BAMParser[.]exe | Triage™

Resubmissions

25/09/2026, 22:39

260925-2lgbhsybng7

25/09/2026, 15:26

260925-svkkvsfb857

Sharing

Copy URL Twitter E-mail

General

Target
BAMParser.exe
Size 5.8MB
Sample260925-svkkvsfb85
SHA256 227e0b89a5f95e13376a42060d38facab9444fbd368fa7dd4f9ed17a4e8fe6b6
MD5 17c54a309e1f5dfeff3c82909dac8ed4
SHA1 5e7aae0b3cd48108f75edead9d010f0e7df4189a
SHA512 118bf1cd9eee9b2c815ec0f1958f0ec63553753e24fcb80abe0a6caac681d8cb592f2a95334740a8f1416b63877e9d78e7376164c52d66cfea2e19eebd3c3cdc
SSDEEP 98304:QrKvgvjeo2HcY/Urb3qps/cbWGMg2QeHdt5zGxGc/QRoA3fUIFk6Y:QOdo28Y/Urb6CcKGM1FSXQRoA3fUIFk
TLSH
T1F456226E61983398C41E84389537FD05B2B6561F46F8C5EAB1CF7B807B9F820DA46F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BAMParser.exe

File Explorer

BAMParser.exe

.exe 5.8MB

BAMParser.exe

IMPHASH b86724dc7f4ab1281ce364b9c365432d
SHA256 227e0b89a5f95e13376a42060d38facab9444fbd368fa7dd4f9ed17a4e8fe6b6
MD5 17c54a309e1f5dfeff3c82909dac8ed4
SHA1 5e7aae0b3cd48108f75edead9d010f0e7df4189a
SHA512 118bf1cd9eee9b2c815ec0f1958f0ec63553753e24fcb80abe0a6caac681d8cb592f2a95334740a8f1416b63877e9d78e7376164c52d66cfea2e19eebd3c3cdc
SSDEEP 98304:QrKvgvjeo2HcY/Urb3qps/cbWGMg2QeHdt5zGxGc/QRoA3fUIFk6Y:QOdo28Y/Urb6CcKGM1FSXQRoA3fUIFk
TLSH
T1F456226E61983398C41E84389537FD05B2B6561F46F8C5EAB1CF7B807B9F820DA46F42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9101607

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

CallWindowProcW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

advapi32

CryptDestroyHash

shell32

SHGetFolderPathA

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

crypt32

CertFreeCertificateChain

ws2_32

send

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

abort

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

841KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

BAMParser.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

crypt32

ws2_32

shlwapi

psapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

wtsapi32

generic