{Q��X��f��*|���O"8�f����E@��I)�{�SA��&�\¾#�/�w�8��Za9v���xㄦ\���?<�j>�7��U>��k�����8x��:�F�۾�"W�M�x�W�K�@z/��-0b���8�BoQ�?`�������7uO�畝�%r"���+�{?�V��U�L ���*f�d�����g���^>�2�Rh";(� N�)�"��*5�S���y`�:N<�^02���K��"�Tt��HD�HW�,��_�%8i���0HXm�k�B����D���n䥄-�`�d{��>O�@&-AgbR�y�A1�D��k���B�R&�>η�[t���N�a9��:L���d+�J7�온"/�G�������������R�[��"5Z�C��Rg�㈖�/���\;[s��6���T�N�1�'�9%�7��±�x�)]�N�Q��@v.8��G�z3Y;C� ̷%����~�]��'�ܧVDg2N�#�fn���I����^D�^�~����B�X�oм�$TB~39�D��S,a�[ζ��2ˑ�[��d���&ߦ��P�N��#�/Z��p(v�Wt+�AhJ�c1��ㅕ]^�bUc�*\ob��'_,fᢤ�+����'���eEe4�������he��eg���Sͩ;l�u��m���g�ڎ�������q��:n?�s��[/�� �HO��E��F�-�8Ӳ��x$��a�1\0��ǎW2OZ�f���[������$7ᖥ�~u�G;S��!6�>Dz�� r�+���M:���3��F���d8^���ז�h����H������iMF��̅�u�����8�:؏��q��s�ݰ��(Q�C�:;`n @O���!T&F���L#<']�/�D�����F+��KeEK�-�X�M�5������&���L��+M��i�-�ۙ՝~�Ⱦ�82�+.��W�����Jw�ao;�"�E-�V홷�B�[�����d~�nb4�$$�(��Kt��\����bc�"łT�ޱ�G�+Җ��9 ���3"O��s���b���AKh���bjϗ�!M�9Y�+����RJM�>/z��˭]@kX�@3˒��ɴ<㧄*B��U�y��^w:�$�Pߟ�AA�@I{�Z��}/@����Nr1�Uؗ6�R_����Yƥn�]rAB��n�;9�6�=c[O*��LSX{�" �@�D��S5h���ˬ�.\���%�o/O8%���k��� 'z�K�����Q��4�� ���遍��u*�:?��ص�b���ݦt�*��ر��܋2�/�z��*:����S�֕�NnZp~���n�Sa^$�2-��_��blԥQ�~�����ya̬�����-)UT�tS�����*n�T�s������!1���w��c�'��SP磾�5�@Q�1��5r�SM������#a�����0���w���`�>i57(w�Id��KZv���h���v���y���'��q�w�z�h�<N������'���}�'�Y�TRҗ>�k����:�X3�՞S(Su��?�+G)��4�b<x���6�nV룖��<��D=?��YC���(H_aAu�¯���(*z�Ns�c)�W%����[Ĕ�\d��#;�<V6��ҏM f�pe3gi}�![^4�����W���/���S��ti��U<T�����}q���O����저.�Y��#����ha/� ������Ƃ���k|��,DN��y��GE�9p�*����%y��|�=�I�hT�� �w'�ja ��3 ����� ��z�'��ztGq�N��C�T��9�_�Tnٟ#M^�U�g��(m��8|BWA���H�$��&s�^�|n���o��' |~�\�es�) �՞�*$b��{�� ��+[)�� � �G���^d�0@��6��c�j��|� A4�X��}gp�{��N#a5�}t��/0wJ�v��3��癵U0|�X��VOpFg��]�������8�[��S��j����$6еm*�>��Ke���O�ry�k'�ȡ���c�QEg�����&�3�V��=)�iT� zу_{tC�m�����I|d�]�D <���YsI�}��ȯXx�Ȇ }d7"��_�~�S��Z}j���"�+��/��)����",��f �hJ�$�nڲ�iD}|�F*��KA=4nU8F�0��t��x�ȸ��<rn��d�s��5�8 ~s-��/�O&��D��(h�rŪ�O��t�>!��c�ٕ<ce�L�X,�sL-ϙ�Q��bϒh-�x1��B�sr��ȩ?�[u��Ё��Z �^IJr��C�"�%�1�_��n�OU��\5��b�N�$H���|<�G�3G ɫ����>�)d�a=�����p���"����3���f@�)*+<Q�X��͂�"J,�1A�J��������Ni���:#���Z�{[uwR'�/�P�-ӷRh����ͅ�X��`����3]=��p��e����z�v�ϽX]��o�"�=�T�����������Cy�����K6}����#����v�����7tȡ�g��M�t�������#�N��Z^3H�f����<���K��8����G�5�xhr{��^p,�A��ckHCO�i",*x�0݃��[��\�[�F(>�Z���eV�⾸��$Du�d�|��<�p;3�4���z0dw�\P�n_�p��������H�Pc�.��=�lÆ��b|p��%0[����緬��DDAi�i=nZ�N;`�i�c�O<��9�^^8 <ܯ��_@&l���s����O��K��n�my�`+@}8��!hSę��Ʌ�>�R�s�$�,<�{De�wC�:�z{��A|�ف���zք��x;+�$��';d��z�tw2?F��ZЃ9]2�c�_PO4� ����%;��ڗ� RL1��w�$'�8h����ȣ"�=�ȯf;7va���t0Y��.ϧ`W\�I鲷��w�TJ=Ob��핳�Sw�<B7��!�{:G���qY�1�S_Q��ԣ5(���]T@6�$�;O( b�N�CAo�Z�������6
Behavioral task
behavioral1
Sample
dd440bfca4db8e453338cc29a0f6d46e30036a7cc56443cfa9a00a0096bb6657.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dd440bfca4db8e453338cc29a0f6d46e30036a7cc56443cfa9a00a0096bb6657.dll
Resource
win10v2004-20220901-en
General
-
Target
dd440bfca4db8e453338cc29a0f6d46e30036a7cc56443cfa9a00a0096bb6657
-
Size
548KB
-
MD5
65c2c6ec6ff0cd6341b7ae3b969d15f7
-
SHA1
9e00577c0acfffc719b1492b631ad588aae333de
-
SHA256
dd440bfca4db8e453338cc29a0f6d46e30036a7cc56443cfa9a00a0096bb6657
-
SHA512
6a91447f109fdd237364609cad32056149847c9910415215fd71e24e0ef6555c1b1d8416232743ed47e7eb084c0823c0055bb1d3bae762bd7a9d0873c719643b
-
SSDEEP
12288:6I9+T8pMUP2/Wq0wlFh7lWXzOmAG3T7MsiXqgeYVNvU5jZ:6m+TWMhVZVlWXzRAwAsiss6
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dd440bfca4db8e453338cc29a0f6d46e30036a7cc56443cfa9a00a0096bb6657.dll windows x86
b917328d1a82dacd77a408e8c830cd38
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetHandleCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 536KB - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ