��V���*v7����A���B'�x�_0�5 �n�|������3����H������b����@ODrL���}���G��� �E�ћ��T9�U�Dgڨ�/ɘ�톪=_\�+EɼD��&G��c�c0o�F��1B�����6B �3�4h�'�2��N�]��Ir/V���ÏdǚeW�U�ި����Y��^&o͌�!���Ut��D� R�?����r��hk�B;��L1��]*b��L\�u7G�l���Ô=J�[����W"8�?V��pdp)½~�-2���u�U�Nt�� 7�M��m��k09����$��e�B�"���b����!�Ks!��� Zp8�z� rq���x9��_Z+yЍ��&(��a���k�|���PvC� �G��\����*�ÊOD��N�c9]��I�*��C;C�]�1��K�r�k0�*,���/�P�5J��ףJcX���3+� t����I����tn'-lE%�B���`q���bu@���e$^f��%pί8���+��p����z���^9'f'b��Z��4�eSmc���!�>Vx|G���z�e��ʠ8~>&� �w�����Ё�{��#�L|�>� ��k. A?���ĺ�<�AZ(�Z��A�� �TFzH��^i \Y�#����ލ�N9jU������]��8n�����]��u�)P8b�SV^N �h�������P�Źp_��R�_�`�k�dq*mg������RWߏ�s_�1$g�wz�ϙ��o���i|C�_n��?�W��1�# ;9J���\Sz-}W�(o��tkQ �G)Ydap������9ËQ�����mA��=6[�n�ڝJ����Cs���>F^�(=:cUY332�w/?��.�m�Ej-� ��&�uab'w$4Okfi�*���:���ߑd�J͈��B�h�;�&O�I� ,.��t�j�O�{�.�=�(J��?;_�VRKE3�4�y��u�,^�@�|!��#������k j%�H>�|JkC�G7���&����V����T5�7�c����u�>;���͢�v�פ���W;$Ѐ�{����x���3����)Z���A��C(��y�5��K��\��""Hk�����B�Ǝ���:��7m����l2q�#�]��_�X�>��Vb�If��� �ʸ`jq���]=��mR5������0u��!���p/��3,��H#�2]�+M���r�B������W_O�l���sV)��l��y����ȟ����Mx 0�����n��zd��E�NQ����ѩ��W1��ۅ���0��N�1�5TIǮ�� ��ޭ��5p���J\�tģ����:T�tf�Rb�r���?�(���Q���{�=L�9�8a�A� �J������������\�r*���҅�|C�fZ��a�abz��6dʳ�"�{[)���d&���j�t1砈�'��`&��p<Qh��z,I+ƌ�� �Zmp|�E�i���I(�Hʴ�͕���>t�$K�z�Dy̎���440@�ӈ��%����+�r�:�X�Q{��ΤGS�<ۄWP�Ʊ�2"�;4"A0iRo��t �����4���d�t�D�� (=��K�.ze�� �"��`����[g��t�CqfYQ_����E���~�D�KE���3B>K�D���}Љ?��,IjH�Ѹ�;㼥4���]]�8����P,�<����9�ޯ"��M|_�fuv��M�������o�|7E��S�o� O[���0��ߣ:�5ƕ�SK�i���*�47��'�:���@f���eݼ�,L��g��l�������V��J � "�Ĩ��T;N&C5��+=�?�k/Ik��o��fm�Y��J�r/N۠�EK��5���V�>����q�@���>��J1�$ ��d�p��IZ���b E����cl�B;H�gi�Ҡ��Bk9�0�w��o�y�fx���P��@��K�u²ș7�*t5����c�1��x>�ۻ�C�D�� �2�;��E�)W|�.�Z�m� 3(�ʨ����5�m�ǧ�^�Jbi��|m�1���z�T�#b]����;�F��u��a�?���Ҷ?L��t�aO��7������'''�p�y��+�[��C��B�x?��`BS�.J�n�>� A#��O�M�G}z��> }�w���W��<l�|��M#�+pv�d�2�ƭ����1�C�S)�N�����>˼y�˸�����̨f AN����z��F�N�P[+�lp�������@�a�ZW]���2�n�����?��:.�fe�+ֱ8I������ z�� �� ɋ���|�bi�;��S3��X��*⟗Crc�/����)��{*��0n�Δ�{��Y0�����M9-�ɟ8�����O��1�����S��������"��\��C"�K5�{&3��e�ko�=��"S���#yrW�����o�}3��B�'��u٭�����jtHe��FB�%����}��*m)��;��p���,��u�=5�����E'�Z�u��$���Bm�+�bFI�d��Zʍ��]M�����1mK�������s��P�Nnr��瓤 ��B0�����G4J�r4� �=T� l��Oř�b�-�w��p�2���;����r�~W1��ؤ�o�] ���&\� �͢T <��ѾC��)qϓ n(����������9߳?�'쯝�xx�f����u�}��ݙ�u��J�J�Dզ �Pt MnF�žq�jV�@�3�!���2�ɩN���0�-���ޒ��g�MT*����K��9���-[�G5���D��� 6�O��_P$�7��?�i�7�Y�#)n�ĩ��?Cf)Ag�F��C�b��S��؍o�C�����Lur�tDђ������8�u���A�t��k��B�=�I���69L�s:I��E0i�m��ق���r��ˏ�4z�,����k>Q]�#eG�i�5QLa3�ء�F$��D�::�f��W�E2�J -k��'Խ�ek]ټc�=.pg����㴨�.Li��E������D��S���
Behavioral task
behavioral1
Sample
3078b7bb3260fd7caa95d8f2cb64891f803bbd487105ef48742fc2e6f63b6bd1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3078b7bb3260fd7caa95d8f2cb64891f803bbd487105ef48742fc2e6f63b6bd1.dll
Resource
win10v2004-20220812-en
General
-
Target
3078b7bb3260fd7caa95d8f2cb64891f803bbd487105ef48742fc2e6f63b6bd1
-
Size
1.3MB
-
MD5
84186baeda5a7160f6678ebc6bef147d
-
SHA1
5be06271eedd785357251b5cde5c282896f7e1b8
-
SHA256
3078b7bb3260fd7caa95d8f2cb64891f803bbd487105ef48742fc2e6f63b6bd1
-
SHA512
119ab89dfa0994c59e42d5467daad37f4bb63e7144fb58ae1f19af20bd6c8d1ab283da148fe3d083955bed7dfb364bfbc3f700a36953bd874fb698c079bdd5f4
-
SSDEEP
24576:Q87Zc1bIZYbbX2qtLmU61Jfbz8axrEgK+QHV6sFi8/B0TsU2R2eHVzvdQ:X7Zc1bIMbptK1Jfbz88wwQHVRVB0TsUj
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3078b7bb3260fd7caa95d8f2cb64891f803bbd487105ef48742fc2e6f63b6bd1.dll windows x86
33db826f4a282e6aadb5bb20d4d723e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
SetTextColor
advapi32
RegCloseKey
msvcr90
fclose
msvcp90
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
wininet
InternetOpenA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 340KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 790KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ