V�D�B:ѭK}�C�ojg����]�T})�e�~c��r,����p��9��t��f�����QT�"٣�y[�tFr�(�*�� � �r�5�6��W~�V�#9��4;�j�zS�>��j����e��¯y��߀6�8�� �/:k��(Gd���.��)}��U�*��A�,)��1�""���]ڶ������Y ����X>��lG����������4ji��M�w ����.p[��uÒ�������� |�sl� ��}�/���`����H܋t}^�PY����SnR�0�V�8T\��?���S�@m��l\N�C�#a_I/Kֶ�ض�VUg�� �}D��,�Gt�t~{D�J٬G� PJ�7��S�K6]"�����P��� MW��z'�O��$�v�"�O�kƐ%X�ͻ]�U徂� ��:cD �����N�7��I��kpQ����u��) j=�/����A�¼(�\|��ֻ�P2J�� 4*�����A��Y�d�@��պ�3��<�(���ʖ�2��4x�A��k�,|�h�l�j��@y����2l�q�@H*�r t6���$3�A'}yc�7Y���W��5r6,N-���{�=]���>~�H��ׯF ����Z?����f��T���δE�U�N$���UԘ%��\��=ޖ;sbx��yw;��Q8&������ �e��������x&�2������F����U,=��&nFv��#4K�+җ��(R܋���3!�}��h(ܻ�����C��t�_�� ƥ�vYtm�: &P�{$o�g_��������֗s(�U�� ��@�r�o�Un'�f�/��v��f����T��X�y��8�n5��~��$wl;��s�s�Z��T�c��S�q<}���(̬ìۣ��hÂ/^(�����L�2���������q1+gHLD���E+%�Na�5���A{R�F�,Gq����Z�XZ�n��m�D�gAeP�/H�^���gB�C�Y}3��QҾ�����~���xM!|��4���Ob g'��:�m��[�m��PT0Z/96�o�Q�۲R�%� ���ahZ2�FL�eI쮓_$1�4�����#G��a$ȃ��S�����t��@�]9-s4�ў�%���k�%r��(�A�� �j�^h�(���9|JP2J��R��'����.�e�.��4��,��)e���,��t�w�7����E����à;ث������� �!R�i��tW��G��{�s�����P�;�xά�;��$ �J/~�M�U?(4�����<f��ޥ�^�ָ�m�'�����4e=UbE��EXP�]�o�T�_�Ƃ�>��\����i�����Z1y� ^9oVf}=�M3�I�{��|��&b6�h9��@}��T�1�����7~e�� �^y'{e���)>[TQu�C��P'�f���)u��x�v�u �P�CMLH(��n��W�(��[d�< Wc0| �}���~,�n�hX�DΞ�:����������§��n?;���Z'����:�bp�� ��p<�c{�\�5�1� ��m�H�B�F�Tˬ�(�Y5V�2�?��8X��-D�����+Dn^� #��P�<����o����l�w�y͜��}F�ԃTmR�붧��y�#E�%)b�T��I�B� �C}�igv@��S'�����^@"��0��6�����-0�^���3уzߙ�?gPw?�)��ʣ���:J�E�I�'�b>)_(G�"y�]����Zc��s}��y����y1r&#ptA�}�}�����S�E���!D�n�}kZP/-����!�lt*�&�:�.ea�6� ��F(��+�Fz�̘�T{�cΥnڋ8H�(��0�fL5�Â0��]���<I�o*6���J_r-�--|n�j`C�SH��ܒ�l�5f%N����R5��R�p|��a�=�a_��R-m啝�(��� ��+�P{<ip�y���V��}�ے��%�,a0�1%�,#E3x����V�V�e烧M�<���������i�Q4�&��1��d�"u6yn��z�%����ׯ�-c0��ElP�cg_D���8V V�dH,�|Y�g�N�sa�wk �Ӿ��"�*C^D�����$�����<�ԥ�]�q�%��^h3��&��]/�c}������j�%�Ⱥ,��w�A�d��'���\@�Ģ�/�'�;Z�\R߫��A<�1�잇�ZO��U�/yj}��$�oyK��tB)�'R�\���/�lKBN����=��n����Cac�c^�蕮=��w5��s��f X(y,!�O�JK��nc�9�~T-���W+�z�0 ��r �C2z����n<ay�xj�3B�^��ۭh�Wt1Y��5��X�d��On�;�tI�n�a��c-����t4�VJ��ýxf��������9�Zw��>� ?�ev֬��E8��p��}L=�cǃ�FȉXO�%'�6pY���snRQ[��Z�YrXܣ��U�m�jx��P�|L᭜NJ>�[ǫw�H��"�UJ�1cň*�L�G���b%y�ͻ��3ǧ���,�2��ox���8UaԜ�f�n+R�:��l$�w⁜��ݱ!�d~:fWu��§��,��ٮ��Tl a;4.�Ƌ�����{'�w��g���m��4w��^ray�d�~�8wez5�����/~ؒO�N����j�������t6���@#��+����h��&Q����)��Q9��\:ԙ�K�)�������z$=��h w�� �<��f�~ʳk����~���b��P>��'��ɉ�<畅�]1�~(g�Q���s����]���?�ψ0���0���d:x �+�$2U��+0�9�?USu���n���� ���������K�9�xi[� ��L<Ǵ̹��c� WY4G[T|/c$w|��$�6���'@v���0�����B��RIг=����5ܮ�'�ŮZ�]]��hb��f�����X>��"PhR�d�G��el�(�Z���*z :^��̺uJx��� �01�x�$ϮC9�7x����f��=��]���"�~O��5ir�|]��t ^}h��ښm�
Behavioral task
behavioral1
Sample
1730294e6da1bb3754af28ddc8dc78c121b0bd1f8ddd93a084bc2328971fdfc0.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1730294e6da1bb3754af28ddc8dc78c121b0bd1f8ddd93a084bc2328971fdfc0.dll
Resource
win10v2004-20221111-en
General
-
Target
1730294e6da1bb3754af28ddc8dc78c121b0bd1f8ddd93a084bc2328971fdfc0
-
Size
137KB
-
MD5
0229e546e91784a2f029353ecd5c28dc
-
SHA1
117bc98ac34a69a22433c8925a3fb185fd51ffd8
-
SHA256
1730294e6da1bb3754af28ddc8dc78c121b0bd1f8ddd93a084bc2328971fdfc0
-
SHA512
719a500a9a27e0e6b164735097b0e9a32bc7d195838d8581306d0b503e80d62bc9912efdfb62d33cb0abe5beebbf8481d7d87e0a593fab170e8e6ad9fc3e4159
-
SSDEEP
3072:NHErlrdKDlWEXrIfR6PfXvwg12QWGIt8bfD5qwQa0VcXoHri83vxc:NHCWUEbORIbZmt8DsjNrN/xc
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
1730294e6da1bb3754af28ddc8dc78c121b0bd1f8ddd93a084bc2328971fdfc0.dll windows x86
5a3a1f42477887e465e35c081bafe2cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
mouse_event
shell32
ShellExecuteW
d3dx9_43
D3DXCreateSprite
ws2_32
getaddrinfo
msvcr100
_onexit
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ