�em���p���w�߉�H�{&H����_�(���>\��'ڇ�h���y�Tһ46�'�:�r��s4ݧ���A�ŗG���+�O����=X�txt�5_:s�� Ԇe���&�ux��}�XC��sn���C�W-�L')�ŸY}���:�7��2Lw9����#����ʄR�F�C?6jcE:t�I�O ����/It���ʎ�~�X��e�}���GJ�c��!YK��:N2��4�9��N��������+yu������ ����'K���!wY-�tTX����/��~m�Y�XB�'�IgՉ�Z Ռr!7~�n9��m%��E��v*F�l݃�K��yia�̹�?$?^o�3G_�[ʈ*��a��4m7PSο����t�h�d��,��T&`�T6���b)�l5Η��Q0���v8X{~�B�F:�lJ�/B�Ɲ�[���_?����l���_FQc�PI���_���%3�8��sj�S���K#wab��G����kZ{KƆ�ϗ�����[� �ّPH�R�r��Y�%+��f����W�� ���I@2LñI�Oo��гކ��.3�Կz P����7���Jއ��Xs�aSj�[��{�b5�1��l�q�t�L��W t(��"����u���QaZC7))<�7嬾u;��RI��� F��]זs���(=�zS.neԢ�8zIZ �W���� 0'���rU���e�ހv`.JD��c���Όf�w � &���$��`�i�s{8kJ����1�TOь�ߋW����#cP����a��Xk�5�NX��j6�����R*喲�Ő���ۉ��$��:ė��Y��6AqT��Y�c��}�݂�]��]������_f�|Kr#Y. ���x��a������`ʟ�e3��r��?��YRc[��d"�a�ƺȧ�����yV�meh;�ݗ�M�(����������pF$��Ȁu[<i�_��kF�D�d��Ҏ�����[ c�ʚgS�p���d�LC\��i�F� H�n�EȚ]�s�A��D[�������!Yz�:������:�g�����m?D�~\:�YI��}��� A hb߂;�i}��8g~�q����ow�à<� 6�ݰR�H����#u�I k���*�%��_�C��Ʒa��a��{�����:�~� )An�qzp���#h��-�y0p[��C)���}��~�a!^�r��a�.�csݨgB�^ڢzS�ȲHs0j#�Ҏ}͑rM�.��qq��X�$�g�nH}����!��9$Q���9y_ofk��k�S�#Wg<�e�^�۪e&ǥ|eS�>#sEt� �ګ+!Ϸ��E��&p��p�W�05 J:V���T��N�� �7�&?.���v��ix�������]���g���Q���f�>��sXt�3���sJQ��Ԓ0�|T��#�+��v�Vf�T0�pPMQ�S�ϲrL�>.z�����B��W������54����ۼ<(��a614���i5�頠�vW�ۂ�%������Dž{z�cp�|������D�-�#�$����+]�y��Tҧ���)���rI�����{0)Π��z\Hp�<�9��R�N���&ȁ^�|lF�����S$P�$��iԜJ- Qcc���^Ō]���${�.�Bx=�bwTT�řO}��8�t�f�'� ���|�:.�W��y^.^`�;}��y��I%'`��@�*�Y�����%�����������գa-#�,�Q� �1�tʸR'�[�x�R���b���q�nds�Q�����C,��U���z,�v�������֨��A���^���Iy�� ���������A!wR�#yMlb�3�'���%-��ya�ʷ�9���&���m9�i^E.���W������?Xtu�� &�2�C�'ݥc7?D�1o�1�meA���1�_Ҵ ��%�} ��,ˁ���ũz�V~]#�������q���H[N��D2䳻�l�i|���K��YjgD��&sp�_0�C���n��n�l�H�H���5�-���ޭL١���$'��P"�b�n� Ц�����2[�%�}�@�����9W������)-i��Lh���?���$[����:��K`<��WM�l-�� L]�N�����{����?�6O�ѯ�J���Y�O-�J�B����ⶸ������L1�~�%�� ������l��f������3�v��ɟ�S�oh<a?����k�º龫f���N���U�T/tmy<��kyvnL���N���D��#���l��9v *��olK�9�z;�%�j�1>���;"Bcb�\^Y)�o�{ìlTlǶ j��-�m�Ɓc��*�4�B�-�]�2\/S�8�a0y�AҺ�d�(�_��D���-�.���b���Wy-dVŰn����}�]�_�A�L�b�� �Ϝ�@��PQ|#&�I��qG��9�<�}�r��s�P�5WNv�K�U�����Eae#��v�.f�刟���J�)8�~[6� ʊ����!;��M8�!WA���������d8�R *na����9eSEb{�jF�=��y���ssŏk�r����%\u�� R �%Z��Y����˚�N�Ѽ�����qz *Jt��㑇[)½R���6���B��,ޒ���rq�$P�uޠ�*��b�ݢ[�7��Q#���p yD�x�M�?gz��i*��COu뱢�����c�]lE�k/���g���b����~:�L�����tp�3U��n��v�#ړ��_�8����~�-ϵNƢR*<�E��ߨޅ���E' ��u�Ӌ�ST볜}��H�oc.����k��z���Ԩ"w�aNH'�tn�!�|�2F����X�u' g��[���I�)�3�eG\V�4���-R�~� �6hj�ӕ�$�_�ꇳ��(���M���2=LHt� ���؇=ck�P3vu�Q�.�?����p@�, ʥ"�?6|��[�"��<2H��� �O��^��� k�1M3��*�D� ��o�b�ژ�E�c
Behavioral task
behavioral1
Sample
46923e91acd91b06006a62dee94710f31ac57587443a68c57014c486575e71e9.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
46923e91acd91b06006a62dee94710f31ac57587443a68c57014c486575e71e9.dll
Resource
win10v2004-20220812-en
General
-
Target
46923e91acd91b06006a62dee94710f31ac57587443a68c57014c486575e71e9
-
Size
433KB
-
MD5
7a59a9eb0c6b85485ebcbece60ebb690
-
SHA1
eb3973040b09e12199288282bd0b8d3b547765d7
-
SHA256
46923e91acd91b06006a62dee94710f31ac57587443a68c57014c486575e71e9
-
SHA512
add70647fa5a8bc5c8a2dcb65596490ab50b5bbbfeae6142a4432efb43859038d0c5031acf05d217a7a8f9c77fc868b4022f2ac4fa7a66fcbdef957af32d0a21
-
SSDEEP
12288:QmFUTW/b/+FDbee1g8G3kkrtfGTApv3cL:QOUTWr+FDbesG3BtfLpvML
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
46923e91acd91b06006a62dee94710f31ac57587443a68c57014c486575e71e9.dll windows x86
201d2d0659493ba8ab7248337073ba04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
gdi32
GetCharacterPlacementA
advapi32
RegCloseKey
shell32
ShellExecuteA
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 431KB - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ