��f��g��U���P ����0��5$��_L�����*0���{WFK�2g����.�Rn��f��n���c��!yS�K�ɂ��K/'��?���A�K�3��'语`o�D�3RY���>CM��yx&�c��%?���OS��vdnC�Aɏ�x=�7�en~�R; �������Hk{�d��7��|��� T#�~�F9�z���E����3γp���^���*�AD<��F�L�9R�A�x�b��sbx[-������x��xq��Zm�Y��(M����@>�]hB��Z���t��R(��=��a�]���_����+��*�B6r�� ��a�`$́����r��ȸ�1`�����e������;Z�B���a �)���Qӄ�[��\�U�����9��KP7����Zr#Ɓ�~o�fg�o���j̸��7�⣑������ѡ&9(���a���7��ε���e,尓F�ҍ�%�~�o�BCU�dU����^�1D���}��s���V'<|��1��?�����5+r"����>e鲄zL)�z�=�x�� ���fw�9ޏV�G��eW2�~[�F��e�����E2��qt�!�r�� �+�@�o���� ����z��S�H!�yi���������+�II,�F��NIWze�?�V�rd�4�3���K�@��Pd��E��-%σ���5��}�cO �Ї";��G\�S�NM����t��h���/��:�G+��9W�ܣ砗t�c��(B5�����L%��i�����ɬN�JLI/y��_�8�o������ 2�7�D�y��u ��)zd(��$7bX�.���B����\���:���u�p^�S ˄g��� |���2N��U����2/3�\T�XAERV��$̣����z�U���4$P?E�����!����-�I˦'��O{I���W�:�m�H������ 6üDd�<�$j�v�)��B��!)�~_�s��oտ4�&����VphY���\Z�h/������%{�G���6=��A����ڣm(��)3ތ�V���<]\������O��q���p����t\ӧ[��9b�|r�ٰf���Lc��+/)�0��𮔩n.���ofB> Z_����>5�p���:�o��d����LK��o�����^*L� �?X�M���0�e�&�y���A3r�T��/�5uV\Fu RQf�S*�����(�a�N�+s��E�z͵��L��d�ȫⴇ١9�GĶ�8����5})ˊ�4wj%D�Fyꈢ; ~r����$��r.�F��`�B���EE41�J��Ճ ���*��?6��]���H:�l�T0���ƫ���PM�RH�>�r�f{3?nLkE���U�!A �͆��S�l�Z.̓q�&Q�Kx�e���nq-˖��k����)����0A������*_�Q~�p7w�{/Z�{� �-�3�cP���DN&�s;?3����4ftpJـ=;�[� ��IV�S���j�- 瘼�^}_ޞ`�������j���&��Qx��)�p*d9|�dz�t7n��Qo3V���GS�����1��B��^o �y�c��#������5}���U��Y3������ͪ?������\�i�2��ׂj���\��:��9��PI=ht7�1�q��ؕ�@��z�S�x~ {BA8�W�-�����9b��z�5�R��\����}�K58�bU���[N���$��G���) J��Y���� �ł����g��ZRf���<(T^���)�SL���y�L�7� �S�F�U��$�ï�:ِ��-^�B:����������g[�9�����2僑a�kjQwɪ�-���=A�l�J ��߉�w�'G)SM�gjQW�*��O8�ui��*��FW�I�4>�/�W)*tA6Մe!���ښ�AAY}9^{�h㠵!�=�j���_�lkp�pF.���I��4!.�@������ߠKC64oREK�}x�k���ܛ�h�]�A����Z3#I�Y,ii�gE���,�c>����_Vop��¸o��x�D?u�1S &dd�O֖>1m�3�kh;K��=P��%�#�[�Et�ۉΛI�hA��u�>+0��7��Y$��a����'��Lg2��"]���M�Ny+����KQ�.mQ��v�A�(Ҏt۲�?��f3��*;��z4{a/��5fRQ'��<���i�dd��G��Q\ ��#����mӻ����ߊ����I�b�3�e�V_�,%����x�27o`���k̓=��cOqcN0�~|n�"xh��b V7NWp�(È$�:�_�:�a�&�*��(|,����o�0�/T��f_�%p��]룿>�����O�D]9(�I�c��+j�`.p��yNԣ���S2��ai��u��A�=yz�� �R�����I��QjW{Rʨ�0}9u��܇x�dVw���x�Wk%�j h�t�����Z���[�7�_aZ �b�z�M$Ż#����w(���ھT�ՐuB�1���Ml���u�m��''��6��Ǡ�w��"g�`u�4���o�!�ȷ9^\qE^�j{m�;�H}�>Y���v�����$��T���}e3\P�B�[R'��-(�����y�M���ѹ��\ �4HW�[� D�C�-���cx)m4L?��Z�D�4�Q�۟���0�IQ6;O�쐄k���*2:hG�(1۹����KmW���;U� ���!d���IY����۞���_7g ����8}��<�&R��'�ǎ|����̐g���Oi�5�S�δ4&X����-�χ��ˑ �D�߯6J����L��,5D�7�S��O7�+/ 8�BJ����G/. �xh�t�{^�̵Vg��d�ZT{� �`5�������)���+Ɛ�`ᄎ~FJT�����G���4�*ɞ��\�`*t��x&�Jho��lY�%}�����GLJ��� M2|������rkt�z�f�!ݡ����2�"H�li�aa��G�S����L�#�#��D���B�l%�q�m$l��2��K�9��+E0������ �n���j�C{�
Behavioral task
behavioral1
Sample
5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302.dll
Resource
win10v2004-20220901-en
General
-
Target
5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302
-
Size
154KB
-
MD5
71d3291d570dc5bf91120b15ff56dc84
-
SHA1
a7425b8abed1d8163bf682b510ad0f62954b31d8
-
SHA256
5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302
-
SHA512
c5b051f7f746eab6db2c00709fdb740e2983a9c3cf78fc3d3041398a6f6605d12649bb8af063f8eeb5a55855a229022cbe724e7a28d453c0a3476cd5742df8c1
-
SSDEEP
3072:H5SukrhEEr8bldysJ+W+M7FKW1GXQlK22x1aC1d1FykJ:ZSukxr8SsXQ2Cy
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302.dll windows x86
1cda86a2be3f9e7e7f5660b1f4791f07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetAsyncKeyState
MessageBoxA
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 566B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 406B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 584B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ