��'�N!.�wk L�F�ˈ^p����[[�Z�.Mq�jr0�;�Q^תO�6�РAϨV ����@ISע�t�Țgj+�|�p��Z�FZ���R�ļ�B#N#��|�0ڊ$��~d� �Ӡ�,'q���6x�-]#�/N�q� ��[�2��k��%��{�s>�*;>�į3e�Q�c����Q{5p{���\A( ]��������j��*�� ���1��vu �-��R��P<l�<$c�u����q�@zd�/����4!t����r��4�㿏���|n{]�Պ&k���Ԩã���z����_܌|ȅ� ��� �p}^1:o��hYl�(�3Ӿ�&���$���DW���V�Ʌ��f�}��1� ^��F�oUI�߀��d�K�*7�O��� 5����P&J� 4���a���3g��~�����.V��ٞ��=��mF��?�]��^w�Ɋ�k�ˍ�% 9�{��2��J�k���fGϥ�ICH��$E�?��9aڒ��$�a�!�9S��Ѳ�އ�/� ��1E�4B��$;��2���ޟg����_�l�O�3���h��Y�D��a�x_�u���j�L���-1��P �밭b>�_������$�!$�)ǭ��Z��se�:ԙu����i\�gV4_�\Q6v�k�<�MV���܀�Hք���[pa�ib`���t��k���=��{���F��E����v��h5��"FYY�<aN�<�q��6�ɟ(��Ze�A�^D��9c$�v ������?V^6���8�8����[�,�/f �OA�l�Vme+Q[D��֏�᙮��AA��ה��1�xq�5`|Mp���Z#�}U;#dLMx!�b����ۻf@������C&E�����RPgM\���;j"j]'�)��^�&bg�s۵d����4t����������i�ۋb٬>���g�k�Pr�̾�: ��:8S������R��7������X���KֲHM����ֽ��F����C� �Ŏ��ݡ�z�`��v�Ak��[��R0�-�ܶfO��Z�'\�f��x~�!4M��H��%��ZH�K��J�/��f,���"%Q�w��r�jqv��!H͙���r��F�"e��P{�� x�ئ?��#��r�~�&�l`�7���r+�j�8l�.�(?6�>�Q0���A����\��ȣ�̵�������1!E��j�����k�c� A�hڨ�����w�)���i�O"-�R.K��~���,�������6� S#��xq�i_r��m�m�����������;�|��O�������/���6�~,� ���;������k�V��2O{��If��AO���J�rmةu��{�ՎQ5`�B� S;Yv��za�V��hpE#�A���K�&���wn��xٙ- *��A�-�6����6`-�x�_$"���$!u��P�J�o�?�e0�u����� dC��m���%Z���Q���Ӗ�����, �"���0�E�(����������ݰ�=��!���n����ٷ�����U�"$� (�7V��<���������6��ј8��9����Ŏq���ߩk�ep2����{[(`΅�1�Ҷ��}#�A/�>�6�}����^��,�ryI�����Es'۷;�5���/oj�5O6d�� �G�2���կP5�)����4 �8�H�����]1y{�%��bB�-����K!�O�m��X�,řܖ��^Ϣk3�4R�y}@��Դ�������Iad�~F�Y�b���7��W�����67�f���]��Z� ���+ğz@ }��xƲ��ܛ�C�\7V��BL���|����kQH� S]\iZ�wu�|�V7�;�?jQ�uhY]'�M^X��y����q(��D�w�9[:�������$5i���]펤_()��Al���2<�0����E|R����N���VW6�uR���j�R�irҍ�}����{����b� 0�u#�R ꮬ�ݥn4(4Z/��e@4荀Ⱦ����W�%�=d�}MP�m���]8����Ϥ�Z�����2$�nF�����Itp��R��;�mZ��!o�Z����p �Phg6V:WHF.�U.�"�%,i\@�?{>i����~ D^ٹ��{J�%���z�])Xv�b���ZI�c��L�H�4�7�h����v������e]q��wI���8����3���]<�!y�2|Rm#~5���T7X,��(v� ����K)��h��=AU;^��O���F��3�6���pĻ�4��'�i�5`�"���W�ʧ�Y���Z^�]��y�At Y��V�����/R��A4ơ(�;)뷼F*�� 0�#����p�HO〠��$r�m��JoU@?��-.����v�%��E�o���E� ��A٭q撼��V�2�Y� �uYK����3l������~��`ov��=��l��"� ~[7:K�&��3�� )�^���7dW0%Ԇ�ޫ�mf �-���m�Q�1� M��[h�x���� x��pȦ�[���tyW{�/��e1,[X���1�В8]�Z�f+/1�#�������-�lzN~�(<�����ۃ����^�٧�&y��4\�-���T�h�F��N|F��S�%_��'3�Y4��IS��M�_���R �D�iQ*0 C�x���=�'CS�?�SmS��b�i�[K�%�6��ʣ�p����sK�v/�p����]+˂��r9�V��u���Q!�sTP3���5�,4��̩A��s���ݢ*��x6:�0|סO`(�9����"+��JX�5�V��B,Ҍ�|�wf��9V�N��� �I�H7A�s_��!z�?�H�y ���J��?~]�>��6G���Hz8�1(���Aw���i���ar�u$�OǕF8��{�y��L��-b�a��A��n�CW�0�XŴ��z�x�j!�� |؍��I�ӵ��Mm�ۙ���U��w��`�߲i J�L'����6E��25����A%]��i<���Kٯ6�GH`5���Ï4o�F�8A�6��g���pm1i�2}��h���
Behavioral task
behavioral1
Sample
8616b7ad9d4a5775251f342f4e0ea47318742c300e287f2a163b7b025eab5ff5.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8616b7ad9d4a5775251f342f4e0ea47318742c300e287f2a163b7b025eab5ff5.dll
Resource
win10v2004-20220812-en
General
-
Target
8616b7ad9d4a5775251f342f4e0ea47318742c300e287f2a163b7b025eab5ff5
-
Size
618KB
-
MD5
2efe62c678022608683673aaf8fd3c90
-
SHA1
06693b2ffe7902a1afa235f3c91d9aab14212e7f
-
SHA256
8616b7ad9d4a5775251f342f4e0ea47318742c300e287f2a163b7b025eab5ff5
-
SHA512
d6dedf9a092894413c31e8f424c6b2500a7fb7d1a5d9f1f506fe35cc403b20e7c72dbc7a59bad24edd7f5daf711ef56dcddd82e58de4c08d091f839aafcd1778
-
SSDEEP
12288:Hwar925F2Z38komrW98SHgFZ4TM5SgDgj7FmASsYVagKn:HwarIFqB5hSAnfD/AS9aZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8616b7ad9d4a5775251f342f4e0ea47318742c300e287f2a163b7b025eab5ff5.dll windows x86
54f6858fa9aa106f2faa66612ea40198
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcpynA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IntersectRect
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoA
gdi32
StretchDIBits
comctl32
ImageList_GetIconSize
Exports
Exports
Sections
CODE Size: - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 612KB - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ