�����C� �K�+JD�E#�q��r�Ȅ�bm����b>}$;�m��J���v�@���p���e0&��d�8�����+�;%y�˽H�5$u0 ��q;h.w}��j��"C�$��Sİ�����-�� Hx]p�o�Ƭ��XB88��VXN$�Fa{���Hk�c�~�:�Y_ h����A/�����$~Dp�6�<�%�5Q�ĴX�Q�����8�{�^!��E����J�[Y\b^؎��5���,�a��h<Z�@®��_'�B�3%�]�x+(����l�%�ȧΪ�����2��u�;Q��"�A��zVjŰn)��^pSXi0#Ab2��k݀�T��]#P�����h��ߑ\ ����8��JA̛�T�Ϝ��jBb���H���z��&]�G8�[Hj�<Ϛ����aC��J�;����`9���JX��5���Q2�����X�'���]���qN-��m�BT�8(��SAA�uZS�}1/a�:X$��g��}���B�ޮ���@�DT�� �ZMۣ3��������O.� h7Xnم6_�� �3�ҽZ�@Oø�He�S��ੰ�mVx�����xrR�ȃ���0o���##��"���~�^>r��DM�#f61pQX܅��yPken1��P*��'�.=�FD�r�P��G�4g��������DS��(�Kd���,����;��[8/El�%�~����n&x��3 P ��㟘����ꐙ���Y���ۤ��7Y�Ŷ�\�d�/*0�ʁ������!+����I�����t�E��1�9�����ߪ�ς����2�$O���mK5υ���@�i,g�k?�q:�#p��f2�.��֞�G��'��<~.��\+��B�`�Z%�*g�c�t�3��������dڭ�B�Qa�K_�Kq ����� ]om^���%Q����sw�{o�����RC�3���\����ތ'��ݾ��c�Ve�.�����<�,ch6dC!��][��yJ9��G�NA���!����حg#C��#kt(q��>>�Y� '<Z�㳎> ���)o9gH�j-�r���R��1�iVW/8�n#���~lu���*�ſ���EnR�G�&��&��>��A@ �?��ެ�~������W5(r�<q_�`���SC��B����7AS��7{9 *>�$�H6�Xfv.��7�8�XZ�.c��l-PG��N�ӷ�����|������J#�9� ����4����)�έ���cQU�+�u;��k#-�u�����%�16���"�6?��*/�&���y?����[1Du����H��#�ĵ��̀���Q�C-�60�4��y��,0u�ъ�����@���OjL4��,,��wI��n[|���sU!�,����Fn�#�ٮ0�Gde�=9Ȩ\�%1֘U�:?G�����䐈 p�}���s�d>���(��{�ǘ_��T� �>�x�t�<�(д`S����#D���� l���FBrQ��#�;$/��\Szu��t�e<c�Dz#�`�&�9�����`��t��}�g�@"{6*:~�L���WԔ�8[�x��*��g���B���8�8��3f�w�����f�=�>(�d�-O2�/ �.�[ �5�G��`���V�gheTX�0Fc/��ˋ(}���H������`*�Ձ�o�[��������7���˙̖/�t?��4W�gKD/Z�~����fC`l�I������)������1���\���0�WՌ�g��!�p����GܘTr�$��X�aF�&��0_�~���Mz�/��&r��V��W��2��j��'&ѐ܋���j����V�y:J�s_su*5ɧ�=P��� ����:�=n4S�~���L�j�B�+Ыl߮'�!�@���ߜA-1n'��� `Ъ�!�DWA��V4H������D,�ejR&2�%Rש݀hf�8�NgC�����9� ��Q�{���Iet���#�G E��\����݂9Q��2��(����f��b�Nx����ڕ.R se�E�ٳ.b�7~Gܧ��r?l��i�l��]�;� $����%�~�h��^m&u�FE ��_�?x�筷и��B�ĄJ��� R��@��Z��G�����H\��̀/� / ��䩻�zR`5<Y{��a�>�h�F2��0�+�>�L5A:�m@�EB&��Jqc���K'�.��4���X����c��v�Ӝv��l6�|J��P �|�\dA����NFG@�λ3���;������;�OH��R�l��]j�[�u�U<��\����V���Ib�Y �?��S�r�c�v��f�����������,N=1�i`m>3gr���_vK�v��5!6u�m�"�d+Ǔ9�$܊�=L>�I ��ߎ���o�.�T.�X����'ƞ�0��͗D��@��ܠ�x�,���mSrtm���߁ф�����*��P��_PI��7v� *u؟��)���}�Cf���o-ZW���Dx�wl+~]\Ӆ}��%����q3ؗ��*�������� #��'G���$��*�x�X&�lu��J�6Oq0�^:d���%]1�����}g���8��X��xl{�^��w��=�6�_ηX4:;��6�?�<�]{@5e\�����ϸ��a��|�3���Y��e<I�t�5��բ��s�� c~��T5���R~��Q�Ԝ���`�cy�v�Y/M���nɺ�v��P�2� .{��2��G�p��ǘ�w�ր��ep�XHO���~��Ž]�g"�w�iN!�M�B�Qo��e8"+��x`�)P�of�oq0+2!X/W���m��d�k)�`��5����,�"� ��$��j����EZ�qS]�)��"���뼾�����N�DHzk���1�����i���ʒ7�� �S�ܡ�� �L��PXA��{�V�i+$��ZPf�6H�ǾȼQ�X�{�J���z��-^7r�]3�]A��R�=iMb>�K����� h].�Jp�I/w��+N`�"���(�/ :��t���~^��-}C�h,oz�
Behavioral task
behavioral1
Sample
blockhit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
blockhit.exe
Resource
win10v2004-20240419-en
General
-
Target
blockhit.exe
-
Size
5.7MB
-
MD5
d4b8bacd7a46b3f70e49e363e11e928c
-
SHA1
3624bb78da221febfb163a12e7fc88cc021170d1
-
SHA256
b2dc88a12d690bdfb124e1d463a68accb0b745ab711d267042ca99beb7c344fa
-
SHA512
7121551f30f9c90f748a42bba3bee30599745b4ec6c4a989fb4fb8cd28e9de83196d7f102f17b8894b07150fa6f813dc62140176d64692718160d85970737a49
-
SSDEEP
98304:HIRZKiZuwLYHWWiprGIjpxHRdfcOrtMdcPh2Oh8WzreMtJeafe75x:HI3KiwdWW2rGIjptRGqnP0Oh8ECMyZ1
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource blockhit.exe
Files
-
blockhit.exe.exe windows:6 windows x64 arch:x64
6a5bff68a2777e68c4c9c3fdcad56479
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
VkKeyScanA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextA
normaliz
IdnToAscii
ws2_32
__WSAFDIsSet
wldap32
ord41
crypt32
CertFindCertificateInStore
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 910KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ