�eQy�~���O�(ܻ� �IsA�۸�r�@�Ѓ�O�ˇt�U<DE���љƷ�'��hq��xFl+d�t5���/��|A8�1�d'�)ܑ���1�h��w�Գ!qgt����~�!�Kv�\o�� 2W�v�����Hх� ��N���eNq��T�1p�&m�,HŮeF�:�Ǖ��@Y�aĩ�DT��:I�r>���|��Ml�q1� ���ӠaR��)A�n2[H��Q4#fO�X�j,���� <1U����*�)��n�[�����w*o��O�"�R��g�vX�r �cN\5��v{�\�q�f��@A�I���i$�u�̲,:�k+���D�v_�B�x_�z�^��x8��%�?e�����=יj��\y����l.��[�j+�����1���N)n;t�د�Pp����2~�0h���� +���ϐP�w�� ���)�8�N���4��@ޏ���u�c͟��S��tE��������(D ) E�+�ʜ� �R,^>n�������,����C��H��� �r5�]�Ph�K�M�<Qh�YQ�(�q� �|KS�e�V�9YV���TJR�)|]�� #P ��v�CqW��s�]���Af2�Q ��:xǶ,�b���%~�_G�±=�{���j��>r�]���B�/AJ8|S+�h?�y��GhI����MYiX̏�,I(�����S�jm��(�Dv�"��ƖC���>0��f�� ��~LJ!/��1�P%��Y�m_� xW�If_�8�v@����4r����-��( �t"�vI5��3�NEIɘ�����w�-~7�<RT��tbŨV��4�a2�����;"�Y�ȃ���c�!��G�y��6!B����W+k�N���������#o>y�>��]�94�e�s9e*�0��*QzF�bX|�3�^J�}�|sv-�[��7i�N�fa=�.`*����ٺ�����ʖ�)Z$8Q�K�yG�\��F���V��������V�@l"X��! �Do����/����HO S'�s�,0ot4��N��Տ�1?�vʈ�m$ܹ���|��:%�7���}6:����}Q�ς���W���E�d�/ie�^������K<0�x�����4�&2�6���@ީ�`�=6r�տ��s�Nu�/M�6|�[�B���G#o�i�UD[�.��@�g���!��M{�fhp��m�Ҭ00���G�fQ�yq�8h`��Ó�I��%����6F���Ps��X:�jVm>���y��� _o�ܩ�T�#9i��^vo<��?����g3�]�)��9�MS����!%} ̃`r����?�~��V�������Z}��9F�~(ř`��ޑ<rmt�-���|������NEj�|�V�(�vϤJHc������"����?p�i��\~�GT�5}�Oι��,�@���Z^<2�~�m���5l��)��r��2��H�f*�6�y ��r/V5OJ��s_q0�ē38�W�e܌�Q�]�ЮE����2$� ��D<�r�7l`��03Af���:,�1�o��Æ7�Hk�Nn�d��ʄ/D����QD`V�,1��#�pܲ�õZ�$��-]�U��b���Y�Q�sno�^L���C���!c�\��;�^���T��{,���>�b0T\ʵ�AIb����;��8�D~�|�G�a�p Wމ�5i��z��� ����B� C�����A:��{cj4e�q�y��S�E��qχ��9j#Qh�s ��|ҟ��f�u߈G��{R����*��ZY.14TMC2j������:q�]�{L��7�n�5Yezm�ż# D>���R/�� ?#�7E�yX�$��o�^�����'��%PJι�V�f�Ւ�G��KC���y��F����� S�`�h��a&|A�T B�-!L+Yp�{�T�|c?,+������Aa-3�E-� �))��&��.��S�� e �h�Y�7����IH�-�,�=�[����r�7���G�?�.�T�ۢx�Ņ�t� ��@(�`�I�gE��Z1�q��1�lb`�Q�>�����I��<��^lǬB��y!����R���گ�*��b�������+��L���V���x�tu��]p�D(E=�^�����������X��p/���XW�9}�q�������)*��A����z���$��;��K�?q)�ˑ.�3������@���Ft����LZOs�D���f��WƳ�2h��Ր���}-���qQ �(����Fk�+��N� �p{)������.ŷygԟ��������u�z� � ��+����!vc���h� `�R����#�� þ�J�b�S�1�'TsR K�g��q��Z�7���h��B@��v��iF~�:���y��I��0Rb��.!��@����d��o{�W��1 W���Q�D+D���M'З�ʨ����a��3͝a������}x�Ɣ���mj�TE��PHF�T�b�ɞ���D���V�X��r3EmC�J?�P:0��%o��<�VD��,���f���g�:y,Y���N��� ��yI��`%S7�4��,�z/�ΰ��Y�HتX�i������K�+@�$M�?tl����Z�l���/�ɶ��[.Z^�ҡ��0E��WʲP���02ݑ��B�lp� �UW��.bȱ:?���+)۬��]4��\ǥ_H�F�-S\u#���SH��ϗ�|&�Y����3��y5�H���%sitHn��;1��T��ۮ��I���{V¼ \{�JY>�y5�������q~�=x}�xfÓ}�h�+���7_�T7�ް�3ą�hU�U��O����"���q�9�Tt(\S�ݳ�yW���6�F�'ɐ,�ON���:%Dg23n�_{�p�XOv��i��G��P���}t�/.y�ar�@:�4>�r ]ه$�/��G��\�����qܮ9�j��BK�c�t�ښ� �bvT3m�I��d6�b�p9%ι��2��,�,�_S֜jb����:���H������}���6��RuVI�YbS.(k
Behavioral task
behavioral1
Sample
b3a8da0cbdbaa44cff2f705dcb2a5e673e7986d13b95cd8225487cd974c2debd.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b3a8da0cbdbaa44cff2f705dcb2a5e673e7986d13b95cd8225487cd974c2debd.dll
Resource
win10v2004-20221111-en
General
-
Target
b3a8da0cbdbaa44cff2f705dcb2a5e673e7986d13b95cd8225487cd974c2debd
-
Size
63KB
-
MD5
a060125cc2f88a42f5809916ed15eef3
-
SHA1
74d711a07f759861b7bb08b9b133135fd3e223d7
-
SHA256
b3a8da0cbdbaa44cff2f705dcb2a5e673e7986d13b95cd8225487cd974c2debd
-
SHA512
6309a9bdd753201b5eadc440019f4b49b571c94804f54984aad3d31a8ef4df9f4e316eda8cadf86b10e5abcbd8ecdd8771129a7b3e2e432d8440ff6cc7a2820c
-
SSDEEP
1536:3SmTC0EvFo2p4fUbEnfzJjkSJQcFKKBUaNbd84u0YEoG4YJ:3SmTCTvC2kb5/BFKKb1iiYEyi
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b3a8da0cbdbaa44cff2f705dcb2a5e673e7986d13b95cd8225487cd974c2debd.dll windows x86
acd0f4621e91130aa90cdd34d55d38fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 279B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 70B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ