��A;%T[�v�H"��9�+t��&�2�~�j����H�q��c���"������jh�V�笯57��4T�r;�pJ�̹b)�r�n�sg�8�iTv��b+�Mg���aR�r(���k�Q��d]r�:j�:/c���M^��ҳ@�S8�S�4ה?N�ǎ�`�C|HB*Y�H��>�?�����+Բ���Jk�]?� R��`�Av���m�J�q�=M�T�#NG���(?�H��/���0�ԙ��������o�3���jYq��g`�YN6��=P���}����/Oj6���@��O�N��5����I��A����T��Q`1���v5�ht��P*���5���� *�{=����\c�î} ƍx�u<[�`�Ѕ~�.� �b|� �ݮ�[W�yBa ���[�;��@�G���Ϸ|Y��3�*�*���t�h�S mv���`�{L���T�g�J�J,��L���t�y�T҆����)���6�8]��i$��g�;��KY�H`��Y荂#啦�&:NsV�L%La��0���e��m-�A �6$���'�>��Fd?�%�r�J��=]�s�52OH�<.R^� t�u����q����20�m)Z)�<�L�4P-�z��ת�t������x�3�� ?���U�],Dmr��08��i�:J��.n� ���4؟��" ,t�wvs���E���̈́�����G��(E\��ksM�=�.��)d&���2Wu)���ƙ�ϡ�t � T�4��E��<�5n� �"lp�}?U�.��8�3��BZќ���L��V����V6��֏ ��ym�4�H��u��|���������4����&w��LH5��U����P�)�7�PF_t7!5���\���q�G7�)l���y��c[5�� ����ۥ��)� K��t�x����\��^��ԠJ�hiK��}����m8��M���V�2��@6���Q}�W�IJ|�m�3�Ď`[�[��S�U��bI)�����Q��*��U�[�����}�+J�G.C�}&T���/�.�-�ԍ)I��z����N����$7�CL �D�zP�ٴ<���PT�7���v��0(�ݽ��?�2$K������3���-�t�|��hi�E��ke_�"F��dp���0B|��d%�"�DY!A'|kh ����?^��ў��k��������g�����뾖H�{�d�z����b0�/ݽ@�4�� �[��g��*d�'s��//�t����&��Ѡ�Ua�>u�?C� 6�ԃႽ�U��ÄF}�hc�]�¡����R��R!��AɲWS=�i��o�W�V�{<���,�&Yk���[ƿ_鿋���û ���4"��?p;�)q����|�h�5����T���\[:K�Ec�����t�B.t�e`�aj������b�VGR�!;=+��=nK:�CU%�_rQxZ��� Jáԉ�"g�}�g:T5�%��`d�(�N�I��?Q��ǟ�*U��g:��wp�����.��ы�𢃛�+��b�xm��/m��e���YPp?M9Y�����u���F�AWJ��w�r���C\G�5M"H4����F4Ӳ���F��>E��@�l��5�Sd�y��Q���8��4�Y����Z�W��X���-3��s��ߡ�,�~�)[Wǹ����S*je�zP���5��9WT;��!�;@O�G�b�@�h>����/����"����aC��'��:�[�H��>�?�)T�8A�e�b�kF���=�8ʼ����"���^'����y-ܹ�%��J۠u&�-�'�봤�7N>p+����5G��6�N���_ߣ�<U%�C�$J^Pk� ]'�:���x�����шX���E���(O��`o��cYh"z� �����ТV��M"�� xG�x|��V��`��"�[�y7��N_��u0\=FR���P��&�y+e��Y�� 8x9�ּ����r-ʎ��,�F����>Nc���Q�!�e��IR��f�������N���:+�ɟAGHQ��[�"�����p(:������g63)@������V�����cX2`5��*���e^���#��&��ݶ�f�ˈ�$��T�{�홴F�+KS^,�jqj; ]����Cڈ����d�G��>�S�����^�->z��&���\J��)���8J�C@e�A�L��q@;f� �����`E� 8��ǡ��e��'b=hX�?;���B�q<u��'C�v�T�t��J�c�~���]� /<я�[��1 I7����9�1,��ç�^z�V夢��T-���O]��7��]����9Rg�4�!ov�,[�%R>K���~�b�6�fV߮�<���.��9�ҁn �o!j���������K�ݡ��ӎEzc���O��(�yڱ�G�H�����3.��Q�6�T�4 ����d,�L 6͏C��F!�!��8�"��#K|�H��Og�� ���R�U�x��5H�9���z)���?�����~i=\x���dQ��gn�6?h�y�"A$� �7NKX-���\���%- tBqJcWM�W��D-P���v��&�q�߮��P� S��6��6"�P����;j�������" o��*���WJ� �0�M�N ûl�:�k�C��̻������9��4�fi-��[b�ϱ.?���H�j�x!m;j�lŪ�'����\��,v�oo_j����(�Z���7`�����V ���^@�l��c���/������K�9KC` #��S��'kh����!�+��-�%6&{-�%�1Q C.������VcW��J_�30wb�!��M��#+ץ�(�n��vH��>�cPO�߽|}��q̧���X-������N�&�ͮZ_���c��4&ǯ>�� ������s�� f��4V�����p$6Pږa�M�պ�2��S��#h�(f|�L��,���oD�����m(�}���5���|�Ph}���V�ѣ���:�7Bb�S��L����uMX�V�+�0��M�̙�-=����C)��0�m�'
Behavioral task
behavioral1
Sample
jra848c9bscitlk.exe
Resource
win10-20231020-en
General
-
Target
jra848c9bscitlk.exe
-
Size
7.8MB
-
MD5
67a46cb199f06f26b8e59338fb59efaa
-
SHA1
66947bdb7305e396b0a2bc276ef34aed084b17fb
-
SHA256
535ffc0ae9da4ec0bda18684f3618629bfd1f01aa07a19af861b0d9df4b32826
-
SHA512
31bd4ec30f0ab47d2448507e605fd08b39ea1ac9239c54eb23adb7b8a70bf768f4fb5c39b32a2b8b2c6391c8d9743970fe4a277f43394c0396069d187a506366
-
SSDEEP
196608:O2nUdEgGue4zYFUEqGPj+3Ev6VLXwst3Sy0y1NIjs+4nE7QkMVle/:O2gAzGYSBGPAPgu3Sy0uVnE7pMe/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource jra848c9bscitlk.exe
Files
-
jra848c9bscitlk.exe.exe windows:6 windows x64 arch:x64
Password: lol
1b25e38e71b89953ac7c1aa3e95c3e2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
QueryPerformanceCounter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
LookupPrivilegeValueW
imm32
ImmReleaseContext
ws2_32
recv
d3d9
Direct3DCreate9
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 470KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ