�/WH�ڛ��A����,�U��v���QLS*�.�[o�']kH��p��c��VId�>dJ ݸB���a?�NZ���.Gu�&1�9z�uJ� @�`;G���f��3��{�@o��p\@���u��WZ�mi"J\�� �ƅ�i���� ñ#����"+���;�z"��$dh#ە5E�d�QVA�IA2@a">�:��8�}��:c �7��&�~���?��4,����mEDB!0W\w8�,f/Gl6�9�Q�A�M�FC�|�!�$ �=�[f�5�/>���V���FI�hM�GP��9���0�)L٩�Q<I��D7��"�F� l7Nm@9���j�#7t�J-�~���3�f��OrO� a��Z KU��k���v���#��#��d��5�#�Py������n���%����n�l�6Cf�y`��= �q�>"f$�y?���c�?J@s-!h���6}@��]E'�������R�)$�o``-�;�7�G�4�7zO���� ��Y��rM�qT���~l>�v�x���x�"W���c���*�^��/9�<��ܘ�Pڲ�V�,��uw3��hI�,�a= w����%95�=R�+��ͅ���+�#p�%��EOq{}�\|M�O@K=�D���p>F3����d��Up�a��14��(2p�B�$�@'�e�+�K��Q�����ˮ�{����g����+cԏ *��b����A C��'����xX!)pmn�y�����9[Q�k�����%�}�?4��$��:~ ���� u�Pb~� _r�d�!����^`Z@�s�����^1��������6�2���_.��k+ ���Q��~@{�ʢ����1�ڇg���J+��E�����k^���T�*�-�w_D���hw}S��<6����#5Ҥ�����2��i��`��Z����7�I:�\JI*��e��y������:,_��|�8�Ϸ�a��;���#>�����a�����N}K��;�SA=�P,���|�I f�Mt\o4k�֜-��P"��KH����C��1v�x�����J�Q�������,Y���'���S�!b�@�|�3";�'Lg��`��j� �-� ~i9w��(��?�� xU��˥��ױ?f�0TD�|� d�F���z$K�ˆCi�����!��R6Yڞ��g�r��9�yC��c �rf5P��[˚�XR�%�æפ����ew�AΗ!�E���U6�SIFg�|�QG+��?��ª�y�Y�]�� �� w�M#u1��rCLZXP�� ��NDW ����%�G;f��r|�$R@�,�� w2��_]��O(Om� �KB��=3�?��~����vr})�mjO���l��a6��r|5Ѭ1���1_d�Z-_kwz�\��FH��`wb���M�JM�خ���J\Õ��KRJ�tȿ�h� ��p�^W0��n�9e���~�t�I]���=���:R��]H�� X?�Mm�s�6Z�"�e�vyù��D,=ˌ܍,���ElM^�l/�U�oG�6�2C��u���@���HI�����L�-RƩ�3��G���'���#�E<��B���y��x�̾�׳���ԶXI�����k������5�����~o%�7��u�22j����;�]N���[Q�4|\`v� � r.����g��a����M�Vι|\ܔ%���#��W��W@8���TV䘨������bn��k�C���f"3��b�����E����,l�oBW��������]�s���1���Ngq��^#�]Gغ��ҝ��a�^�kv|� u��5Q�!������r ZM�L����6�m�� �}�@Xf@yL�>Є"�v�Ur��ߔؐN{v��EXqs� mⰸ��}��v���+Rx�Fc�?���F���$��$f�RFo����Y�kx��W�ݺc�V~�H�ބ�{��Ե]!��{���_����Su��˿�#i�y�P�M��m���Q!��=֥�g�AWE*����d��d��84���N�Ls�p�Ȇ��k!�2�|��T�#�y�uc%Z��6��Z�!��r[9�A>S��>��H�P��pwΫ�HnD�tQ�������_m-��u�.l@W���C� }���T��Y8���r��r��;<KN$ �}P��;� ��v;���B�>�S���d�6���o�=��z.�K�Pri� N��8��%I(�=ǚ�%jxF�|�c5+�t��c0��3�>h��_y���B�j���� ���J�d��IxpWJ�rz}K��x�uj{j���匙�wkj��{={|*�M�����5d:Q��i߳+Pk�R'�����tҵ��?�]f!+)S`����2=�Lcҍa���-�Y �C{w"��_��Z������q�֚��Ø��ay�-���[N��e��J�{�-�±O� 1p�O��5��ޥ�[���L��e��r�%���<����Q��c�9]_���߱)�>�tW7/�v���C�4{ w� o�P��»�7�Y�Yt��#����`�˼D�#�y�����4Փ��H���B\���=-1:��~/������;�������5}�氈� Ogr���.��6*��*K���j�<�Q���{ p���]?�ҷ�}w���O�јy��zҜ4�r����@�ߍK��gx8v��1��o�i�B��;�t$G��0J��{�U����lS��bK�C�Qz�ʓ���ͣ��<�փ�f�]VԍF�z0���� 6�k_������jV���L�Ul��M��'���,^��� V)��[���T̩-�~lC!�אf���v����#�q⯁��7p��#��ĘX:�o��3 �����5#Sk�pH�ݗ��H��&�<���f��"ƈx�AJ�#��+>nxH��D�bǩױS0 }�[u<U܍�� ���S5ȸD9�Ό���r�2߰��,m�by7��V�t��~��t eC�H�:ʟg����H���>������TP�?w�"u.��_-Q���_�[,��}�YhR��E�X`�h�<{�)v�h�p�/)gu�V��r^q�LY
Behavioral task
behavioral1
Sample
2bb362a5f34ef13d763ada655d73338789cc0816607139b7ff3981a92739a4e5.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bb362a5f34ef13d763ada655d73338789cc0816607139b7ff3981a92739a4e5.dll
Resource
win10v2004-20220812-en
General
-
Target
2bb362a5f34ef13d763ada655d73338789cc0816607139b7ff3981a92739a4e5
-
Size
226KB
-
MD5
6a9a6ccbe652725314278e26de48a117
-
SHA1
ac165173a9389625dae40dd08ad170c32f99e59c
-
SHA256
2bb362a5f34ef13d763ada655d73338789cc0816607139b7ff3981a92739a4e5
-
SHA512
1db2d775c486fb1f7fb9cdd80cd16e841d1e07e57973afd5532a895be44b3d9a535a7f352d414b7a127db44bf28b13c8514156a4a4b926f3bf0976d1ac81bedd
-
SSDEEP
3072:co5W0s/B3cf/P8EZ83kPn2WWis6kTfgtI9gpvQv4zrn4ODbw/wPjxjD:cooJs8A8Ks6kTK3pvfv4OfwoPV
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2bb362a5f34ef13d763ada655d73338789cc0816607139b7ff3981a92739a4e5.dll windows x86
85f9f5f56b781f8da0f8cccc3a61e64b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
BlockInput
shell32
ShellExecuteW
msvcr90
_amsg_exit
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ