���F�W���d%�+.��XJ��;��6�i=��Lr��bi��`��:#ک��>-56��n��4�0���Ì�GB�ֈ��b����+d>����fh�P�V��3,��|����B���"j�؛�!�l8��o���(��1����R��A����'+!�(+P�0����k衕K�YT輅��~��n���U�"w��9�/{\A[$։�C.��m���� d*LP�\��;�s=��ey�X�>��(/byS� /�IG��Ul��>��+�]�yBqOe��� � �[����~�(�UR�4���y>��� F����Y��3)w�<�@U�{JL�N�(岄�,j�w�g�<BV ��8{9����I�˝d���N�Um�z20)8����u��Iᎊ���n1�� ��7�nL���l�<T�e���'����s�p?<����SO� ��;���W"e�c�~.���L*q،��N�#kM���U�J��M$���N��!ibJ���kgI_��1T�CS[�����¾�-�1�C�o�WgI����l��P��,.Z9�h��E�y�B��g�[#�a���%�1?"�����Ӝ�����~.[����m5���k2�����|1�/><o �����'�v;���"�_�Y��P�Uwd�mi��J!#��XV=S��u9�B�W�ޱ�Q҅�.uU�-w� �2�0���ٶ��2MbZ�k�pm�y�r?�k�՟��"��V��S�ܗ���7&p_IRi�_��b�>�&rJ��T�a�oY��qU����ؿ]��:X}�[��H��h�\�Ч9�yȪ״+�.yJa�,c��֧�k�mq�ؼVK�v���y��0�c3t$�o�$����/�u��|��cz� iTL�������bg�[!�H��yi9_��d��7E�Z��R��������Fu��A��K0�^���!k /�}_/9r�)�Yԥ������l?�O*��U�WL�Ì�|0CR�l��;{�p2uT�F��-l6�p? ��1s�$ ttP2��])f�����\_��<��>����ޔ#��Ԙb�Uw��pƝL b�o�n�i ( �fҥ�_��-s^aY7 ����fjh�p$��JFu)W�n�͜wW���W=�i<��6T9�a�� :��Ϊ ���bOt�H�n�A��M��zw;������-�-h0�/��q�`�$�ߣ]Sh�=�[z�[�����Ԟt�/���01��6�[��Z��9°�8\V/�}�9 S�E@��~�w�LͲ�.<�&���:�4�&y�i��q0N�4��� <&����U�2�ڥv���+�]+u}�⠙Q־6���=~ۋ�x�I^���ɝ)"bob�j���+lm���Gk���W[�����P�9��.;ꎤ������W�֨� J�����+,�i2��6:r66��4/K�m䃯��P���� �2#bȖ�6c��6�U��2{-�]����b��d�l�G����A����d����]�"��ۭ��Є�"$k�gg5akN�j<�?���E� 4 h�����S�7����>�ɢZ �2��k@���O ��,;�+�Inp轐�Mak-�T��)�4��/�X{������U\Z�i�;|]V�q [@5.��b�'����ĉ)"M�o9�S�a���gl,�#��I:�Fը�m����+��z���}�F�s�#��sB�zVo�~��K�`�B(9���xq���9-(��F����k.����Q�}�*]E�������F���iRH�{fej��:��7~:�P�����EY��J "�˭�� �8)a���[ �ڛgv��%k���/�!n��#��>�,�I���b�Ӡ0�@�GbthVr�:5�DU�1���W�(��{Y�����Xش��=v�&\t��Wn-.nt��k߶ϵ�,[n��d�4�o���2_GrG���\�fS���0�����=�����U+n��yи���-�FBfDB��U��M�s�������N .E��TK��[?��=F��x\G��I*n����K���D�6j�g"�)J8&�r��3��TB�^����-�jE��%g�. v�ǒ���x,�[��?�w��?��m��W�8��#b��h�ˠ���H��Fv�j�n����| x���`ؕ�-�����Z*,aj�Q���T"�gN ������`�CS��Gg�}�q��v[��&�6��DR��<����Y�o��?x4|)⫰�i������� �$���sx�=o����eb-����^5�^ꐅl��?�����7��C�P^i�7����J�I{���2j��ॢlb�4�Zf �.��u(o|�PT�@�㭉 |X���-�A ӳ��)�c$����Cly�`�X��ld�=i<�i�XD���1}�$�d_xAX��cp������ I�Jq����bX �z��������i٘���@��#��y�ב��}���9 ��� �}K�2�eQơٮ�{�[r�S��)68��2�YY�yN��>�-2�f�*��c��JBj�, -v����L�-����Y"��}�S���(����J�c%��S�� �O�����b�JD��Z w�R]���H�W����V��O3�4 ]0�`* �s���9�����d�"���2��z2�g>ra����5O�l8�"t�_�A�� )fwA�A, >a-<��x+�kš���(?��d��� �Pt��92��HB�acb�פ��*숿�=��յJ����~��.D�wG�.Q뻟~h`��� ^�~�Oe�hDB��o��we���1�K��.�%&*��!pZ�������(�5���-/ ��!է�fo.�VrX�.=�to�&��1�bk[�+*8����a�MR2�ڠpq��2 �� M��l��!t�!�`�tp��tQ&���NsuK����4�Q���k����T����6!���I���$���"/�!f��$�63Q�c�Ň\��������ϚwIIhD?��6<a�} NR� �J��c�"�i��j�트6��jc"����W{�/�
Behavioral task
behavioral1
Sample
0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll
Resource
win10v2004-20221111-en
General
-
Target
0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d
-
Size
2.1MB
-
MD5
d7c1f86e402a9dc3fcacc2d6f021b65a
-
SHA1
e1acd4af9267f47bd1f3948fdb8868bcb88d763f
-
SHA256
0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d
-
SHA512
90a4690e0298396e89a3279b64acfb37fa25b3ddec6917df34eddbe915580b5df4b10bee2f630ef2815a93ce8574fcccab3b5ea7b099886a2534bdc889d356b3
-
SSDEEP
49152:4fN8zLIixWrAVWap+93E6cUNaKr6avchdpaRZq6Bau:4l8/jA1ap+BOUNa+6CcOqWau
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll windows x86
08bbec3ece2d003d677f1f3909718520
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
SetTextColor
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
comctl32
ImageList_Destroy
ole32
CoCreateInstance
oleaut32
GetErrorInfo
psapi
GetModuleBaseNameA
netapi32
Netbios
ws2_32
connect
iphlpapi
GetAdaptersInfo
winmm
sndPlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 517KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ