��+�2*�ɘ�G:�V0͗'��(F�;IB�*�W�ew�K�L�Ӻ'4 :� !��f��:��v��t��З �O%�/���Z�>���8�U\ƶ!![_�-��;(��ʮ���L�y���Ư����7���0&�k0���<���z<�S'{r����i��3�U��G���XZ�U�r3��\��Jכ�ʩ����?2Ùi�O�V���Ý �Y�#:Θ3 n:VES��6��S�}��~R�Nb�fꞗ6� �Ԫp�����\���<#��]I� %-|@a��A'�S�N��R��iE��%� E���rT�a�Paʡ����k��㽹}T�G���ol�VQ�l�\Ѳg��B�u�$wۨX%�E�?%�D(���7xs��_a<L��M ���㡓�ò��^Ǿ �#�g�2�bYRG��j�=�v�@�_I}6U��V+��c��+&�j�� ^�n������ER(���.t|�aٗ��<,��'�a��Ք�\�p_����;�KMP���ئh������a�[66�c!�U;��3=�Qbk�h)_Y1̉{��"1R�>�k;_?���9��z�����3<!�����Y����]88���0C�7B���g�E�!Ϳb���h'��|Uf�Ɂ�>������:�N���\�[l�����Q���nn=�P0�y��7w��t�PJ�>�y���.��)G��i$��0:�ɀ4ԴA{?2��]�*�� ?u�"�* ��+ki��Ny�x|7�DVU3U�7�m��������# iqg�Ia�m�~u��k�>�PQ����6Y�g�O߄�V%zm��c�Cy�D@Eч���OM&���At��WB_=U<fG\��� �e:�K�L�����~��"��\�Y`'R�M5��ًh��W܄�ʎIH��fKԊ���A�Y#�A�w�B]%����d�6<11o��E(������o֮��B4�X;>�>����.K�A)K�~�e��+<woA��A�J��+GTE%�ΫJ��xo���O�e�?[��_�a/���·0���ud�C Y<�Oz���}c�</��I������������ީW|�����:!��b��=B���������`5,�,aG�t�]��Ts��k�q�y����`�i�hC�"!����jy�w��LŨ�Z���|�@?ꄠ��w���.�N����=���:���J�$��.L�^,���F"M��G�v���nP�l�6��C� 7�����m]ڹ�:q�c����6�0dZp�����ǹ����FRm,pe�ra�!���Lmwǩi�a`�zר4����>�9P\{��fl�l-Y&�R�q/�+A�ФP���� g��^(Kr\��GQXGj��bH�<��%�IhB��Ԟ��s�ͅ��X��Ye'�m@����Ő���?�O*������n�0���1B������fӁ���w?Og���+e���d�93���Sکgp�ՙ�XR,�.�l��i�+[������qL|t��"W�g��42EK��IŬg�F�W�C��ũ�k%�&�zU�zP����V6ƽ_���e)�>�v$���η�tgX�"Z��H��]��^��|�~h���[��� �����]ْO��Ǝ�cR> ��unC�.��ޏS���6%\?�^; 7{�lj�Hf�_78�X��3E �0F�m��J���6��7"e�� �c7r���yk��Fe���~x���~d��z�KsI\��@�O��)�B�p��ei����[����U������%�6At �,�ߘ[Rjū'*���د�7u��>CX)M�Xgms�3����Dm��h���N������.OY�����B��o�/T��ptb!��i:z��N1�>ߚBXR8=HᄱyQ���f�ǒ�*�X�t���^�N\��Epm�E/�����,_�(DW�|?Û�{���8�;�:���f�Z��9�ea��wEr�e�)��c������S݊(��!��]��|DZ�~CO�Y()�700.5�`�*3���\VISGA��b�E�i�#�>��X�r�;��%�����% U�ɷ�J(�*�� WM�rz�/J��>�|��:Ƹ�ra�D���!����a��)3����<�Xk��|�|(l$��__̨�� ��M0J`��<��^TS�i�}w���}��+�YǾ�v5�;��4ֱ��=qgdb���n;� �*S� �z�� �� �L�<Jw$�f[����i�,8������q���@�-��xSp��GY�[�ĘP)گB�@;Z��U�i��v��V�/�d'xOZn0�/70�2��1�o -�]d͉�&���7��H[A2F.��� �!�>͈&�Vis���rd��oB�m��$�T6��ֆ���S��"��ʹ;�q}&���YO��X�%����۠XIx�l���eܟ����ݏ3�� ��,?A{�p�&�sk3�;Z�ɹP�#�f�8uZ}e-���g^o-r~�r̡�C����m9Df�@l# $�W��|�.3���|�h�ys���t�L�_��U�c�)����ZÃ��[���%��D�6[�֣'�i��pew���(�t�d�.Ћ��.V�U�e�2�BTʎ����=��6�c�+�?"�}��5�(N�p��d̒��Š�u���!%:>��'i��q���X>�? ��7�@��<u� y+6���lqWUXk��(�?~[8x�hŪ]�M�\�9�y��$)c�(�K���r̦3��36c"o��C�O���p��f1-.p$z���|��=�bȼ�����)�WR���T�&nl�y}+����qu�ht��j�o��G��ʭ� �C"��&�h?v�U���.�"h��J�nS��J7c]6C��,��}�����<�1P���n��j[�l ��z���ܱ�`���:�?ŕ��^`�䚆^�x�+��J�ø�� ���9� H'� $�=|8*�O������0@Ȋ]���h�w6� ����sEew�őeq�5۠�|GB~�`����:��z�<.���i$ԯ������2E�ߵ���w�7u��;�'_��C���Br
Behavioral task
behavioral1
Sample
ahbapware.exe
Resource
win10v2004-20230703-en
General
-
Target
ahbapware.exe
-
Size
5.9MB
-
MD5
086f698774e01682d4fbcfb6d970336c
-
SHA1
b04d3340c310ae345c1e9c617ce0ea4d72982026
-
SHA256
4a2f37931a39ef1ef5c809c5bb9b3de5a8ccfe6a6afaee79122e3f67616d2a32
-
SHA512
ec37877265174cb649904df0c4e3697ab3315cc1e8a827e3be71673cd69d4ba49d4cab5e0e541edb35fe3705401d2888ec3d72b3723498ed979a7abd347bc87e
-
SSDEEP
98304:Lng+gjHqvDpvhE1F2M5b1mgKh+ioo0+l6jXlgveivy2w2KM+Epq03Q47zQvZ3/25:LnpgjKLpvhSUUmgCXoGl67lMeiC2KM+C
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ahbapware.exe
Files
-
ahbapware.exe.exe windows x64
deb152d5e49cb8a1afb95d33f9c57abc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OpenProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXVec3Transform
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 938KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ