���>�i�q�q�-Xn3�T�_��<��EfU�x�h���YP�F�6�(���|;)������ �V����L0���G!���S�>������L�I�����|�)�ȷ3��a�=P����<���zO�w}O��l��v��ʧSo�|Z���u�%c��zz���$�# ���HB�����ZsŻM�Mꉴ��c���x=�s��0Ӻ<<Y���1g�\L���C���;͉�_TTmޕ�2�\O��L�#���h�*h��Go��;�($�K��S�!}C�4�oZ�u�r�U)���6�c;�(��;�.� ��6���C"-���" +A���4�vw��gH�^c5�qR4��83P���s�^J�����u� y���ڭT�eF�s<f �!�a���a)���ҥ����4�.P�����2 *ۻ0�׆q�Cc�o&����_�x����,-(�<mArߜ��ʖ�W��V�أt�LC� ���~��J��i�f~�_��PB�%Ei~���i�a��H��b(z�e��R��$���^�+� �����ޟ��i�i���&f�%�����!��?���)f@Ĭ/�N�Pc��+��k�9tI��� Y�x��|5�����uE�U���M�b����v�K�K��#�06��{(��w 2�v�Y� ��Mr�� ��〴>�k ���dk��R��?ȺS�j�l���Įs����\ŴU���Iu na��5��>i�L�l�ڎ����6��������� m�!\��.^��|,z�J�'��J�:�vM�)-��c<�"����+ղ�_��8�ാa�Q�?�\ԣ���t��?p�Q���粑bi��r�A�-���$qP��*��%���w��p�z�����v�V�y͢�sÎ��e��Bd��/6�v���dS;vi�Ƣk��x�C�k-�7��]����{��P�i�����ry��;�Ip��{�6�?R�q��Y71=n�MX���#����^��B{9��)��aߩ��W�����Y%�Ķ)�X�F��=�_U�kd�y�j����"�3X4��[�:��uB� ��{Q�'��2�8����09ő�V����K�� 'n����Nʓ���Il<k�yd�A�UQ����m����xI�e�O�b-�=�z���1`_��P��$%��Gj��H�wog}t������^v{N�#:� ٕ�l.v��]Ƅu��W�+���\����ybe���+���[l�ٹ�;�{�=�#����)�p�T����>��l`�! �?��X~�J�_ ~�ܪpqZ��%^Uf�L)'�n@L��B`���c�pɤ~��Bf�a_�����l���30\G�h!��b��������˾�q�ӨX��b�z�K]/[�Z�"���8��~�!ߚ�:�JKJ�,a[8f���?{�dk��r�*(��w�{�����[.��c"]u�o~]�T����.�)dj2�9j ���g���J�/�lY��ok�(eb��P5�sǛ�����. ������$��m--Lڙ��u��X|����tx��"�g�и����Tts�<��5�����q?� CC&=��d N.!����c|!�"EgX���j�A 2h��2��%�M��ڨ#��tn��Q��f<���YrG7L0uQ{`�*\[�T%k1���Ԙ��=�㮒�G�s�A������?@�p �i�(���}ٛ��mo�D� ��| ���L�<+��]E�r��Q��Y�@!�ӡ����9ܥ�N�Ul�n�C�=NLU�3W���N���&�; �Z���I��z��s"�dv�f@�j��9J�ѩ����5�r�.T �s�D��A���Aou�-+N�W�o��v�܈r K�6b��xTB|�C�FES �������2t��;���ƆӴ}$������'������eH%���6./�($����|� {qLU��^vcj�����֘�L�Y�\�G]�]�����nh�*k����9�%/S�!�]M�$�R�j���V7`�ȏ�`ư�pbA��-�Q�}{%_���Q�_;I�l�p�<��� }��܁�-���X �=2-m��)�5���=��k�������UƐZD���C���e���9��Z�6Lh#����uJ?^��_ ɬ�W���b����n|�d�q����/������2��]�I�ʅ�ٙ�\�n�-N�Mg�I����߾[�i�ӯ9���y�� ]g�s�+��Z.2(�'R�%�W���&M�����:y]L����'����Z���������X k�>�v�������f��� ʍ�V���U��`�����m������2K($s��1�!�����⎼hIS;GƲ=��n�j$]<K�3���g%������̧�����C����l���� ���x�e�:��=[I�vk�����y#��r�����l����kz_;�xU�U� ��V$���ي�r; %Ż��#��j�0�E����=�A]S�Y���K��:J�&jݲG(>�I�\�yRP���F^��+����~��`�!A��n����+aFR3_�F��.��d������|=���j2��N��?�������%�� .�� �ņh�lْ�f���)��)z_�9�$R��I8��9:��7��c-�W�aB�X�J'|�sXؗ�te0&��T��5��+rx� �K$g�T M %Q�{Xھ��i���%g�R�7m�;�4EXhsg�N����l`��h�E���^d�-7+V���,����-��,C�����^�7x��F�G;@��;��DZ�K�̿����2��CGO,�� ����D�̆�@2��)�FF�Z4D��qfA~ޛqFj�[B����d��4���(J̟����"0������d�G:���.c�S�A��~EC̦�������F�w����������h~Θk�6�:^�*����ݵ�'S�tĕ���I!��� ѭ��Z����!῍$�����b:�& ��Õ.{D��M�vDt-!}k�?���#�6�7E�`�y
Behavioral task
behavioral1
Sample
eae85c29fd210bbc0df0718e8fb297d226c3e534d62ca2ba86147218e307ea91.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eae85c29fd210bbc0df0718e8fb297d226c3e534d62ca2ba86147218e307ea91.dll
Resource
win10v2004-20220901-en
General
-
Target
eae85c29fd210bbc0df0718e8fb297d226c3e534d62ca2ba86147218e307ea91
-
Size
1.1MB
-
MD5
42439b592be666af043c787e8cd3489b
-
SHA1
c4c6955cf623af195aca4b9b2d4678cd94b33fb6
-
SHA256
eae85c29fd210bbc0df0718e8fb297d226c3e534d62ca2ba86147218e307ea91
-
SHA512
39130ac70f3f3929b9d4afe86e59f691100fe30ab70092c5fe371e10a3698c723fab916942743f017b4dbc6e1739db2b78ec64deb78f85e05e6d4ece10bda2d7
-
SSDEEP
24576:2tXdutUhzcFcShzS6nWJI/EifEXAqDOkk+hwsdFk:OhotoFJIdC7wB
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
eae85c29fd210bbc0df0718e8fb297d226c3e534d62ca2ba86147218e307ea91.dll windows x86
aa97189f58c1e273fe14797ef0469678
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostQuitMessage
gdi32
CreateCompatibleDC
winmm
waveOutClose
msvcr100
strncpy
Exports
Exports
Sections
.text Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 440KB - Virtual size: 439KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 440KB - Virtual size: 439KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ