����s�v������>X2پ��ÜC�n����D�7�<p�r���o!��+U�+�X�r����D���ַ�6 ����x�%l��|?0>O���T|��|�k��k=P%pd}�O[�0D����FQ��H�hv�͚]�$��rl.%o��'����"�������;;�~e�ڇ�3D �i/Z�]�?�3����^qy�?��|�s�5�C��]<�Z�IJg�#���$����w@�V�n�4�H� (Ek�/z�x��ų#t���M������)o���=��Zc����R�(X��ܮ](�B�L��+�=�]&��c�$�����ܟ��.�`�"|'.���.�=(�ߐ�XOy��~<RsXY��㼠�(H( _��'��bj�69b~"Vw��̔�P�y���j��6���y��Y)l�f�'��C�]�=�z�{ )��Mѐ�e��'�|��ы(���rg �Ͳ��W�E��Jg�bn�\����h�61�uP�B��/���6���k�2��*���n���gB�D�[Zx�@����d�غ��,�'��'�R��5���N,&CQ����VlA��*�t��?/z�Bݣ5S8m�/i�|��a���|<���i��%=p)P'�����7��V���MY�xb�t��ʂ�I����N��{�����ϫ%דb*6g˱���-�AsI��S,���F��f!������i�ݣ�)�A�xIV�Q�/R�O�jtL�Vy'���BAO5p��S�q6�È���(���D��сѱ�%��!J���'��==���V}>ͣ�I+��b�Q4�3�3q�Z^4��l1�!|�)ת�H��W�n�~�q��Z�~����ߡ��ΞpevB�֕$_[�ˁ���R��s�?���"�F}l�R���x�5�*�9�|���ū�"8������m�} m��)�:8RI�t��Ԓk�PL?"��(Y�SF��rUFC�^���xqc���`o� sM�&��kPA�9�$�ݚ���)�}/�P8�9�^ �bzfR���e��g�����>����Z�j?��;���%�&?@A�`/B���_*$�|3&���]�زMO���Z�<p�LzՕ��\�O�� Z܄ԁmU?q�&Ռ�����������0�y������� {������=Nxh���ް�X�ȡ�à�X�;����o�oHņpʂ1:���vhн��^�^两grsjww�-�~j4�/*��v��#Kd?�.l�M?�{8��wϽ����K�e�i���9�����4��>}?��2v�4m�lс�k0�aPýI2#=�4�y�y��n� ��_ W$� J�}ΰ�2]7Ҭ.`�<5��&%���B�g��N��+���s�ˌ�V�t� ��= �$�~ �fK}�tuQ%����opV+A���өt8]���m�� ���ـb��N܂����V�e����H�k/r��p���I{�5w�3�<�m��v��+6����_���F��D/ǂ���cxvSsK��%���Rd��nK��h��I������y�bTZ�$�.O�2��P�JL~U�-��J�4�b���/���I'��W1�u�j����r8����(�d��#���C�a9��,�ʼn��N;��4[�A�5�{β�K�Y��R�;���Ht�K��o�W�����ؼ$���ϰ� �o���� t�Ý;QW;��"��X��`�ꦰ�H��&Wk��"����x_��d��0�����C�#���0���R�H_'��X��+�22;�##ܑ�K!;�*����i���%��硒S�S.�( U�Ŭ�-v�(��0�e�v�#ZL_�Pb�-^��(a�˩���K�\P(���݉뿣3N��_�ˇ�X�o�"6u��`��@���ր����3R�W_{ͨ���=D� /?옕(���L�f���>����{� w)��$7fř���<$����.�&۶��}(+1q�� NG��L��PZ��o[���p�m�Hէ��+��D�C|�ڷy����}�8�_3��2(O���a��l��j��R�~ N��sO�hi)o��M�"��XV2���ʀ"�c�t /w%t��J�����?=��nH�tzc��5f�=�,G�e+��F`�%7,��ֹ�viU�A�9����N��q�q�+4�ԘEd�=L���x�S���!���U�n{V�9��������D4@!e<-�"�"��)���'S���t|A�;�v/��Lp �K�F���)��:��ʐ�y\L��_晖:w��h��-A9�iE<�u�� �J��Q|����-�Vx��)騸���{�����z���X���3�v��G7I�h)��Cw�����^�$��T3���sj�d�Gx"TP�?1]�G?X-�8���C��R��d-���4��~�f_����?�C�Z��\*y-��2$+��X����9)s(�Ȇ^ �Ҳ=`��x^+��4��;N:��B��"/�N��5=w��@���wW��L�w癠#��E�Dk^C�����<��B���H�1���43��)�l�7�pmsŭb�����i&����pH��^[C�k{A�6�A�L�������ަj� m����Pf@^^��� �����a������g���`o6b�Je �o:!�C���`E��A^� z;l��l��ڔ.��-�r��-bUKn�.g9�Z��o/?�AHAc� b�u/����7�a�8ci� MY;%Znoi?�m�ߨv�|��cn���/��P�a���g�va���:N�yR���Ǽ���ӗ������eB^��D���$�ƅ��Q�\G��֫8��ؠ��L&4,�n�g��������(��W$v|;�?��u��P� �pԙK�O�f\����XC�52Ys��bǍ;�b�w�*w���`&��4� z��[������R�UtƮE�M������8y�Ǖ0g��n,I���I�Z�o�zI��]�������g�X�;�����)��r��� f�q��2ɶ-b�����}=5ǐ�濫�0�^_�C�<�(u[ժ�� |\���߃t0ޗ
Behavioral task
behavioral1
Sample
a4ab0a681e91ae2070134b9edc749c356ba18e648c04be9bd6e25ab90842167e.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a4ab0a681e91ae2070134b9edc749c356ba18e648c04be9bd6e25ab90842167e.dll
Resource
win10v2004-20220812-en
General
-
Target
a4ab0a681e91ae2070134b9edc749c356ba18e648c04be9bd6e25ab90842167e
-
Size
316KB
-
MD5
68a032ab72477946cadc43cea67822f8
-
SHA1
5493742f3ddde838984a01f633b23c258f071cbf
-
SHA256
a4ab0a681e91ae2070134b9edc749c356ba18e648c04be9bd6e25ab90842167e
-
SHA512
284894a3a468779cf670ab4585ae5869e1d987a64960ddfa75e706d98e360751b86b6434142b5ecdfe7a07f55affa1e7d2098a9c7eae9c8f0323428c8d95b5a7
-
SSDEEP
6144:GK1LebR0k93c3rZvSR1YWqGXL2ZtjuTOdxTgU5U9CBgb80MNK4np2rmM7itQc9FM:GK9eakRkhSDh2ZtjwsRgU55w80M04npI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a4ab0a681e91ae2070134b9edc749c356ba18e648c04be9bd6e25ab90842167e.dll windows x86
4695d7dc1a08c0ef020772e32bf4e2eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileType
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
gdi32
SetTextAlign
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 304KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ