���K%��2UE���]u�.D �O�{��(��v߮���͒���#��, w��_VO�8w��\�On�i�Ǣ�, f�73���<+<�yl �>B�?D�Q8���_�R�0��v�3���FD2�T'�H��ZS�|���;yE�*n�5�d�r�����m�ẃc�T"<�\���e��v Elڥ��P ��g�[����+ȼ�o�����Ź��3T'w��G՛� N��=6���3���i�{Au} ���9����Έ%�E�y��pÖ)��� �l���z�\~�Z�k2��}�/�q�h�L��l��d�y�X+A��ؠ2�#���ي��?���*K��;II�lT@��C�͙�0<�Tj��zeE���Y.#P�pl�o�QD]���"���e�Ww����4т�?$���+���d09f/t-��Θqhk�NI���E:�����c����`�q�Is�����I*���J�q_��<��r�=�NNZ���O��Do4�$(���q>W����9�z��FM@˽�NJ�T|� #i��ԋ+3�s��X��QP��k�+���w�h����s4�Y�#�yD��Q;�sDp'�֔n�G>r����\�����3��Ա��%��1/�����[mnqc��SS���M��J�r��,��E���- ��ʎ�o�֑���/T�]�f�1���7I� �ڶ~:��A�T��;�T��|�������OlL�����'C2@O��E`�[���zC�0*ߤ����8p�N�vH�� *&^<��)U�x 6a��� ��B����C�|l���[�ݺ6%aYqy���]l0��sY4�".��U=�2L:��F-�+"�o�)-C�,� �6VU��uptY����M�2��-ᝧ�_W�PX�D��~�q���x��������hİM�e����ir#��hԭ�!O���g^�ۚNG�T>� U3H�(��F��g�+O��c*��i��R*&�Q��T�s#�%9��2b-A�۹��fhyhr����N(X�h�����; 7CɈ�UG�����;:hRo��PF�'�r{��#��/��ذ�9� �gI-��|�5L,Bx�G����(����1_�@�g�u��A*��I���Y+el~��F�����%<���VՆ�h�f�<���o;���т�+T�����=5�y�c����3X��Y��ȤaGx2�����(b7n��}�:-!ܫ=��T0~�����V�C���]�����.|�>N䏀5Mg �@�g��]��\�.?:?Γ��>� Z�� � �w���g(��L�h�4�T^>IK϶�%?Q��/��ڏ��)� N�'�2��Ֆ�zkA8$/�>������gd��hSA��� g|������TS���ya4e���u�ړ$�,/`>��tw=�@ ���FƆgE����^y��7��f��\�9�y�������ͯmr�N�iA<����� q'�7'�<�����#@��o�"&ywNwR��q�AO����#)j����\F���-_���&����,�L�4 ƅH2j��2�p1�8g�i˞U9�(�nH^Ć�q�?�$��[����� �f��x��' ���|��ε�)g4n�������ĭc��^���xi�rٍ�N9�3�$�H�O6T|�X���s���*�|�# �86�����:&R�r���]wh�!Pb��zcp6��n]⧟|�ߒs���K����aј��\�^�>}��[�Ga֕��1"����45���6�;Q1�&p;J���rYH�� �?��#l��uGd��_3R�16�O���q�e;�*�=Kx�7ђ\^˱�̫�������7�W��G'�֏Xm����#��0X[*�� |iM!�r�0o�G�hrB�q�ƥH_H��uv��� ��L�s�94���p5�b�&�F��N ��cXM�G�h�ib�kv�lC)4_P���p?]����;z%�A�%����e��6Z����3;�v����G�)'�J������]��.��A3�Q9p��iU'5�q��� i;z ���~̖RN�IB���CWm�b� �'e�� \�-�~��U�^u�:��2 }7bi㒍��p���[o�2x�Q&�B� f%7���@80��U������ʁ��H���N��8��o� ct~��,c� h\{z�s�2�\C�����a_b���'-���q��"��-� ���2.O�ԁ��|�����iVܩ�>�A���J� �0�q�f��'9J���w4Ѣ�����Z /F�x�dn��'BbV�De�qĒV�d�D�w��a?�W"6��z��tO!��@�7��OA'&O�F�jT���K���̖���;��E]<� $w?��f\~�:�tJ�����t�;���p9_x��)��������(�`�HVaq���V��09ҳ�>�ۮ�����*���f�A�dI.7���*Ջ�(���UXiw_���>e��U`�K���t� �6dM,�67�t\l��ū$ ��+��o]��lki�$���#�ƴ��+'��q�W�����I��� !���`grPԆ %�Q�B�KL\��'�O*)e�t"s^�5���,���JX�b��[%9��8��( �H������y��ѝN�a���)Ty�>Wo}�zܓs=cP ��DǨVn���y愦8��� "W�#j�A�/E���lМ���dI*&�5�9��� ��u�d�����2b,z������!�вQP/`����Y�;�4���kE�F�?�*n����0��Z^�4 ����YsD!��� ���O�1L�'h1�ON�5�c�,XY�Vr�]�^����4��EjEA;qVXQ��N�1��?�a��T���gP�u�'���ɣ����dJ[�G�F1�q�;� dA�J�܌*h�R��v��!�ie�.e�h$��eϵ���N�A��1����&g�6=��{Cè����O��rm���+���D�j��p��˂�H����?��x~�h�@�������w ��ƭ�� ��3����x���"�����|�a���A����2by��c,j%foė��g:�X�s
Behavioral task
behavioral1
Sample
76889c970f9372444884be78fde632bb92a8fe356fa75abb05eb46f8f8a35a36.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76889c970f9372444884be78fde632bb92a8fe356fa75abb05eb46f8f8a35a36.dll
Resource
win10v2004-20220812-en
General
-
Target
76889c970f9372444884be78fde632bb92a8fe356fa75abb05eb46f8f8a35a36
-
Size
292KB
-
MD5
1f23d73cf5ecab7bc95c7ab4dc56ae1a
-
SHA1
62f8ee6ba6aedd29a2a5186896421e9f66d7ddc0
-
SHA256
76889c970f9372444884be78fde632bb92a8fe356fa75abb05eb46f8f8a35a36
-
SHA512
4072ae1552ffd2ebb38c140b180fa164eed1aecd2dde0d271093281f9b161b2ba3dac67f3d74602f90985e8d05a4cdba16ffdbc651a6d349202536d244ea5039
-
SSDEEP
6144:QqlCPJGV+hHeTJq1WoeyV43sl9kYW1MNQHhSJdqmHl/LS0DD7C:JlCoVntGWn3sl9cM2HhA/lWmDe
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
76889c970f9372444884be78fde632bb92a8fe356fa75abb05eb46f8f8a35a36.dll windows x86
8583ff476100cd670e87a1221165a862
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOEMCP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 280KB - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ