j�Nr:�����+�q�RcE(�/����ux�tm$�CV�W����{O�G�LN,� !�ڲf�ovm^�K��T���.�5�%������ul`���h���j2�.�epd����k���7����# �'X�B�� ��zRؕ��\/n�p]��>|<F�W�[����]�p�z�FÒ�����iS���Lk��{��z��8�o��������� GNfj;��w��7���Oot�m��o��b�Mx��P����-Ʌ�C��_�4��f��:�;�Q����o�S��M4/F~��dF��88�+�]Z�i��9���{�IV�.��5�twb (X�[��#�>��V�A<�C��D&����0F5g֜^���/��s�X��U�����/�:�LR҃����XȪ��g��=��f��-��X\J -�>�,I�*$�Icr��SS@�>��w*��NT{i�E�!W�.��>��P�?T�.��0���@3��U���;�����wP �q�i-�hE�si>ЋO��<��aW��:P�Q!-�Q�3c�>w�����lG���F~ݹ�]\P�r��Q�PG��# Jvu�h�+��⠩�9m����� �4̮�E��-'����{�:6zr7#�A��=��35ؿ����Yj賡?r���a=��6hTaqJَl0���{\�i9W����2�tv���Z-K��Pa߅�9>w���k^d��Q���4~1�n?�� ���K��hF�}�8?���8G�N���_L�`�*�x��b^���G�U��K�R�h�$�]�6�9m��^�Y��kP��H;��4&��h� A�����A����6WW�ҧ�������X��7�4��,m��Y����4]e��<�D_SR�8�=;��OZ��l��B"�O��Oz_�^Wd�`l�<�c���g���V5 A,c��r�'�G&Ǟ�����84[O�C�]���v�+�;ʹ����휁fmoϛW�^�0of� F�&�]�8����-c^�,����)�z�#� �;?{?ɦ�>�Q��+��ba$ +�t�q��!S�3i�e�h_T6He��T�ߜt l��Dd�1a\�.����;�( ���3�\�즈�I�Y��`J*z��:���*~��=��VX8��IǨ:�qna%�Z���m�8glI�<+[�.�gNI[�xb�h��.�(��D �m/�=�3���`�iq=a��Ǿ=9����h�O�5]�;_��L��F0 �J��#!��7B�5�As�?(�,�1���L �~5DF })�����X�g�&R�W7�0d�)��+H9a� Ƒ�!>���.+�䘨�g�: ��q��ߟ�gx�wc�`BΈ��Ӄ�����CG-�}�3���* �� ��ٮ� Ίz>ѶN�e)����ҩ|,���-�p�AY�K�������Y�RD¹��'����ӕb�3:�e7[>� ���4�bb���Q�='�(�X&���!�B*]�ڵw݇���C��f��v����FB� 9�|����m�}�/��� �{�ٹ2�}��r-J�![ߓ[�os����D��=e�K����L�{�wںz[�����3�voP`���997���D���[O�h������q��aVT�rӯ��㙭9C:�U'�����<��EU�M{�hY-~�q��Du��a���,�*f=`�� �Tg ���e-�g�Ş�2������{1��jL�>�ą�V�2>]�8.q���{9 ��i k���*�e��fe(�U=��dLC7w-t���/��Sb�t��{�z�ZYE&+(�¬]�h5M���o��OT����(I�U�H�A*��oc��;���͓,<�9�:�8I+���Bѫ���Ѹ�%GcF�t�S�R��T���k���a�L���m���9>���N� H4'>#V2�R�]����m g�FD�O�$�Cҁ�oG����«9�#D��\L�o0�-�\�6��XtDD�ۦ7��Ƚ�W<K�*9uj�F?�B^{m+��o�(Q'�q}l� +*l�E��̋���Vc����@��������گB�]H�Fpm|���\ݚ}�c��}��������ó�����#.$��^��/�mP��f� 8���x��ǚ�K-;����/ ����w߫��Hm��t����I����!�cb� �!n�)���͘!����}����� q����9jΘ�T1�@�S��d{���RP/��E?��G�F���mp�s�5ՏY즒e�u)��������R�\�,���Qs� ��$�e�rRC�(A��p����a��E�����ݥ��8i� v�c�k���}�C�s�x���!�-JE=�.1i�[ED#����! e;B�e�q�]P����;?~P���wJo,&G��Q���T-��&�C�GpW0���~D�[��"םc�o���8��p�K2��k�����Z�b�#.2��i�EiM_�?�X�3��J� +�0ڡ����� �IV�ց+y��o��dw�(IIE���� ǥ[��@P��\�D�96٦|X7fM�Tf��!KyH�% V쩷@N��W�8�x�k2O�}�#+�p���X�$���:�f|�\9�ݙS�LA,K�S����nd) � �:t���3 n�!�~٤{߭����������ڶ ��_N�G���o�8���/&39I�Lp��S�ϗ�a~uflƧ�˽g&e_y��%5v[w62���`t!�!r\�w����p�Zc1�����|���S���Q �FazPk�^�I̙�ll[j��9n��Anڃ�D@P���W��Xn�ۭ&��;�I����hZ������$J���,��2D�ڼ2��ϚѼ�N�ۭ�X�uky������p�S��YLwi��?�e�v�������5��"�o�!�F!�1�~'.p�"xy��0��ԣ8)�Cw*�۾Q(���@�Qe���碎�L[s��oN�~B��Dq>�*��h�ʬٍ�2��;�ҡ���H��y����͖vӉc�X�4�J!�d�[֧��� \N8���ߺ�@�p��d芦�ĭ��S}�� ��Z�%(��a��
General
-
Target
Sparta-V2.6.2.exe
-
Size
5.9MB
-
MD5
16e450f7a2a60c10bde75e23472a1735
-
SHA1
5e823ae777ac17b02833214dcc517ba51e7e2759
-
SHA256
0e37315e53a5eb6b0449321236cf7ac5142c3f6b34a5b303cdcc7c7cc4880145
-
SHA512
ba2d0d3b2333e673b3cabcd76b43dab54adecda4e764fd70714f9936454a6cc25c60253578792aaa1bce03b194491f15b3063aaa194fb4ea1521912a3a67e773
-
SSDEEP
98304:r5yEqjcDFlk7apwMakcp9tYUEss8pD/zDqTZshVqR43X3lUMflgluLuycft/G02+:r50oFK7gwMakQtlEsr7zDq1A44UMflgE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Sparta-V2.6.2.exe
Files
-
Sparta-V2.6.2.exe.exe windows:6 windows x64 arch:x64
48e6602174f31b579bb3f37c5ca99314
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerifyVersionInfoA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassExA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
msvcp140
_Xtime_get_ticks
d3dx9_43
D3DXCreateTextureFromFileA
xinput1_4
ord2
imm32
ImmGetContext
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-math-l1-1-0
_finite
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
_dupenv_s
normaliz
IdnToAscii
ws2_32
WSAGetLastError
wldap32
ord33
crypt32
CertAddCertificateContextToStore
advapi32
CryptGetHashParam
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ