Hostile ^93% Download

be08977dfeb0b2daae5f8fbd464488adee2d3a8db3da0f0bff3fe1c9e5065a52

Winnti, C2, packed, unsigned

Detects Windows.Generic.ThreatDetects executables using BlackMoon RunTime

SHA-256be08977dfeb0b2daae5f8fbd464488adee2d3a8db3da0f0bff3fe1c9e5065a52

URLhttps://tria.ge/api/v0/samples/261001-jctalsvcpe/sample

MaleculeO₄(As₂AlCEr₂)H₉(Cm₃Cr₃Db₂FMgOs₄Po₃TiU)Md₄(Bi₉HePaSi)Th₃

Evidence

Detects Windows.Generic.Threat 0x3d0–0x6c0

⋯32 more rows
0x5d00383c3044974050faf03ebf58bc8c355....It.........U
0x5e08bec83c4f4d97dfe668b45fe80cc0c66......}.f.E....f
0x5f08945fcd96dfcdf7df4d96dfe8b45f48b.E..m..}..m..E..
⋯13 more rows

Native stack immediate byte-string fragment 0x4db5–0x4ea5

⋯3 more rows
0x4de5ffff6fc6857effffff7488857fffffff..o..~...t......
0x4df5c6458063c6458174885d82c645b44cc6.E.c.E.t.]..E.L.
0x4e0545b56f8855b6c645b764c645b84cc645E.o.U..E.d.E.L.E
0x4e15b969c645ba62884dbb8855bc884dbdc6.i.E.b.M..U..M..
0x4e2545be79c645bf41885dc0c645a456c645E.y.E.A.]..E.V.E
0x4e35a569884da6c645a774c645a8758855a9.i.M..E.t.E.u.U.
⋯7 more rows

Detects executables using BlackMoon RunTime 0x220a0–0x222b0

⋯7 more rows
0x22110bcd90000d5e600002c00000025580000........,...%X..
0x22120626c61636b6d6f6f6e000000b2bbd6a7blackmoon.......
0x22130b3d6cfb5cdb3b9a6c4dcbaafcafd2564..............%d
0x221402e20c7ebbdabb4cbd0c5cfa2b7b4c0a1. ..............
0x22150b8f8d7f7d5df00004552524f52000000........ERROR...
0x22160426c61636b4d6f6f6e2052756e54696dBlackMoon RunTim
0x2217065204572726f723a0d0a0d0a25730000e Error:....%s..
0x22180cedeb7a8b6a8cebb444c4ccec4bcfe3a........DLL....:
⋯19 more rows

VMProtect detected via section names 0x275a0–0x276c0

⋯5 more rows
0x275f000000000000000000000000000000000................
0x2760000000000000000000000000000000000................
0x2761000000000000000000000000000000000................
⋯11 more rows

Winnti sample - file NlaifSvc.dll 0x3f0fa–0x3f27a

⋯7 more rows
0x3f16a2e38ff89c59869926170c8ebac15d040.8....i.ap.....@
0x3f17a637261636b65642062792078696d6f20cracked by ximo 
0x3f18adbcf44594fbfbe21c67b9b80411f861a..DYO..!.{..A...
⋯15 more rows