b�����Ȕ���^P8��v7:b����q_L�)�鋢I�"��$�_��nMi�3���131�YG+p��-�w��jl�I� ��~R��AjE&���v��r HK�����ʂ�i��T��.����h7�:ҷ���;*iņ�(x�4�ykQ_�{��"vt1CZ���.�k9,�%*�t�������a����e���a����Ȩ��}1n ��d��i�dz���F���m�b�"���B��V�>6�����-x��f}x��1컨����0lb˷˼1�(`��00J o����k���Y� 4e��Z�=t�go|5��/8=i_:���.����ڳ�������I�Y�"�?��9j����y�v�� �d����^X�[�}IK9��<q��5ϱJd' �/e���B��&��}�;�����M<U����SP�Yo_h84��~� R�⺎�~P�Ю�������W��Yա��O)lb��.�X�m��!B"Qu���*�}���� �|��3�if����B���݇i{�,� Kښ� ;�C� f�݅|'����e�^*D:W����H'h����T=�9��zbv��`5��^� �4�^)�2~G�.5�+���}�R���4:����&<�4Z�*Q¦͢�RS�@��Z�������&j�8)���e�[�!͔g��$:E��Qc�t�%�Rf��z}�J瑼z�Kj����>$��y�s<�A������P?w�!}өjLU��=Ï~�ɖ��4���^�����M-��9�UZ�'A��.Ƒ�]��Z\Th�UvbNKDn�N*�o^����`����>0�)%�B�b�t_U�D���7��%���I�4�V���avt�@�w�@;7\�d�<�)������Lӝ0���}$�,�K��Iy���p#����ŝS�����\����V廾#���B."�ڥW�K)ȑW}�r_f��cFf����qr��Eo����&�(sx b�$U*�a�V'0�3Q<�M�����8�ʚ)�A�ALj���;�U�%�eYK��+�s��I8�kt�Lh��95c���^���o/��6~Y��R2{hh�v_|�k�@��_�YL���)Vc>�����|��B��W)�ڕ�P�����B�Z���:z��3u��e'��i����熗)r�;�PA$��� 32(���&���4<O�;�4�0��9y �sO��@��:e|Z��� �/S۔�y��=z�LJ�F#�v��R�9���[|���-k7r8� �5�x5[uk#\���9��Z��vw�H�#/���#��?2��m\����:b�6���n������5Ǫ |,���.���8(��V�wlm���8':����o��uy n(��&�;�l��W ��:u:�E��]�j�`XE�b�KaF�@�^<��� ����8���r�|�"v��4{�v&I{��RǪ�Mk{�*�o3������tE �Cji�&"Éτ�O+,��y-�ED4� c�@�v���K S�U�6��������-h�x�0��W!��'8��n�X���>)*�@.؈5CࡄĠDnE Q��[�{1�D�4�'y/�0��7b��n�(d�\��W�+.0�:���c~�Hz*�����,�ct̲���3�} �T�˗1c!W����ƘT�L�=�K[�7"b/e���*�dt��=3 �B�<;'zd�O;�C��bd�h�Ǩ�(��8���v�0dI���������%4b�/J-��->[\��H�`�� ���V���@��=r��T���v���I@~��5r�֫��[�=��]��ƸB@�o�yJh9�?r�����$&�Դ}+7vQ�.���۾:����?�2�����ME�>�S�s�T�1�k�%o�i��G�HԉvKת�6<�A%�i|0�F 8RO� 6�ÛĚ��qk��� cH�j}��!�w�g�z���"�œ�;�b�!O�8����!�)�Zx��nT���FM�I�P�5�^w�9 ,d�'̑�21������J\${Sg��#�����7k�|��6�s<�ZA���Y U�2YÙMrV=ա��9��)���:�v���څ_ �a�_>���վ�#���9f�T�� ��"1 n6�W�;�����6��yd��6��vbe5���I�H�q1Ӵ�5L����Z �N����λ��r ���"Y�4��{�-3F�B�DZ?mF���2S�}Z�=���o�ib�}:��ԡ�}$;�����G�N"�4RLQ�#�@��ڛCsɕ�0|�m�73a/�S��|�,��yæ�����߂Y=$���[�|B*�6d�ȼ�6����0��e����'Sj���kB�Ɋh���"Z��U�Z)n�hz~,�h �nb"e�/��zl�����tچy%?~�My+"m��>S�sO���G������R$Sq���tK�m2�E��c�>���?�7:~��9��eZ��.�@���Oņ6mE.?�P�T^${*fJ�Z�&������n�s$,nz�ǚ�K��I/"��@�������+D����UC��@L8&&��� ��jgGc<\���*ރ� �,�γV��'�=��W�nÚ����좐����c-3 �7��A8n�Z픨�[B¶�G��(��79t2&�x�9�aO=��-�G�0E�EW3��y�����؞p�ȭWsi�G��/�,#�QZ�εcP��@uW,e����vS����b�\�~c��Ǩ�R����ѩ�~��:�����M54��g�B�҅��Cӛf�*o�.*����JB�O����(M�`QfJ��<L$� ��HK�#B�l��P �5�ciK�A4���L&��o%��]�}�����/'��jRі����ϻA.�V\yUڣ��� y7���r� |ž�"�Rzʈb�s�@4��g��)O��p�S*a�h4qi������E�p��Y2�Jp��n� ��{Pt�]����/���0����f3�������X�_��yI[��Èv�̼���fx!�������6�( *���f-��?��3�[f ����{�1������V�j�j�
Behavioral task
behavioral1
Sample
05a72a438d1d42c82b3819051509dd2736cec2f07084e500277d7e4fae6bd90d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
05a72a438d1d42c82b3819051509dd2736cec2f07084e500277d7e4fae6bd90d.dll
Resource
win10v2004-20220812-en
General
-
Target
05a72a438d1d42c82b3819051509dd2736cec2f07084e500277d7e4fae6bd90d
-
Size
206KB
-
MD5
bda31e1c72ffb63917b923d46fc7541f
-
SHA1
97482c0b18d8e0b34d84187fc4649fa97be37b4a
-
SHA256
05a72a438d1d42c82b3819051509dd2736cec2f07084e500277d7e4fae6bd90d
-
SHA512
3351263c4663145c31bae436410d8d420bac9bf735fc645ab1b19e805aef6c3d7305a308559f1c9ba45ba51ab96a8ef20a244241b7865b469bfa20f51ef171d7
-
SSDEEP
6144:hWJ1rrBvWDe+DfcmMlgI/G00cfIVr/de8FpeVt:hWJNBvWi+TOJ/G0FwZFe8FpeVt
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
05a72a438d1d42c82b3819051509dd2736cec2f07084e500277d7e4fae6bd90d.dll windows x86
32f5bc5eef419b0fb2f2ad905b726212
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
advapi32
GetUserNameA
wininet
InternetOpenUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ