�\};��'3=9+,7dΰ���i�['"嚷��O!Ĩ�cq������ð��f�q\�R�������^�D؝d,�W�X�b>�d�rL2��`ji�T�������0�s�-��h0��߹9r���1���1�v4�L�����4�w����C�E��s?�����[_5[e쇖��Z�� -��x�*�V ��hU�B^�>���I�����q���j�C�Q�8i�y b���I�J� :�m���v��uP�a�A�UYTWپ>hF�>��;<�#t�������#\NЪ[_��/ ���+^�Q���^�S�~��'��v�@�X�\ڝ�2/�]�H!]��(�+����ɮ)�k��l���gS�؇��t��+�� c������#ݞ~ͥ:f���}���ʎLq �w��Mmx.9`�,l��)r��N�x���3��U-���d������]�K6)�L%p�q�c3��I�z�&5�=�?yՍzwF�8�F�x���s�X��c!jt+�.%N��B���ZR�=���k��� S����|��� ���Y��n�q�$дi���@|�V������dY��P�nKn&N� %���{yN���!D<���A5;uZ(�c���; x(��F�m3R�4�A��f͂��=�_����;Rn�J@W!U%]ȋ�؏1��4���^���h�Q1������$%�a��O(I�䷝k��u�D����v�Iov�s��]�4y�WL�}/�^�H�����ǶN�/���.nJЭ>��v:�/�VXO�;�>E��M��������7����_��[<�5k�r5rΏ�z�p��&�*����~{Uy������ڛ(ZD8�Ƞ��\�V�����j�t����q�YޑJ�6�]���Qʤ��%��Yi}��P��Dlf!����̣��D��>>���&m����|H�������\�,���定���Zڟ���*���/��x����2Z>D[7�C`=Dt!"B6�~��iX�x�ҥ�i�{�$�f���Ն���c��t��8���'��ѓ*��v1�z 0�u���f�A���=� ����V9�������~끔8���'���JT�7����H���ć�s(��_�KX�R�U��S�� �n���;!A��>���瓃��2g����)�8`&�1SL�����7^L�k9��v�P��C\`L� e��[�oE��Mo���Q���X4�vo$n�I�0��V-��u���X���~��łgS�Z�z�d&W?G�R���w����܁����?ޅ7���}@>���18�1�����I���JIq3����F���j��P���� �w��=�����W���g�~JF�+�n�2,�b#�#�����q�̙��_Y�8'}ր��=�K�A���xL{c��#?����MvAM�;��k`��͑}C�ǭ���/[i�����6h�ͥX@�O3�~V� ���$%SqG�l�ɼ�c��p���$zD ����4�����Q���<���C�>J������Z��WS���z������j�l�i=���.w�_�7�rխj��ƃ�!)��=,��2��m�[t�����I-6�L��s��2A6�t�Q�77�3����U��/�!�ϖ�vy� ����4Vb3D��k�+����z�HE a,��S�B�{��+�q$�wd���'qq�K,�r�U��8��h�*�$�� ��6B5vP��ul� ���R�m���Ʊ��\��n�_&�L����3���^�imM�<f�Y/��/�����A6��CU���(��r��KldWM�@�,��tnr�����5�����OEp�P=�����0���]����B�&���}�a��n�k���y��и�(���I9���vn+sVuSh�!���0>����8Ah��{�oR����W \"�T��{+{�n��Qݹ�l[_�'�w�g/ �G�x|$�������l ����d�fQSE�(}\ܬ�v�@�K�L7�7(RZ�?͖B���%��6����s����?���іN�3u��}n|��"8�`�M2���85����@���q|*��܇*���jLo�V�//b�eޤi�"��_���bC�L�c�FO��9�Uk��ٝ�5h�N�Ҫcؖ��h�S�m�E��5<��P�r0_��_וjx�O����%�w�Kc�-v\�'�3���9�����`��ZA���䟲�5��LJ���X�h��\�Q�����ȳ�&y����T4#��p�Xl���H ^�3�㊛Q`�a��`�����]��"w��r�P��P��|#� 0O�8t��*+�������oŔx|:�.�J9��}$��Ol�V��~�ʌ�� ��I��V�?�צ�U���M��9��Bd�� D����ܷ*s�[�Z��R�;sʓ�Q|I�{�)&�@g];v�<X�Q{&���kDDP���;C�#�o{Z�7������� Bǜ�����5�����w��BF��JK��=7�<0�t*�r?rG~Y+e��5�k1�廽�p�u� m�n������O����Q��(�]L>�v�$"���7h�������wN��_ԸN���}�3#��Y��� �;�Z�Y��Xt�������ԕUg��Aɨ�N3����,h~���l�z�����b8Jh����50;o���%��0�\Y�6,Ā%��E7�2��rB��'�Ӡ��-��%pzU�F��ݯ�������Ю���ET�1ϥԑl�����/h���xa��,A��5�n�)��aap#��Uv��QJ1q����^y7r���H��e2<Qx�v�!��'R�EU��V��x}�^�X���f�f@�� �_��@;��b� ��Ni:��u6��X.�1�z��U����\I����s�a/��ӭ$:�L�U�� ��N�V��v��`�� ���`��5�k:�+|ij�'~�^L=Ϗ����h�t�=�hY%m3�X��ŗ�<�D�#��v���lH:=l��� �E�� �D=�6f�Q*7��ܚ�<[|�$�����s ����:Z�6� �1�c1^�� �Ah��
Behavioral task
behavioral1
Sample
5cb92582194bae0097edb38e3fdd57cd5a8ad9a93a856bacbce04ae8023c838f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5cb92582194bae0097edb38e3fdd57cd5a8ad9a93a856bacbce04ae8023c838f.dll
Resource
win10v2004-20220812-en
General
-
Target
5cb92582194bae0097edb38e3fdd57cd5a8ad9a93a856bacbce04ae8023c838f
-
Size
67KB
-
MD5
55039e98a26da7d277560e4b9620b5fa
-
SHA1
b455cafe0c00c1fcfda0c8b301bc9209e4189e54
-
SHA256
5cb92582194bae0097edb38e3fdd57cd5a8ad9a93a856bacbce04ae8023c838f
-
SHA512
23575a8b9af4d766c794acc28211a553272880cbbd000e950d981de906b8df8a184325187d6a06a4c9fb72544b03365557f87abb0e03283307a6b9959adee4f8
-
SSDEEP
1536:gO2SMTJsgoihwBcC0RxSfRuJ4nFNZHLGHpj1AsIQdDAQ:gOQsQhweC0iZE4nFNp07A+A
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5cb92582194bae0097edb38e3fdd57cd5a8ad9a93a856bacbce04ae8023c838f.dll windows x86
3e3dd3d6cc7934a9c930ce254cf7e301
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 665B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 270B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ