error@std@@YAXPBD@Z
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
oleaut32
SysAllocString
urlmon
URLDownloadToFileA
advapi32
CryptAcquireContextA
kernel32
WideCharToMultiByte
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertOpenStore
ws2_32
sendto
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 463KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ