w�L�H1~O/w�� �������}%�9��P����23D��m���pl ;�E���#���`��'�5�;:�9;����7�C}dZ����}A����Xh���As�9���@rF��Z �}B��L���o"jg�6@26 3�R&�k�����~xz�jv3U� h��}j"��$� 6� P�Y��*�J<dž�o�J#~MҮ3��$�A��T�[3�m����?s�:�Z+䅔ӗ5U�G۷;�q�h�Uv��h,��f�XRJ�&����&K �bQ�)tr���O�K���s�?�h�x�/� ��lC�=��VM�@��ݐ��e�L�m��[9,���Q!���5�f�Ln(yT��� 8��X��rg ��fg++/ڿ����y�4H<B�ǀ�f�ǹ%yY��DU~��td!��%�5�j.KF�!2O�U�I�fm�; � Υ�v)O�re��AG���l��;�g�����Iw�b�4��3����irA���^ ՜Q���Z��� G���f3 ���д�漬�!�P�^�#��k�m]Ω={3�����ܔ�h��1���AQ�=BPԟJ)�!��;�)�x��;4sٍ*�,?KT��C\� :���u�*�U��"A����?�.���nOUM��T�����t<���l}�@9W��0��e譯��f��ڥW6��E�i/d�I�{��$�`-�:"b�)#�]ݘ�l���`n���^�m`gFv6��`D�|B(�c�@i�!-�AA�R͏���R��I�g�����V��d^�����ǰ�s��f;�J�S~�n�Q5�x�ט ��2�\�T���ft�u9½�_�W�un�ɑ�'>�G�x�> ��/{Ƹ� 2p�� �>GuKnE���{��;M�7�i�֛=l��H/�N7o�2�ӈ��E��hw3����*�ļls_���� �����鎱��������jt(e�A6�p f��F=�=� j2�4���ЮSYY袡���6�̃�\y|g��ͫ�n�#�T9��k8��w�`��BaD�| \Q��~�P(N�G��t��\M�W�}\D�`y�������gE�a����]][zÔ��\��5XMTEp�5{�������Ʋ����r��X�d���y�z㎽ a���7T����ۉ���^��@��F�%� �^L2%?`�jPV�`�c\Y��RI��4y�0���q�>�O��G^w�|{�-���b �g}NDݗ����t$����4� ��8ޅ�r��cD�d4�p��N �ʼL b/�ǎ���6���<W�*e���ޡĚ2��VbR�����Õ��2�oݔ���`�KP����0b,�A_��l��Sk�F����3`M�hi�q)?a֘I�D�*o'���_� d{����ſ(t�2�'�X���)6K��ց��G�)$B���k�u��L��4+�{U�2�Si:���Hc!�o�U���ɇ�I����ǟ��a�Y�9�$�z���a@�Wx@8$?�@Gj�b%a�.��M�bƐ�CM9�,�j��6�7'o�N �h��J�i�U�)�h@R�_2���l_���{W��}6f1�q��h��+�P��u�����"��I�5T�����N��V���|NE� �#��xJ�9'Jc��Zߋ��2Lߩ��߀��-Md�2L�+���,�>ī�Jጶ��Sg� Ъ�soN�r6�4g���g�)< �x$�:��"���l�*�B@����&��\ƒ��ﯣ�m�;�ie�^��DȜ��¾W�̷�*l7GX@@h�ٌ�t��RɤB�S�+��Q*M�aʇ�m%��_�E'a����"":eu�:��߃�*B��t�Ɂ�"�5�ܵr���[С�8-���+�7��KL�~��k��6�>�.[��x���k�cKY�����M��q�1���}����L����+5�Tv�Rg��z�I1�"o:��P��e���-�1��i��MԿq}fo�w͕P��7[�!?L�Q���T���BH&��t����,��R|��rf@5N,�XZqaJ �Aܭ����U��β�\�\��a�GX�U������m�qL�#�,ۦnD-��q��G�����n��Y��'㹴�ҁ�D�0ڣ�/~{��x�E��<.��5�x'�B��@���~s��{��� :����<���{\!k��~�}$S���;6) 90-8�)�9 ������D��2���)b���+5SE�G�X�����P��8y3�n�EXV���>JC��t����UB�vS�%QRVB}kܮٛ���M7��H�z����w��#��l�]t�c�3x3�]�^��NW4��z�@C�����-�=��f�~Af��� ;&!���rЋ�0��3��0�m���D�p����=���۠o�h2�.1#�M��o�a����SiR���a\���hUo����rM��<Rl�>��;"��T^�|4�2�$�bޗ�?ܯs/C"�] w��q:LY��~2y��H���W�q�|��p{Q���G����'�;�P<SA��8"-�K���[f�w��x�tu�{F=�]�uӉ�pi|��N�!��!+���4�'ՊA�������A�c�����2ɛ����� ��;}%H�<e���Qܰ���}�F"D� g6 ɰ�"�.���S^UǦ'G��/KJ�� �[DLv�@<:��[f�K��ǟ:��g�5��v`]HR��fk>}���X���ԛ�q�&���v� 4$x�r?��0������V��'�#E��Ur[�.,0��i���J%�(4!1qOqwC{34�~��۷�d �;��_3�\*��~3��N��tb � �!>��vN�n�Q���P-X �<ݓ�?���ȇ�NPe���������9,���w�Gmq�R��*<�O��5�/��\���YO- ����oK��n4�����4���2r�t3��H�����v�çLf ���.k�n�¤|��� ���@0N�;�#���/�}����%�� �V{���:8Ot�A���!?�����\�͎t>�NG��t ���a�;��j�_
Behavioral task
behavioral1
Sample
637f4427f32a811353dd58db4b074647cad2b83a06f544e9e2e67f9b9bf4dd03.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
637f4427f32a811353dd58db4b074647cad2b83a06f544e9e2e67f9b9bf4dd03.dll
Resource
win10v2004-20220901-en
General
-
Target
637f4427f32a811353dd58db4b074647cad2b83a06f544e9e2e67f9b9bf4dd03
-
Size
320KB
-
MD5
0bfbcb68b3229584ad6fa1ce7c22251e
-
SHA1
2b085492e5be3d1077ad4e229428a5ff2f6a9c71
-
SHA256
637f4427f32a811353dd58db4b074647cad2b83a06f544e9e2e67f9b9bf4dd03
-
SHA512
827513cedc48d0785575c72ce811d92a8462f70b668c50ecab0e8ee2422f0f61aea812f1dd07fd9f1c412b24b1b4bd769645491455d3af8b40c7bcd9c212a52a
-
SSDEEP
6144:MsLEzPRzZZ8t3bAR7qLhUbhE+LV2DoqunK6/5N31bffjs28o/gcZRoiyaZw:MskKre8hUbhHxqy5vS23/7ZiiyaZw
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
637f4427f32a811353dd58db4b074647cad2b83a06f544e9e2e67f9b9bf4dd03.dll windows x86
e1d302a784f7db5a477022032fa45cd9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsGetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
wininet
InternetOpenA
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 308KB - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ