�&%��]�1>���F#��N%3����#�ΡH�Π`��y,� �5�Y3��7�ρA��l���8�Q}Q{�*,z~���o?��;J���:���{��n6N��F3� vĔR�$��㎜ґ�TH����o:g�"sꇤ�H��*{Q�w��S+"��E��*�x�R�����Vox���o�������2"������(��;���/�7i�47��u:8��n�<C#���!0���ġ��G�Qj4�Қb����֤{V�Y�q�r2Y*UJH�2z��ޕ�r3��|�I�==���L�T�#��"ftܪ{M�KeIˏ��z��)��CouP�vפͿG�K���s0F(������ ��X��0��JG�������ORw�����4�I#>����a��5���_�C6j σ�Ï�)���Y�p#�ZN��\�۟`��Wy�e�s��A�4���$��Fu��\��c"���q�� a*���xW(eER�e�G��*����|/��1B:�7IA� %g{�������c��7�� Y�J�z�W�����XL��w�\��̉���.oM���:��6��Q�,��;K*��(}��;bK*AD�rHL����L�>[ _J�!�џ�f(���Y��y�'+s=zL{ ��w��%�_l�/f�Y�.��Ji�A3ouR�X�1�D,<��U�W#6g��R�W�RR�H g�{��h�?Gv������"6P�������KU�sC�'���2��/p�cG�eݸeLH$V(8[�EV*#0�����v�1���P�b_\9�I�$�5r?QP 2��Jҩ�&Ks����X2n}��Z�sm�� ���A;+��<\���g��� ~��]`����_9a��?B��������%�ti��p56��8�^@�Ijm����w�@(��b&�i�ZEsY�rue��/�.,�|��(���1Y���aS����$���Gc�"�h"U;<iN�e��BΪh���QJb+�c";��{���<lb�������O'q�0� N�3���o3��:���o��������o�D�-�NT^������M������OZ)\t2����Gv��l��h�ܳ��3��� ��u8qA� }��#M; _�8��_�8��1��$�����뾞a�K��v�܁~�ᛘ�?��{�醜v��Z�x6+)��b�Jt^�Dۉ.P�6��"�n-s��jy��QD|��Gw�Ŏ�%�9�A�����:��{����45�^��F�V:6B��Fv.�~9��)�^�Kq��-�E�7��Lb8D����W�^�o?߸��Ti���6��-e˘%:E�zg��F5��,;�(rK+l��b�}�vYHIV���Maw4�@�|���e�[ɌU8���w@���I�)��SR���q7�L�,(�"w0��|2��x���(�D^�w[6���lq��;!A� �.F��9*�L�H*_3�5]O����$�MZ��;��������Vt(A �a���e:.�CcK�%Q������U��u�����J��):~Q����.�����ITi,�l�2�D����\��!�����a�[� ����:��ւ��F�4����P�#��=�����������hlWK �[��Y�01����� &o�-!R�U��ԅc�a�����fC�>��c�~�T��~��+����D�M��V��q��7�y�@�Bf~����lcj=6�^c�hRu$�I�;ۦ2/�OS���)�Y��h��:۔ w�.��vI�b�)>0�E �Dw�$���m�δb�~�T�T [��� �5�v�G��pd[�>]ܜ5%�_�y��sَ�S IHK��DU�����k�;Np-I��C[���n%�Z`_��u�k�r�9���p�筒S^���&T�q��z��j.Q�dGu�:�H��1T�m�r�9iKH��](����r;�9��[-Z��I�ش��y�����3�m�6?��z?{��vSz>1v�t�ّ�;�c�\M��AA�)aW��?����i#T���nP��O��Ky� a=]��}�I�ZR&9�i���c\�pWG�u�]�W����u̚�����F��M��h4&����na,``i�����&����N�<_�������\���4���Y�:g��[�p����YS�!�*�3]��k#:���f�Կ>" 6��+�(���?��2��Ga)<>�f̋��}��Ć�pk�)���w���/�{�)�Q��,X�ī�Ŏ!5H�n�2e�G2��.��!��ss�&�A��Zj'�%wm� �a��җ�� @�8b��=YB�t�V�ѓ8��>���ߦ���ā^���< �Fb�� ��� �o+i��W�eҦ! H��Mp3g�#w�����7"M}�n����b_8������ff�JB�Y��Z��~`*amfH&B�ʛ���҅ ��>>�Y��8�<1q7��;̀������+&��0y�R)}Z����Pi�T�T�[Q�N�90.�$�k��k��aCJ�(sb� �3�� �ظ"��U��a�>��h���Vt7��@!��1���M��B�C�����T��&�+�~�p^o��0&Eվ?�5��m�����?)"�������h��.����J�9ntױ"+j��{9de�P'�T�-��p��Z� �ݗ�T�7�����\����F��f5��F��ju�:���"S��h>3e�O�Uk��m�s�N����K��������˴����6m���ڊ��u�:w�zب!�b�J�4,x&w��q3˃�DK���id$,��F�9�#/�n��R��c�N_=v��ZX��`pL�l�`-�U���6`�3�BX��!�Kmݽmh,# �Ig$��Py�/��@�6y������-��o�GT F,�VI��0���E��i�� $q��ɺ|YwV��R@#�-n�}�X2�D������P����� b����Č���h���V%����i���<8<�H $d����"AAR{hq3�ұ���s�v�<��t�S����ԙ���f6� ���}���\����l��J��
Behavioral task
behavioral1
Sample
3f71ecaffb49a1f79a2d81144e6eaf1aafa814356084f17734b352c0175c47e3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f71ecaffb49a1f79a2d81144e6eaf1aafa814356084f17734b352c0175c47e3.dll
Resource
win10v2004-20220812-en
General
-
Target
3f71ecaffb49a1f79a2d81144e6eaf1aafa814356084f17734b352c0175c47e3
-
Size
356KB
-
MD5
b003831d7207eaab71a3e8690f5e7f91
-
SHA1
a820e6641be4f2c84776c098a0c12048fa946897
-
SHA256
3f71ecaffb49a1f79a2d81144e6eaf1aafa814356084f17734b352c0175c47e3
-
SHA512
066caf8a50346305ca79d01ca3e2cab42494ed427362077b986c275d44cbb25892a7a91252804e9910978f621031d539b6c3285dda62b2340da93348a7466047
-
SSDEEP
6144:TclL3iw53qr47odr6uYAlDFTMxH9Z1gMKiJNhLxYRKMzsvSSnQIkwsDnKiw/q0zE:Tcll53qr4cIAuRnKiJHIJSQd3nD+q0zE
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3f71ecaffb49a1f79a2d81144e6eaf1aafa814356084f17734b352c0175c47e3.dll windows x86
91137259eb618175bac5ead565c0e00a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
StartServiceW
ntdll
NtQuerySystemInformation
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 353KB - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ