)��g}l|B��I��-��H�z��%i"�z�6KWd_���m� 5����E���ŗ�@��Cu���TV��}�z�l����H�W��0]Y@���V� <�믕]�G�Z�r�v�)|�9��j���I��4�N����8����<4Ѝ�8�ڻ��`2� f���õ¦tDڥ��2�����y+Lwu�Ń� ����uә����V������[�ϱ�i!�y?��+�X9�����=ET�M*췤����Ėz��ůH6N��xVVF�g���P�����u`�>�5Ōw )�H:DA@�.�ώJ_\���!=�P'���3W�;d���f:N̩m�y0V%N:|�1�n,�������3��x+֣Ӑ��X6�J�d]5�/�6#':"@�6�/ߊ_�z��c\y���t �Xv|����k���ZM�Y����!ݑX��m�7~��l�N��\V?����kt(�G�?��Z�*��:��+�?�n$I��g_������0�g�����Q�Īe��N���.�e7�Z����2����~�,\eH�_�E���39֕Y n �8��t&`w bC�f����arHp�<���A;��gz�MC}/�;����1���]��!�Y���QX��;Qq�xIzA�ch]t��'8���*t_�hwi��Lc\����t���\ [�����E�7 �՟t�����N��M�ot�4�x%:g�EEǑxE��D�Z������9f�tS%V�tc���"+�=�Exg�=���� \DI�d�~��*�# 8��i��{<��?&�����퐲�G�[�7�xm/�>��v\ �C>��m�K���.t-�B�n���w��D7ׇj�/%ʛ0�[:v0>��H_��^�ث�F��uM4��E�/�d;��_{d�m�N�[�!�im�W �&?ÃOz֗�kPs�?��'��D�V��9l�E�Yɢ��{b��\��m��d1kAb�~<�6}�ΆЧ�EȭE�;��qw��IV�`�����S&6w�;��2*v�� 8���yVlj��,t�Y�A�n�&�);�Y��V�2H%����C�#���˲��Q$o�ꃵdt[gȼ���X���DfOF':����$ˢ��C|3`:o*��A�|�:����E������g�U�����[M�=��i���nX���=M��Ljb�T�S�W���8%��!o���bJ�R��U�#"�?V|Gj�M���a~���R�p�� i�J���t۾#GR1'�F�c��z��8�U�/��t�k�[���R���4q&6|���7Kq��6���ۺA;�F`|����w�9��!��iZ��& �ۑ�d��J�wa����XX�G�~oOy(�'��o(]-��&��C�A塲H [~O���*uh�C)ß|�� ۺi1:���Q%ӋH�S�� ���sa&g!���ڠJ�_���R���*����tVN���U�*������>v�&F�dxg#K���A�y��`:�5�2��}k�5'/�ъ� Z���̫���kA���������z������VO�s+\���B�I]�l��H�Q�N/�Pp���_�ᇪ0z���e�>9��Q{��iat�a�1XIA}C��O/�r�ó�rZ�R�A�l�G��(�)̓�_�l���M�_e��``>"{S�Hi�ѷ�gG,p�V?�~�$��8/� ���gd@6����!)���g�4������B���\���1F�o����v�ή�^��e`\J㛜8�I�ަT(9)%�$���ʞ�_��_���a��.�%H��ޫ`����A~ک�x�L�Y�����Ԥ#�y �b�K��2`���i�¶�<g�q�\��Z������<��IGx?BP����^ �kM�9��#��]6ɠ�ٌ&�[r�+��2�|��ͩ������3u���͚�|���K6g��[�D�� ���R��' P.2�Jp�p��u�S�g�i�!��ϸ��z<�G�{�\kC���~�`<R&�mk�P�U��,���Z٬�;����l�[_2�� O�h7��� �p"Z�������0��W��hLᾱ%N �w!� Lplf�8'.�Z����!�������^[�������4R�=bi�\A�~Ӛ�auM���� �dJ��3���e-�>�k���I��?�[��B�mʃ�[y1Qt妾��0�ᥬ��%�I��F���M�KZ$���)�)xT�HSJe?��ոy��P Q+748+����Hu���'~n���[�p��c�%$��@%�ɰ<7땐��'�Hp���!k����87Vovl��h���D��G��3���b�ae$yH�������O+ؘP9�\h�����n���?����7)�3�jg�oşm�h����P�ɐ��x92����'��4��w��� "G���+����]�����Ĉ1@!���Qe�ŀ,��'-C���u2G�(���'���$c���^{�!�<NJ�V>oY>-�g7��sK/�ؔ�`���u>���mw%����2�+c}��K�=�=���W[ ��tl{7���&%o�Dj P\�1n��� 0.,p���ϒ���A\�*��Cʺ|�L��V� �:T�xv���%�2��[>x"��f�Q��l1w�03� ��}���I��]��k�|Vpw�S8ؑt��! ��E������uph7;�B%��8���������mb���T����KA��f�] )�1���KK���8_B�jA�ne�������r=���� xR����έqK�6��X�t���~i�{�{�H8��)� K/;�H�7Lm�U��e�NI�ς �7=���@�5c��l��EG�({5+�y�}۱���_�1�"7����*v3 ��5w�w�EO��eR�4�(���Q5*\,�@�V"�&��C7�1A!��ǗΙ(���VMcP4��}2���}��h"���L"IUL�bVIDF��¬@��g��!��a�t���2�%����}������P�p�rLV�`�e��X��4�,�Z�T�J5,��%.A^��4���ڌ��*F�&�+�'M�N�/Q����
Behavioral task
behavioral1
Sample
9631e0d3313ec4228170b96a7cdf4701fcbb573b162a4f0df26377fe0859385f.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9631e0d3313ec4228170b96a7cdf4701fcbb573b162a4f0df26377fe0859385f.dll
Resource
win10v2004-20221111-en
General
-
Target
9631e0d3313ec4228170b96a7cdf4701fcbb573b162a4f0df26377fe0859385f
-
Size
580KB
-
MD5
ba21a0b60e8a80f1f44e05370cd291ed
-
SHA1
e2f6157f0f58b3b5c316efd0fe43567c8c71a8b7
-
SHA256
9631e0d3313ec4228170b96a7cdf4701fcbb573b162a4f0df26377fe0859385f
-
SHA512
a6e073bfa641edaace01a73f5e431578652a6da4416ad8d4a78b6d882defc41b74cd8372cfdba11820046bb03a1dadefe81e461b6e176e1776a45b87ad036fc0
-
SSDEEP
12288:8Jv/lpIRd5n5Qx4P2J10UVeMC1e++HYBFvoMNNiohkHQWPndzhv2TCVJ:8KRdUxA2J10IKeyjrN8zwWPn
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9631e0d3313ec4228170b96a7cdf4701fcbb573b162a4f0df26377fe0859385f.dll windows x86
bd3a1f4dfa2a45ca6d5056e949c5eecd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 466KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 568KB - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ