<���4fY�i���~ 8����jx�<XC���8zx��8���(F�7@����@������n�̚<�z�|�s�����K*���;� ��" �|�w��Ϛt#�ȱ�O�3A����c\�Q!{�I�%v�Dv6#, �N2`��3��z���ѵ���k��N�k\@��Ǡ7�8S>]����[�J�&~E�,j�(k��yݖY8�����M��#BH.�����)bM� ^�#��6E�/�g7�"w3�-���%�4���@E�I���α�v��Y�x���N��r���#�F?b؆|1ۡe�À�{�� ��C�=��cs�>�gܔ& $յ�(b��3�F�J}?VB�r>��Q����f5j܀yp��� �@�,+y�!��l�H&F�)�% �X�U�X����H^\��3�h���}�3�l��W~D�:�B^���V=?~��1|8n�_��T�v����ڿ����[c�}���W�2�!���>�Sm�HY�l��?�c���\Hw��N�A��9�8J���������c> �Du�R{�mh�$��:T��w1x�e ���7H�^��V#;�� ��7�0�dLjQe�H�f9*���n �h���<@�e&�g�>i�Y'o#'�����I���rr��<�/yG�z�!�J��vޟ�~����szk"3pub�~�=/N�� ���q{=e����\��E��R�.������o��T��{��y�{���q�DC�@l�ZG�����P�$��*�+�=�ۀ|b��6�%��R�mSW��j�^!,u7ޝ�������v�:��ǣ�:%j�9T��*��z1�Û�,�+:\q4��j���zŲ9�E���N��-���f��OS�(��~��7!a���KC���BbC\A�RhY�� ��K�,j����S0ҽ��������� ���p����T����"#����$rH��d��������d��[�^���.l���.�����b��e��Y�3_? n�oG>ZS��y�\�7���ɋ�v����豈w��s�Y�����c@�/ã�d�� )�k8|j�Sd^9�}VA������T}�b� "�x��v!.�ڇ?���K`5ÍL��*7��P�3�� u�l��(��ew�~a8�Tb�I0�.8qp��!$n�p�1JN��.a��o���a�@>�K1�ڷI'�+��V~" ��Οi=��j�:�Jz�;�S�eCD)�ӯ�u:]��p�¿���,�u���S%�!NL�(h����j������83�}� ����G[��U�L�IN@b��*u=��{��[�q��)P�h���3��P��u�d.du�UU�3�@v,��t'ql�h7ܚ�]�,�3z&݈�/V}*�c�S'C#��Qb2�M�W��Sh�P+�R�h��zo���]t�T�h<5b�_n�}䦳斛�l��d�g,ƅ�Bg*w�L��O1����ƈ<*N�}Ԃ/.T�>�w�;�S��q^���cj�9���1�3W�B�QS�ZwA��7?�9%���l����#��{��̯��{b.�m�3w�b�X<�c�W�������.�+��X I�)��Ոo���t����/L�S�XU��r`�eY65ne�֪������W�O�+U} >!u��j�0l�d����Q!Qv���lm7�'P��A�̮J�:������t�ZH{�]h����8e�ِ&Uǩ�NP��#����1D�a����B���?�G�Q�E"yai��$vV4�O� �t�`�����'WþD�c�s��u%y˔��/�_�CH����� ��k=VU�h��ҥ����x�;$^�:"Z���gǧ m2��ntC�k��a3�_�Șꢷ���������,4�.��yHHב6�΄�y��v��J &z?y{��u�|����T��'�m������A:F����?t�_�����@K�N��Q+���<z�M�Q<d��ne.ef��}�g��� ����~L���dC7����%�,���Np� ��z�c�|e�[-�P-�����C24��Y�Ɏ�p�]\��Xbf�����нe�@��U$��\ �9%'�Y����xj��BO� �[�+2�-4�OIn�ʽ� ���С��<�#$z����� ��9q��w����ZY��}��<�S�@��&�$@6����@"A� ���������} 'n�.�wA��N�5�]�8I�S6s�e�v�����kW@X���_�pщ�����z_�}�=v�)��r���Q��|�C������J�PW��O�Z�[�(�1����Y�y�����f�L��ӆW���s���v`�R3�/��M�*�S" D��&D�ȯ����� L�*��]���=��Y��F1E�%R6�,�$g�y v4�� �h����R̓%�{1����!u���Z����V�)1#O�� '�N$ϲ[��w_��N�5Βʞ7{�zc��|'�*�5U���?˸2�|Y0�d�W_i��?���p���d�t��?��Y�:#��ܫ��C[��XC�� �2��^�n��a'��f�g�YF���=�.�A����hh�|k�q��fu���Se��<� U����IT���2�;��O+eu @����7�M��V/O��j1��{��Fi�/�2ͮ E0���zl�q�� v��3�q< H�+n�^��xJ@o ~.FϠ�_��;�.�����c�������YI�� �[��AT�9�]Сn;g*'BI��?s�� c�M.�M��5� ��G[]Ԯ��ܰ�A�s.����P�>�³u��p�V~En�FE�wC#�P���2\�1����f�PԌv��C��}^��z.���s�-��2f�N��2��b*���J6˖χ���"J�9��T��D��r� ?�� ���u��f��������V����DB�r��tbL�1�*EO$�mN��0s��tLB� �،}f��5�U��AŊ��i�f��=tH�AO����X��k{��P������r!�/�h��E�տE#����4jI&�3�������^l��K'�NoATk_����V����}�'!
Behavioral task
behavioral1
Sample
9d6e5ccb4f34135da8d53b76401a122aaad8017ff3fb5e3dd6557f2b10eea1b6.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d6e5ccb4f34135da8d53b76401a122aaad8017ff3fb5e3dd6557f2b10eea1b6.dll
Resource
win10v2004-20220901-en
General
-
Target
9d6e5ccb4f34135da8d53b76401a122aaad8017ff3fb5e3dd6557f2b10eea1b6
-
Size
88KB
-
MD5
018b0ac933f54225b8e9e89335132faa
-
SHA1
a964e12ea6afbd6eba287e5f3d119d5cfb73b17c
-
SHA256
9d6e5ccb4f34135da8d53b76401a122aaad8017ff3fb5e3dd6557f2b10eea1b6
-
SHA512
b2cdf96c6f30f447a5c4af0d972ae94dd70f5726c3359bda864c8514f9ca6e7660a4ddd7f723fc1b9d5db961fb796ba8354aaab3458660a00ef8c7af8ae09aeb
-
SSDEEP
1536:WUgke1cxXcHIAdg1WYLGHeLh7TWJ4Pc0V9en1pJ4pFMMm7ZwHtUxcsBbZPOfdEjy:OjcxsYAYLmehTWJ4Pc0V9eLupFNUkmxa
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9d6e5ccb4f34135da8d53b76401a122aaad8017ff3fb5e3dd6557f2b10eea1b6.dll windows x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ