��nY��cw�V�A��5�T��E�l0����1�0VuH?���S=���|z2�u��в���-ܦ��3{c��Q:�@rP����F�W�#�? �+}��D�~8t��K�e0P�yăJ����>"�KXi��C ��|��j^_���������r� �)Ǹ�8Nɪ�딌��f���R;V?Pj�0!�B�K�$�I#Mx��aj���[�,���QA��ń�*���W�Z�d\�*;r�����U���!+ؚ ]�*#g�Ş� #��Aט]�#��f��ň��5k��W1b�FiL/��n=Zvy0z��eE������� e�:���N����xЏ�\��1�Q��s,���sd���eg��du�ݼ$�RIPr�e �: '�+ ]@>>a��^���WY����L���`�|X� �������=dS����JEB���cH�s���ߔH���F���v�Jx<Ei�|h��ߨP�G�����>�����phmc��.q阱>t^�f.<��-�ڂ�I�!�Ɔ��i8c��*�^�W���Ьe9�³�uh�m���}~�il�L�S0�_��:_��`++���C���if��NB}" S���si>�@�q5�_Bn��[#֏�˔!������c�e�u dȋ�(2I04笹3�-�!P�߯�`_kr�5�ֹ?�,��\��wx܄�����9?o��.�ٹ\~k3/ck�ߤ*>�6R@X}�?�gb���>�nr�-S��V�J��4TyH��F��e��8���Ll}��MhpI�����ؽ;�[Pe��Gig��A:�1nkk@�N�=EZGG����N<\R0��_�:�E!�~[*�Gbm���`�Q�m��_��6C-���g-�=^�$ll�.)ޮU�Pk�|��䢿=�I�_^|J��*�!\�<lm߫)�.E(KoP���U�������m2A̐Ę���ZT0�o"/n='ɑ}8V��e}}=]\��AM�"����"��ӗ�O���[�n"~��<i��r�{Rq��K��d�u�cQ� �p/%嵔��$2���]=7Mâ*m)����g���%�*0zӄM���xE��Զ"�����F(T-�o{���<��~w����`�B`�T>?��];�<�mo��ݝ�h��^~��j�ڝ���t �.�]�~�'财�����raJɧ�=�[t��VP�e��6��bAbs�5����cr#���I̸/H@�x� �. ?�ږ���M�g�_p,S�*�%�ڬ v�Ȝ�� 0\ ��P�ڿ"ceb|� �� q��"D�] �u�o�:��_|�)0Z�\��s�E��$|�.|�Nx��A�lVLA�Œ!*&<凉�E�;̅��E��8翗xs�WO�"�cƲ�L���_L=[�u��q�x���բA�)�*���V�ؚ�0���/�)�p�����������m�8y��7�酷�1�F�����i!��O:��4�m� ��/�0����y��{l8�\��3��u�I��l��[vQ�k�����p��sH^&&S�F�P+�#����d[G�~��1�2�n� �#�g�I�:�e����z��r�V�)'6�b�X�շ߷�Fh;[p����M�W��N�����g�yZN�����@p�]�`�!�bz�@kV��l�U�J�,,��.M�!�R���lBs]��)�H�ӫ���˹8�%�2�M��7ݕ��^<�<!8�q����T��9�B7��0 P��3+]��*��oE����Q@�5w��C���N2W�]E3����z��{�xm�3��@�B��T��*��M��gs���0�� ���0�n60#s�PH �%Z��������[�˱-�eڷհ��<�~4���������:�!g>3��Z�u�����f�&���v v9�vj�H�g��~r�Ҏ�X��i��[�@��{�r:��-�՜c��0�����{�ćZ,嚿��^�#�THS��י�n�|@�FN�w��5���q[���p�bp��{Hd&��WLen� ���,^��W@.�����ꈆ�J���?��3&A���w� F��|�ɯK���N�ݵP����6G�K�����z��)8�!�v��e0>��`Z��&����=��%@ �Z'"��U� ��0�R��i&p%���p�ވ;�Q��d��-����J]���X�l�9E�X3L8 ��j��a\_�!}�^�:x�p��b��8���1��n�@�i�M��^�捶~�J_���>�-W��6�T�u� �l�?Lp}`��$���wtZ)�!��@�{��]�Y-;BN���J'n-������3 �i�?��6Q�bA{�|�B��Ay�5�W4 �mavO�,�c+H<F�+H��%��6r*~ny�p�A�(�|��_�[����y�r�Y6�q�NN0�L�����W���11M�E<&p����Y�T����+����_)�����&�X-�S���h.E�d9����H�#��ϔ�k^����Ŕ�rYF+�u0g?�j����{^B����#�KH�{yh�������� � K��0{��P���>�jJ{B�G>���0�\�r&��?�[���s,�X��D���?h�ǧ%青:�g�C ��{.��5OM���-���Gh��o�i焠�>�ri�n#TiPG� ��t����'��؏�����Z�P[���_ ��8�~���Z��t�mb*�yKc�J?_L>���e�=����PEѮ����(�C������������c��n�d��F�MM��%G���f YQ����|�Ui��BJ$X�x�cf}�). RD��R���������J����?ҥ�B�R��T�Yg)]Ʌ��5t�[���Mα�j�����F�3e�����[I^��Qedd�Đ��U���Z�����=�k{�-QC��Lf5c$q���Q�U���|����Q��/r�(mZ��t��j��E�z�vQ���7Mܲ-�`�ZH�LR^*˙��4�ޑ��sO�N����,�Ӌi�5VOG �NtFP�rq�O��u�}�� �_g*47��J�����3����7`9�*Ѹ]�@�i��&ɱ�����k�
Behavioral task
behavioral1
Sample
34237181628608f32a7a7f8c494cda9fcda3573a9e2c7790ee39d76a282650a2.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
34237181628608f32a7a7f8c494cda9fcda3573a9e2c7790ee39d76a282650a2.dll
Resource
win10v2004-20220812-en
General
-
Target
34237181628608f32a7a7f8c494cda9fcda3573a9e2c7790ee39d76a282650a2
-
Size
1004KB
-
MD5
58c25301f99a7498907909aad7ae2a0e
-
SHA1
10d89d6df6792f8e81096da94ce45eeee41d70aa
-
SHA256
34237181628608f32a7a7f8c494cda9fcda3573a9e2c7790ee39d76a282650a2
-
SHA512
b8b46da219bcebaa51ff3bfd9db122ee6669c70ad3b4a7559df0448d3ba497c155ea7318f8fc32dff64ebd7cb38c15be1ea2cedf5c07e1cdd61d383d6dc5ea1a
-
SSDEEP
24576:VlZX7+URKKx0TDglTUOkxyM4bFfSXYBX:7RKKx0DglGxyzbFx
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
34237181628608f32a7a7f8c494cda9fcda3573a9e2c7790ee39d76a282650a2.dll windows x86
a5fd33c5b31f7dc1122a237b41720b8d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuState
MessageBoxA
gdi32
SelectObject
winspool.drv
OpenPrinterW
advapi32
RegOpenKeyExW
shlwapi
PathFindFileNameW
oleaut32
VariantInit
Exports
Exports
Sections
.text Size: - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 988KB - Virtual size: 984KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ