쌑$�����n`1(���9bU����RM�.��r�R�]Ɩ���R�� Oڃ�ỳl���j��<����∥q@�@~U���ɞ���q���v���=�<�T~�:|!3�kz�Jd�,.���j�5nG��zwV�yvs��X��Ջ�`�D�XQZ�r�u��X'�~ɪ9�A��TIƞ"���U�2�q��Ir�˸g��?���ȥ[2������i�M�c�5��DyGu��}���A ��)��2!�*���gn�E���F�|(��2�s��ں��9�C���j�������|�>��FƃJOU@��O�^߂��D���CM_[����ך�V '��?�JF�u�\Hw08,��l`_>H��FξK�k(`ӕ�^����6ݑψ7"�Q`�/����c]c�5g���o1�j��^�JL]��J����C�}�&�H�m�wT�wP��]��R*t&ԡ=� ����B5@��<D�����[�yߔ[z�I�d%��N�1�S��t�I:.cZ�v��[2Da�.���s��d��3��Xf� ��l�>n��0�Rj�_��"�#��T�'G>'�[��Z�m*oe*/��F�iF�Y�j� �#��iG8i&�z�<"��XJ�װ�X*�S����JT�a'4#�S� : �T�a�T3��!���o�a3�ĕ�c?���Vo *_ �8T���v �S�.�a���#/���R槽1����N!��v��p->~j0$�.r�i��$_��Wve{���ZH���V4���e���6>��RF��aebmdEă�@Aa2�>G�k�]p������A!�܋�� ���6��Ɉ� �+v]tQ���9L;��Vaɖ��PJ��QZC;� }���a!T��3a5� �cd?�`�f�����5�J��l�S@�d7ʬӐ�?��pn����>YO9&7���Ύ�ۦԖ����IV��m����a�J��H3e��_1H1yc�g�:1یf^u���$5/f.����l�;s����kH� �R绶����eDC��4-|D]�L�%e��e����RQ�"T�\^[@�?���/?w$A�Tc{̻1����f�۸�n�R���b:;uJW`T��`-�#)O�F}���{�|��`���M��b��G^��E�p_-�}���E`���g�U���9��XM����ߊ����1��V�jr~�&ZS��}��CNl[�f������n���T��]+b�F������g�� Q����B���B����9/f�f��'���Ik~�W����f���ʮrY3��:�݁@\���m�3U\E��C.�X���nj�ҕ�M��n�������u��I|}�:ր�j�D3��Uv�8�5(rG�@�X^M$AszIZn�f��Y�>��D}TZ?ɞ�*����,2���� �}�.څ#�E��4�)�D�M;=��H� 5k�12u(\//�u��/�p�D���JŋE},�������0= � ������~��E$�X�A<$��5�0�ʺb�oh� b�j9H�V}��� gi���f^�b ��%����t{���?��<Q:2,-9�J�&����G���_��[d0,���Q s�%c���5��=Āem��J'�uoK��x���?��)��3Py��{��ݿtH##��:�"�b���n�'�E��� )��G�%���Z;��3��� �k����ص����*��D3�h��:,�(�T��m��&EjL�8�r�r�ӭ]z'ߌ h�į�]�cr����l�YbH�� �v�T��k��a%t��peI�ی�B��7*��Dk4���wpM\���; ���V[`(���|�-� >��T��_B�>�DbU������-�Lb�җ��R��!,2O{�pD ;���O���d�����n<��s�T�����9�65t��T��h�H���xf��3ʲL@�8t�tl�6xğ#��j Y�a�q�2�GzN���A&K�����uqd&��h�~R}]��x=�7!k���(��q�Z��u����arg�\i�g��!@���R1�i�$�=�Ri{�Ct}Xp���_?��R@4!�F{�;��A;���_�P�,p{������M�*0�#�bA����"{ڦ����@Ge�ߖe�чxj���y�Z�'�kJ�JA��}Lk�:�I ��a��0*ذ�#���Q�O�'l�d�>�(��Q@9�uVq���� Q�[X1!��%# Rh)^?wW��MQ��7�2Lqr�����K?��ADZ����.V����\��M�K�<*5��I��G/<\r[r�À!jzZlP��vz�q�\(�C��b˖��b�3/>%l�����|���R��LfNՇ�z�H�1�,�T�:Lg���v��Z�)l �� �/���u���%�)�!��������پ朼;��,�<9�o���a"|���3�ʡ��?k��Ԍ��R��E���2����} ���hF�yu�L�}�*���W��B˵N����$����~����6 �g+�&4�q���)�/���.@I[��G��ܗrfF��������D�%`Q�ZNv z�?��y����+���2�D�у�]��x��4���Џ1�ɛ�mJ�0�x���?oU���XfeLϒ<�z���8�ɣ�x��pEr��Fh��Y903>|5a�[V"+ԧ��6۶��+��n��.��hF�7�0!�E���r㿢���K_z}S5hz�3��o�KH�w���Mh�̩HRd8���F߄g���eڣ�ϛ����t注�����g<E�^��>��!C��`'? �����UU�M,�8����ಚ�6k]�\�������5�lr^�h�Kf�[T�����t�,F�byȌ:/S֫�xJ��^�y-�]{� ��k�e[�*HT�>/�P�M�/����ȸ��ȇ m��˗���1=w�5�H<��G�6����U�س�i�6��$�0u�z�ιT l�u�����˫�`�PSXj�k*�yK@�b�����]� G�<�5����>�4H�B��-�F�|�����7���5��N��3_���d�.g��N�3���X
Behavioral task
behavioral1
Sample
9cfb568166379258d567a86a419ed872f7348bb166a1eff0775cdb085be63a5c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9cfb568166379258d567a86a419ed872f7348bb166a1eff0775cdb085be63a5c.dll
Resource
win10v2004-20220901-en
General
-
Target
9cfb568166379258d567a86a419ed872f7348bb166a1eff0775cdb085be63a5c
-
Size
564KB
-
MD5
d4717235e15a7a5c518f3ed08287bd5b
-
SHA1
8e6d11698f3d610888f7f1a1803733dd764ab9b3
-
SHA256
9cfb568166379258d567a86a419ed872f7348bb166a1eff0775cdb085be63a5c
-
SHA512
895b99bd6ad8b3c2fcdbec94312a6c806b53fec5deaf12c8f7ba67bdbc78b1e0b6e0765c60d252cb40a3674fa5a1699c8b186b8d0974e684bbfa008551ac1511
-
SSDEEP
12288:hQHTRUIavB6oXdMlYDxbfKNdexae4ZSv2rrWXY:hKUIggx6dfadewrri
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9cfb568166379258d567a86a419ed872f7348bb166a1eff0775cdb085be63a5c.dll windows x86
81c5045c205d2335ad1951c5233ddcf5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord537
msvcrt
_endthreadex
kernel32
lstrlenA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
MessageBoxA
advapi32
AdjustTokenPrivileges
msvcp60
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
psapi
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 552KB - Virtual size: 549KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ