RG���}&�����W�PS�E��0���2�?<qiaA�{:u� �+vԬ؎�x�f#�?{m��� b֝q�͡���(ߝP����9���G0�b?�{>�MT���N� �����RF9t�pâ����ܒ(|�\����;��ٱ�#'�oDz�,;�&���Jd������`1�М�<��wP� )%uŐ�8+n����7��B��̮;"Fb�5o�m����3/���&�~�i��x��1 Jo�|���h��P���g�o���l�vse.Ij���X~Czɂ�W���iL�Xb�܀��� �H���A�/�X��|#::@ ���ʖ�p��.(����5̛X�vT�sm�l���̱4�����������G��R��TC����.QW)?{��t�p�y�zX���fX?��>�gUԢ�1�MI�*Nv'�(@Q�:� ��p�Ӷ���ۣ���t����]`w����SyϦ���&����XV�����22D�y��b�DZ�Kp��u���)�,�������M�,*.Ի��/I���f̺ ��kM;����'�S~�C�R���P�.&%�N�(����B���W�F^�T�:��0�>�8���{Ș�#�+��s�ho�&_����� ,)��Ӎ��?{��Y!Dy��i�'�e��,�ko7�7��h_��Y�b����~� G��m�g!G�F��AKݯӣ�RR_�eU*^b�:�?�,�}�z���� �{?���:G2��rh��:�PY뀾�����mS~y:Y�Pd���L���H�9AӖ�����!]T�7�9����`}����6���]�QEd}U�jpnt����h�z��&*���!I�`��Z��D�|���� q�3œt_�%fz-,�0>�v�`��v�~���y�U�6���e�m%dnN�P�D����? Vd@�Y��L�3.`��� ��N��"X�վ�,$�� ̖?̎�<i�ɫ���d֜�Ƒ�>�`��h��������V�`�������w%���!�iO�� ^w��)+���2M�]�j$������s�K��y�/ȷKPW��C�&k/�w?���m�l��x��J�l�fØf�i��ÅT�Zpl2I� ^��;h��dk⠘��S�־�ּ����p�� ��؉u̒|]âJ`�õ�)�j^�/�eߕD��бv,HtC����[Ԥ��zq�J�s��]M�y��.0�f|\T�X�T��Cnj�O�Y[ڰҕ��x;d�:���Kc��w�J���S����%����g��(��kSy���R����Y6M�k�$n�+�U�EHr�ND� �7��Agհ݀F�]Ϯ����~1ei�A"�5�E99DR�q��j����|�'�����~���V� 2ND�lWF���3J��9����r���������\�^Oh��S��[3�/]� �0<0Pî-�8��lB*:�~�#� �Ҝ:�[Nk��i�u�i���UHv����۷?4\jZ#�1��d����W'����>w)�M[�K�g�����"x���z�NҼ[ޓ�r��"�v�-����6*�IėU�5F�jQ֛��LⅪ�_��v9�f��Ͷl�W�P�W��x�X����q�����_�x�Q2H�n倚�-�[�VD��<"ޚ���Y�Jp ��F4(���vC���m�����K�M��`c#:�7�f���-� s��C�#��x����W؏<�ub��_���9Á!Ã��+�a�ƹ�/��.�d]L�e�H��K��_����@$���e*�=]6j��:��¤(2�m���T����lsK�DG]�������~F�+�&��{�Su�,FJ�h�G'DD�6}��"�<�pm�,���5:}��L�Ǣ���6��� �:FG�REM�X�{���D�c��,����f5 �^��5AAr$ B��!��8��jlm�����ߤ�����HC@�u��g�M���a�TX�ӕ=���&ؑ�w�}7Ͱ��=I��Yz����; e�D�`j��*J�����rV@�kV��|�zηc�>�����T�{ibk�+������Ň_��Ņ���n��yN;������)d��U��P);I�ݥ�ڤ�r�7�������G^��?�*5�~[��m�.FBH^w���"���"E�I�da ��n,�� ���]�+��L�� ����;d�7�wn?�,����Q��X5���2�ʮ���A(B�9��%�8U��z`��N�<��e"Ϥ�o�����4Fݘ*5�Z�D�⧦ ��d�c�����Zxr��g��ǙK�����d�AP]��x3���b���h x� ��V��mv��vf��,rő�����]T��R$��Z�z$��4p����)U<�!O���/�3�LA*�9Jж�4�Ɔ���e ����XWP����h�h�}%�Ԏ�� zw�;�̉f*'M{��c��ҮZ�=���б�p�,�<��"�l�Q�-!�YKސ;<�Wwr\5!*}n&�)�� ���95&x=L*�;В��Xʲ�$���I�4I.*��5��Z���#�F�5t�uR��0���|~�\�3l}�O̍�T�d+:'�*��jk*5e�e����V�0&U����AQ��MW�2l�h/�A�z$� ����E88Y��x��c��<�=]nnu�I/���,v/(�S]�x)��@����I%�aĮx�;w�j&��i�&���T=�^���j9G�����P|��'$���QO���l{��w�w�}E��vgg[^�3-gg���� /@�qV�uƾ��,R��y���Vް�b��Y�8�V��O���$�N�i�b�@�9$��tgg�o�{��y��p��.�V?aܽ�#�����r����(Y�� S�f�0ڈ�VS�k?��>�L�U�Q�:V�D��Q��d��7T7�j�%��!��|01��L��S_��5�l����GO�+n�7^5!YB���S9���[�ȸ<�Џ6.5q�H�(���(�`9 q�c��������r8����I�z�~�볐�04ę�@���bb�*;O�\8[�ba M� +��e�K�`�
Behavioral task
behavioral1
Sample
7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll
Resource
win10v2004-20220812-en
General
-
Target
7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31
-
Size
250KB
-
MD5
a3663bf4bc30763a2bb90408e648cf50
-
SHA1
1225701504a57229b77ab2df14a6d94bc217a654
-
SHA256
7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31
-
SHA512
e0c1c9fa04e763070e4c99f3d88b0d27f9bc8f050e62011243d4fa55d5f1c2cbe8d83cad43df6c9974ced53fe7acd0cacf1af555d05906921b8777ffff80744a
-
SSDEEP
6144:CLo4mxqRbOssVMlhrWVr4M8NSMxf95QjR3SGlhvfWS:CL8Eys2Mjror4/IIs9JXN
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll windows x86
565d2c3a40e7893b9cb4fea63f1a6303
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQuery
CreateThread
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
CloseHandle
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
FreeEnvironmentStringsA
GetProcAddress
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileA
SetStdHandle
FlushFileBuffers
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
ReadFile
GetVersionExA
GetSystemInfo
IsProcessorFeaturePresent
OutputDebugStringA
Sleep
GetVolumeInformationA
IsBadReadPtr
ExitProcess
VirtualProtect
GetEnvironmentStrings
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
GetActiveWindow
GetCursorPos
MessageBoxA
SetRect
MapVirtualKeyA
GetAsyncKeyState
GetSystemMetrics
shell32
ShellExecuteA
ws2_32
send
connect
closesocket
freeaddrinfo
socket
recv
WSACleanup
shutdown
WSAGetLastError
WSAStartup
getaddrinfo
gdi32
GetObjectW
GetObjectA
DeleteDC
GetTextMetricsA
GetCharacterPlacementA
GetCharacterPlacementW
SetTextColor
GetGlyphOutlineA
CreateDIBSection
SelectObject
DeleteObject
ExtTextOutW
MoveToEx
ExtTextOutA
CreateCompatibleDC
SetMapMode
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
SetBkColor
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ