#8Ê�N>��o�iQ8���5���u L@e���ta����\�jO�����Jt��fX��4i�c�:>�fo^�J����Lo��=F1�W���p���c�gK||���ä8�$�s��>%A ����,�4aj??m�n�U@U"m}�o(�ӆ�h7��`�Ǧ�35h���oL"j��ϯ�6�~NH0��P:y\�l=}�����CŶ�5����d�`=! &x_�d�9b�*���Xs������ye}�Ϳ��v��%!�X�4��ZÃ��Q��l�����m�X�N?F�`W�$` ��-���;.�KT^nh\;��g"5 4��k~|)�<&0�����y;�e�M����K�����)e�tN'��96ۉ�xEH��w#�ؽ��m�%'4��}� B��v�&��su������O�٭��1� ��"=�L��-��ڿ�;UޙO��~W���Kτ���(�z6��ڤ��b�]Р��T�yNu7��:g�͈���2�*ĭ�'�ͷ��zѬ�h�u*����LӶ+� B0��Ie��9ǀl�fr�IŒ����r�8��7ݗ<���� YC{$�2���o��tV��E*�Lߎ���]]IG����Bٛu}?Ƭن]}�R�'d������[-'.roJ.Ms:.���\����& ���x� ���YIes��B�|Opv��x��z Ln@��dH�խ8fݒ���S�hHlJ� hs �8X�ۦ8=b�Q�iü��?`[�nR��bB���ԉo�%����9�o:a�J/����,^z_���|���z�e��C��.5-��k<z��up��%�m��ݕ�'�T��Z>F�"��\�O��-��vH�٪��'���P�A͗Yj��6�.���_N�(1�p�(:p���������iBu��Q��I��@ ��h��;���v'�4�0i��e�p�yp��[��?��>���<�N��}���\�ȕN�I���9�� �W�Gм1�i�_�@�Ƚ��9D���T�����)w��Bk�h��;z�j��i�@����._�of>-.#���)�U��)B��F�Uu� *�Pm������� �4�B3���떚 $ɕjo �j7��\�׆)$u�B 2�i��4W�cDp���Z�ݩ�����J {Ժͯ�z��e������N�aU�p�sɁ�ؓ,_������B� �\���X]F��q~x�/|IvR��b�vr<�xL����M:o'�]�.�Q�������Tg�� �zz�<H�TA��'=�����|/���:s�1ǧjw�-��9x���Tl����X���P��d&7��?U��������L�>��y�xg�tk���W�Ɔ- �( �k�v�{V�FP�Cj�������Z���$����h\i�^��Sܲ�4B�[�M��WL40oMFS��ή�-�!��M�1�V�p�y��������S|roeX ���N�P���y�#�dFp�"j��X�DX;�C�ّ��#�Lw��H��� Z������s�2J����u�@��c����Q?YXm�hż���g��Rg ��DW83fs�#�es� ��K�[ �V��R����Y�E�P<fE���cJPH�J9��.���o��|(xY{�C��ż�߃i�OW/Ϗ� j���n%�I����TV#Ϟ���0Q�PUe'�,>3��JRmb�-�e�U��w���U� a�� �yH��G���W2���/���ă,��n��3�jK��RbJh<�{�ғ�<��HS~?�:2Z_���x����l'��|��)�����-R58�ٷ��J��]w->MX�s���f�iK��PL������{N}�% x�0F>*+�Q������g��T1��~��8����9��#t����Kg�@�2&i ���J;& u������m7�7Wu -uk���p�tY�Ot���}����?iJ�7ߋp�`���[����!����>r]������)RY�sC�J��nu6X��N�!����Sl���*������̀����\��q�'(��4�M��p�n���cx�O�dC4���:FLoÚ�C��v%�H$1wM�E��$��"[l�̎�����:���mC?�h. nuv#��c�|���Bx��;F �p8�����m}!hD�/�8Gˡ���Moě\���,_:3�g�����1R���E_Peʢ#a����t���M�@JG�%�l����I)v�f���������,5̖* �D�&Xg��U��LJi����& ��:i���%� ��r'D*�6�k����2�����~#[鱵�~c�f�㛘�Ñ<?�Ӟ�PD��Ѕ�`�M�7݅�'چ�������%��mc�W��=oj!{�!��������-!�ژBc�p�!@m��R�LU��i���7C����N�������W 7��m�A%��'�c6�dv�A�(F��kW�{��SL�_��D���l�fX�F��������t�O��0�Ƣ'Z*�U�δ�J&��(�]g$�x��Y/�VWt��"����O�$!_�$&B7N�l �0�%y�\���f���[pѻ�������O~�xQK�g��k��8U� sfz��6jOr*�=X�>ϑqb�&c��&�,mu�M��r�syF\ ���C&����P�x��wd�$��{]rY�V�ai �r!D ���u��3��bO��R�}����%�#���~ v}��?�d/�5ѭ � t<n{E^�zȍ�q$�� H���w�d�,n�7�����=����W�b}1���7\u�������_����4�r��1��Cr��&��b3L�k����a��� �.mi�l��c��f����u3�A��C?��.V��� 5s�X*�ށ1�&�}\���pƦ(~��4��C(.���Wd��n��W<���Rg�1�p:v�����X��ls�����,!P"7��|2�J-ã̗��ΖW.��� q�`�]`ѫ�v�U@i h�&%�w �2$��)��X�U�L&f"*蟱�b��Ȏ�$��`P���.��M���c�h��g������.�m@{��T?��.c�4�q`w�56i'�+ܣ�}�5�J�
Behavioral task
behavioral1
Sample
71d338d5fa88daa6f6cfa8f02c218a369c8f25c40133e934676926e98dc57754.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
71d338d5fa88daa6f6cfa8f02c218a369c8f25c40133e934676926e98dc57754.dll
Resource
win10v2004-20220812-en
General
-
Target
71d338d5fa88daa6f6cfa8f02c218a369c8f25c40133e934676926e98dc57754
-
Size
436KB
-
MD5
5ddf980ef2098dc5b7c39ad9754f2331
-
SHA1
2d90e2d2c7bd6e92601691303125a5f4621921f0
-
SHA256
71d338d5fa88daa6f6cfa8f02c218a369c8f25c40133e934676926e98dc57754
-
SHA512
94b25dfa3fc964adf6eafdff7280acf58f6a38e278b3ae6495aa4a27ab1bd7509f2d048164e01c03529e8773221c057e458c623927f082fee5dafcef89c80039
-
SSDEEP
12288:gnX0EpufsrID8e2A4sltSLWGEAaGE48iNCPgCXDx1FBl7MIQ:gnRpS+IQw4S4EiNSZNnwIQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
71d338d5fa88daa6f6cfa8f02c218a369c8f25c40133e934676926e98dc57754.dll windows x86
1edab61d7243cb00c322cbcc68f4f53d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
d3dx9_43
D3DXCreateTextureFromFileInMemory
d3d9
Direct3DCreate9
msvcr90
_initterm
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 433KB - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ