ʚ�d��J}தZ�8f(< /�c��;���w�,�� 0v�\���X�D�[�w�%�E�nF�G��:�����+�~�H�ѫ|Jl�7\�JY��`|�ܡ��]�(�ii�a_.����]y�F�yV���G�HK��ޫ �@k�`rbu��&���@��? J���"��@�a�Lps\*u���w,0կq�0{��7(��0iʳ.^k� Nr�V�N~ �D/bv6/y�/[uv]�+�M�����N��'���ܴ�۶a��b������l��[���+&�~�E�d5ca�gƩ��A����F�]��[�L>D:tKFR��{t@��sy�Z��Qx�T����C�K].�U)�>x��Ы�T�)4Px� t��>tu&a�0�Jv��[����ʪyrʩTz��v��e�fl�Z+)r�����.��`��=�_�>������"6H��$|��#�Ʃ��L����c���tt��&�]�Й�i+���%���Z�v��8Ȍ�� ����O�J�N#��U^���ɰ$������a1��v2ol���.����v�"`��#��*��c�� �"En[ߙ�1��*R(���?Λ5S3� �������=��L�L¹��|���S9�ԕ��Q��Y�X&h��n띝~4`ĵTB���`���%�J���~���oν��T�v������b>4?�H�AG���D�h��F�^��?��6�1�`��CΎ���X�]�����T�(l��͓��]o�+�"�fo_A��e��wa�X��3a��`ts���(5����G����M�W�1lR���{��9�*a)'~�_�'�m�ԍ8����E��gPe�����Q ����;�����:��a��/��j�T&�Z�78�R�w^�[�*��}JDE�d��F���W�����TE�'�Fr\n�ߵum-�S�PN�7�����Z���0#�K] �H�X���4���p��/{Z�� 醙������ǒ��¥p��P0�"�ܔ��HAG�dJ�E�ݻ�O�]�k^��rF��7)+�4���o]�MmÜ�*�늠%[�7�����@��6���=�^9LJb�m_j�~�#��,�B���Ӂ�)U� y��R�����5`�l����Y#'�;�Nq���UY��i�& {�f1C,�ZW(�K�i���#DǰV~�o�����TӕҰ5_|���ԕ��[����YV.������L9&�L����)Mrm�9!:r���.���n���Ht��4�ԴC��E6|�?n*���'M��� /O�76����=�,��9`�y�>`AGR5�*�?��u��H4yr-II�]�}ٲ?}�(��w��`�6E�q�P�i�9�$�A��W@Z�Z`�QG������4�����oB2��;��P�t�R�}T�E8&V:�T�����N�hX�A)��1���J���hu�#�8�L�������J��e�_���z�ѯM@�dGq�9wKV��'T\tE�*u��Rn�+Sp�U�2�F����Μ�}�� ���vOr��J)��"A���K m�Z�4�e����y�U���hp��T������ɻu)R��s��+�ٍÁ���A)U;�W��y������y�D�D��$L'9eFymWKٲ*���)���c�����8(u���Bo�����x���|&��_���&�����pp�E�;|Qd ������ȾM�"���,���a�B�p]ȥ�_����-�Y�"��0`�����������S�Յ�V!�;�"���!��*w3���\�blN��x���s��X�o F��!���]�"P��Rcu���Ӡ,�S^s������vbr�0T�t~���={���ߕ�R�9E�E���Fq�t�t�r��U`�ʨ���|M6��8��?��p���z.AϚ�V7��P�۽�Ʌ����2�io�:��ؓ�[ P����3^,ћ��{�mnu��IB1@��(͟5�I�g4�l��ܜe������/7���\0��oFt����Ypۥ�w�=�6����c0|tj5~��pU�"�3 ����6���U�_��}3rcJ鰢�칆�Z�����,N����,ˏ��.P�d��W��~vzs1�Y�f���\%/���_^诮Q��?^j}8�`2�)��M���,��9�K��!�`~���`����F���xJtO�TH��Y��a!�����Eg����Xn\q:��~�Z,aB�%��U*͙�*+�ܗkRn�,LI��H{7+�����y���a��RzjT��1B��h֧Cs�s5N3����b�B�>x��/ �?9VS�<�b1Q<�v�1������x���{����D����2U'���"� \�4��>�!�J�T��|�w�2~D���/5M������;���4�����ܭ(gC���Iϑ���g�Es�����~�{�tb>\3��DIo��i�r�iE�TJ�Mm���Z��.��횕t�bD2�B�!ch�]�P������/�(����iY�,8al�Cm�"xa#:���eX8V2��w�:=݂;/C\U����Vn\⑬G1����U`�7+�N�u䓁PaY�Z[X �d��e@﨤G[��\ͳ��z7�s�*m��tV��S��֛~���9(eg�i�Lv=�>���hfG#����D>��L���^�c�^c�FL���ǎ�G�B� ^D�!�#/��gA��7��znlQ4,˳*ͨj��։��g*�����%�ۗ��m�aM����Rp���Q��"��s�]��wc�����j��v��On����.=+�{j+��Hǐ:��r��:5�ړ�DV���5�,�PJdV�7�k�'{�99��{��h�t���vQ}h^�ͥR�3p�ߟ���gSE �W.���b TvI�-++H~[�u�5�C~���&���[_ik�o_,ޠ�c�B�˰��\v3��jSK��݀u7s8˴2ڿXחM.��I�W�+��Cq�EVs&���g�=���︎���t�o��K ;�p�52�o�to��h{�{��S������%��C��e�g�)
Behavioral task
behavioral1
Sample
81c2eee5021f9bd2eacd565ce2fd2036f73896c30c9f05d2c0158e8cc6fcd68b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
81c2eee5021f9bd2eacd565ce2fd2036f73896c30c9f05d2c0158e8cc6fcd68b.dll
Resource
win10v2004-20221111-en
General
-
Target
81c2eee5021f9bd2eacd565ce2fd2036f73896c30c9f05d2c0158e8cc6fcd68b
-
Size
105KB
-
MD5
009786c930c56921c500d1d6ca1c47ef
-
SHA1
b3fedb32e8c6d44337bc2326409fe8db590a70b5
-
SHA256
81c2eee5021f9bd2eacd565ce2fd2036f73896c30c9f05d2c0158e8cc6fcd68b
-
SHA512
912fed66a7c21ec067a300204876fbb871efa17082fdf96e1de17852efab5458cacbe8e8da3eed6938ba9b162ec1f1c886a130df251cdd13f2c0f7d8a49b4b4a
-
SSDEEP
3072:GmwAu62lep2pdokh2uex6EcKXGTVz7Zm3rF:dbuTJdNo8EcKXGTVz7ZA
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
81c2eee5021f9bd2eacd565ce2fd2036f73896c30c9f05d2c0158e8cc6fcd68b.dll windows x86
d2ee3a4346df47be2fe478e6f3673ef3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
MulDiv
CreateThread
CheckRemoteDebuggerPresent
VirtualProtect
GetModuleHandleA
LoadLibraryA
DisableThreadLibraryCalls
ExitThread
Sleep
GetCurrentProcess
QueryPerformanceCounter
ExitProcess
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
IsProcessorFeaturePresent
EncodePointer
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBeep
GetAsyncKeyState
MessageBoxA
ScreenToClient
GetCursorPos
GetForegroundWindow
gdi32
SetTextColor
DeleteDC
CreateDIBSection
CreateFontA
GetDeviceCaps
SetBkColor
DeleteObject
SelectObject
CreateCompatibleDC
SetMapMode
SetTextAlign
ExtTextOutA
GetTextExtentPoint32A
msvcr100
??3@YAXPAX@Z
??2@YAPAXI@Z
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
clock
strchr
sprintf
_mbsnbcpy
system
malloc
memcpy
memset
strncpy
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ