]����9Q�� @���vwu����y� �M���č�Ԣ$o0%6�-J��E�Vr��D7f��Ĝ�d09G������陇[�֍ Y��s���ET�� sF����x(۶� �ՍX��K+U<�� �� Fby~2q�s��k�ISP�!��c�'�=��6�D�%>λSʮ���liG'�8��(��=�Af����zj692e��X�z�p�!>�V�H��ތ�G��k<7G���B�%�������y �7��HdP#W՟���Vt;��8���a"ht��Sٰ�`Ei����4��,�x�3�n�TA��n�J O�Z֧W�q���_�*uU�E�ե���%o^���y�{�͵��Z ��:~�f~�,�ك��vZK�P\�c�Jܠ���yXQw$B7I�B^�D�@vND���{��_������0�"?a��|D�]���V��(�Y��/�@5�`!��t�xq���q��Pv7 �B���((V,�E��w9�I-��xU5�W��6��+�����AtTe/T�F�|#��O��z���З� �7�pQ�L�"Y���j��gC)�|o[�:���S�BN�k�@1���B`���<�8���� \�=`�����(�VT�7�!����S/�+�ĩ)�[�����vT�M���1�~�|*:$�������1Wc�X���L8)5�~� �.�9j�U~���G�����1[u1����<�d�M�u����'�n��G��"ϣ�}ښ����+��C:֏F���]a�Ш��N�"h���)�B0:�稞�n�'����Ϩ��_m�]�ު�`�NG�Ni8�i��B��� .���R��|F�T� <Sx�${�n|`�@����zm�F�@�S���^+^1��Ԃ_�����=5C����X^\�ǁ���ތG&�q���! `o�!����9U�����MUٝ��4oNK��Z���V ���=�yg���RxBSDx]�pEp�������� >G�M���A�B�5���h!kݠ��D`ћJ�+U�!0R�,���,@7�t-�{��t�����;07c����`/mV��~5�f�������^���X���oݦ��d�F1U�"F�յkAY��U/]�|��=*H0�`uG�:(ۣ�dMٛ�ә������5`c�e�9���m3�v���a3۱�P2 �t�� 8w�r��%]�H�1���j�nZ�o1���ۡ�р��q�$�=�g��� L!�{pH��&C��z�����~���L<�� B!L���Iwu�����.w�+�q�-d2�1�Q!H��{n��YX��&X����<{U�ɹ��3��<��w�6E��������!i�B�*����NPX�����0^�O�,�q.$��� k)|�vS`מLО/A��75�������� M��uZ�X`r3#�/�t��J�����-��w����vQ�5Q��cDHdwMG�UPN������vz>Аn��DEsʮe�y���E>�˓�9(%�D�J{����X{�jhjS+*6<�#�.������ePTX���e�dtcQ���mt(L[qi�^� �j|G ��������=�M�e��3�G"̓���a��;�"�Ck�5#�ǁ�}7�~��?ho���U��^�h§��~�.wt��m�����"!G˪C]D������6E��xe �>��ܜ�A�$i 5����y��>,���q�1C�*�.��p`��� r,6 �.�6k�f���1�WV���@��^<|j}�f�H����jq�Y��ֱ��w�8���Q ������O������x�X�d-��^� �=�e�R�)�?��[[u�BP�x�-�t�;�R����x�;��k�0s�X�ax�:ݖ4QO��-N�s��=�t��=n>����=��|���"�͆����'l���- T�W�r��1��[:I�g���\-�I�����ė�9N��O�d>cZ��������a���|��D%�-�&��F&&\�w^��TCnF Q�B\0)u�#����:B�Ll�����Y�U;��1���B��V,�9<x��K䄲����4�+;~�5�������~Y�S�;#�]�k¿�,T�+�j-��@5�8�h(�R�����ۤ��N��倵�}~��(-����BO|�"�|Kl�Q��ō��KOD2�a�l�b��=n�wX O\��II��< ����������R��IY�*�Uյ�_�?�H,jr�����6�"� ��߶e�q���{��4��qp~�zIL���M�,�eT&� E~ 0�X/l��Ԝ�s������������!1˞��` .�-����R�]\������ �Õ�@�/[K�'�x����Ρ��g�T��.���2�f��L3��}Aڌ6�nR�V���=��z�fk��l��x6���@�5hƓ���z����ZC��v�5�2Խ�ܿ���&O��Y.pV�]@�Y��!�t$�r�����.M(���U���c��ù�`�9�6߾��%�J�a쯳�m�zIy�%�t�0I�߯Ḋ�{DbE�����[Z �û�a�0��7r��зµ�{��T��<�� �d|4 �H���p #3������3'���͊�9' %�a���Нa�١��?��ZD��#�{>w`&/�M������b��R��f�HF���hd-ԃ�0UTޖ|O�K�h3CY�*�\Քƕ�Z��_d(�X�(O�S��U"\Tcd&��*����L��Mc�� �3ɤRz�UfS � ��̍���Z�����D���M������E�K:ׁ���@�r"Nl PFt9�y��a�}k���:��m�"??�+�ݽ�0�b�n���B�*U��S{�S�.0sc���viC#zt!۬������G������ˌn�Rl�e���"�3���NJܵ�����f�Ԧܧ��{�VO�)#e '�U�����:"�����G����k�q��~A��b7\x�������%pZ">��m#����hXcE� {$9�����1�>�PYf����Ar%��
Behavioral task
behavioral1
Sample
bb7a61da5524ed45a3b0bb892ae581d29a904b01e82a89c022e69074bc90d76f.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bb7a61da5524ed45a3b0bb892ae581d29a904b01e82a89c022e69074bc90d76f.dll
Resource
win10v2004-20220901-en
General
-
Target
bb7a61da5524ed45a3b0bb892ae581d29a904b01e82a89c022e69074bc90d76f
-
Size
84KB
-
MD5
6677e75d69940a04d2582a06eba3764b
-
SHA1
908144eefe5a8e0939209c85eab12735a0affa7d
-
SHA256
bb7a61da5524ed45a3b0bb892ae581d29a904b01e82a89c022e69074bc90d76f
-
SHA512
003574327c36ec92ca4e62a5742e1e099962156f8ad36ac2756eb843206a275dc089503fb0db646667f34f1be0a7c103e3b9ad4b26aebe7227075966d1e2c5f7
-
SSDEEP
1536:qsfujYrw/DqgUIGg/6BXf8e7O1bSi5QhjhzlLmvZTdWne:qsfujb/mgUI90Xf8eir+jzlSWe
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bb7a61da5524ed45a3b0bb892ae581d29a904b01e82a89c022e69074bc90d76f.dll windows x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ