9�_�\z-LdZW<@81����u� WhѬWIC��M߾0Pb�|��q}�����$d��0���=�翠���k� �^�i&%�z�Sv)U�����ɕ��Mw�L��{;?�nӞ5=)�?��y�z!��&O�>����fDc�4�ktjL��)���)k�Dp�K^�f�l��c9�������nkf}�,�M(�X>� Xw�W�����%�9+E�r.x�#�)��h� �T<$N�@�lܪ����W����6���V�W5+��e*�8F�]�F�C��"v�G���`%�O~|$����fj�iO!�DŽ��� :�D<�[�l@��.v�������l�82�+���\���tk��l�_sim���`膽Y����7�m��ui'Ρ�,K�Μ ��J���9Q\XC�б���Y0sK1�Q���ra�Ⰻ�e�^w��89����M��� ��D��CN�����K6V�*Qp/�S�U�8�;n�5|I�7;=�(/��!��"�=�����3��5�2_��d7#eW��[q�:rI;�L�:"z�9<H���;Y�և�6q���*GW���� X���{��| {6�e�&�Λ����m9��"NX}���,y8Y���j4Z:�R��Z~����i��3H8[���E5��y��6K��0^�'�3�&��+�d%��_�� �C M{ r��PL�:J Ĕ� �h_��� g�Pssz ��v&*wҎ��T}f�J�� ?֙#���Ns��S�SB-=�B�G�,m�a�l���>��j\<��.�N["��[�����t�>�P���z��W�kx�H�V��A������?n��vF�����E����6��E��WE��ܭ��;vԽ�cE�Ge����9z]i��M��I���lGj3g��_�#�1�L��y���� l���[�y�N�M%`�$u���K��? L��+�mm���2O�8�@�4��ݞA�_�h���S�UU������#¬�~/��yUf>!�a���'�.���Iy N|������6�YuFw�֝:k�J/��t��4Hx�7���C�.�_+���}�7g�@.Ģ��d%�9N���Zc�o|6�_%o};�.̗T��F���_�Aǹ㰔�&9TU>��+_{K�������h�>��#�E@����-�\��D�/W�(^�݀5�����Pt)�WO1���@������yt�KU2<��C�"��@Du���8Y�`�*(�O�"�>=Q�������/ڈJ�5���+3�{ث �ɥ�G�[7���ā6��M��u͵��8`�D��[Uw�|?'{��:��oኺ��Қ��'KSW� 91������j��Ұ�D��j�:9|��.4����:�� I�C4���X�n�� ���s �K-�B��#n:�0���q��r-BU�QH��*���9S l�jDqP(*lЄ5��h������"E�Ȭc�r�p�:=4�vpV�ķ�>u �r�\�'A!�/d�����ѵv��IX����k�<�N�8`�����ͽ��8��"bq�3��&9ȊC����>V���/�[��#���>��_�$��[=.�ȶ�qF���K:��`�Q���k�ۅ�pO�q1��-����gEm�1��Dw��\VN�jӨ��>��$�����&��m���I�ťI����l����^q{��cՉf�}3e.�'�͏�6c4�TI�|�i*�]:o���..����O���������/ػu�W�߭o��nP��,%��Ht�}�_7��=���)7��M���Њ�7+H�������a����Du'� ۳pk���I�;K���3s��sņr)�Gp��_Ö�W}�ME�Q `�h>)OD��F�_�Dw�������� ϴ�[����8��5��B1`��F���3~:�'SmT.���N�ceI �J~�!��4 ҏ4`�EO }�v_�����^�&����;�� �j}q�* �Tf�Y�����a���<2T�Il������]�2�t�@E�f0֤{�D�.L����#�n�D��Swl�����¢rE���:.�x.�Ρ�����*?���?�誅��|������f��l�� ����ϝ�[�s���N`֪�s.#F,J���:�~-�o�W�M!Z�5����%p�y������5��i�6��I�֘6��*�a�6v�:νo_o��ql�f�9������fɏ�=KS"���G�-��\�럘�;�tB7��9Q�X��4�ݑ5Sa�ӂ�?ڝ�iDj��Z�o#�pM�Ƨ�k�L~�nm�ں���<���'�~�X{�e����rO>FwtWXO~a�Dr[�z�(�p*H��cߗ����N�#��5`���{F�5�y/��zd>K~�'�a������9��yQ!*���m����;:��ONd�p���Da����=�JyQ ����m�%ny����ˡ��f<�d��t�<1;p��-^��g�$H�lt�tUF�O����X�bN M�Ƚ<���٫ ���b��>Z�Z��ͷ4=b�m��]nk2L/Ca��˫��\ۯ)8�>,��<�r�Xn�����5;�?V��D� ��Qe�D0¸7R����Oap��G�Xg7�?����YYI���1��L0� 7Qp:89�c��> �~LA�S�Wc*��-\�9�J=T��p}�L\��h!�j��H�[�Iu��S�3&|�z�m�+j����7����qy({߀)Ѡ2wI��Q3��G����})�(�k��_2�K,b�[G|�g�{[+wE�~�8P?'.f�i&l=�d�h�8�y��1��`��SY�C�@+��s�A��퇜���9�t9͡�К ,�.\Md�Y����quϣa\EpQ�F[���0��;g���{I��S�#���eM�>�$0/���ym�|3>:0���Q�d�Q�,4 '��% Dw�#��� �ti�i�3�_=� �����;QКdē�^Y( �J��(�vw������C����P�\a3'{��fs�����7���;�f��� ���<���vɭ�kV�>�Ee�oJ�ɥi���(�H�
Behavioral task
behavioral1
Sample
abbf40a1b8ca5c300a70f60954df6c784cb5d4635e699fc67c752010cc846a11.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
abbf40a1b8ca5c300a70f60954df6c784cb5d4635e699fc67c752010cc846a11.dll
Resource
win10v2004-20220812-en
General
-
Target
abbf40a1b8ca5c300a70f60954df6c784cb5d4635e699fc67c752010cc846a11
-
Size
1.4MB
-
MD5
4a480f3f66628cd775f6b10b4f2469f8
-
SHA1
41a58fa2f45599f0b6cbd3e627fe49ed404a64d2
-
SHA256
abbf40a1b8ca5c300a70f60954df6c784cb5d4635e699fc67c752010cc846a11
-
SHA512
171e8b2af868b2399ba79b283db99f4d738beb8d53d0232119125dad846c699c36ac87d65dd13182ff4b930d4ef4faef1c908bae7bb77d8a574233c2397813fa
-
SSDEEP
24576:TM6CmiDdoQoHrG4kS82AfzkigOEiSMUhP2TOCo94ERnhADkpxhILUH2bt:TM60eaXAg1SVhPIOClEpxH2b
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
abbf40a1b8ca5c300a70f60954df6c784cb5d4635e699fc67c752010cc846a11.dll windows x86
0e7c446603bc9df81784af377616d59f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EndDialog
gdi32
SetBkColor
advapi32
RegCloseKey
winmm
sndPlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ