%_�<VC8CS��z� ���[�����QT,����/jv�P����U�9}R��I������"�g��������r\�ݰ�����UH��Q��z�h��nHXFһl�۬����yա�>��u��]e���w���.�w@��i�[��5�^I����˹�n�fpA"����ͽ�rNѩ��M�ʲ�n��\��|'�5�sFm���1o��=>�Rg��s����wOT�p�Ns�!�Y5��v;�5J�Һ����=�0��wO�h�����y$k]��������J��=�؊s����q�Wx������Խ�7,���O��IR�Ȍ�����v�骡^�m�� �Wb�|5�<�c���b�}��{y�I�Vw���g�W�e6a&�퓗�Rao�i�;1^;��'�^����7־Rܴ�)o�Zu� �tR�O��N��oN�Ώ��_���I��]��_�,�eb�U�b��4��vǸ��9t����e�/�F��������S�)���|`��H���C��� &+Qy.ʿ��4Wm�`�5��������Ny��B=�XE����_ P��c��D�̊H`��q����d��������jj!ẫE�D1��kW}fX,��:�����"��=ꅙzk��PՈpZ��^]�Yϥ煮l��Dab��|�LHn1k���N����;�<��Kйe��j`����,�"Ik#X�g��k���)���8t�f���e:Ddү�or9���"����+���ڀ�7u��G�c�DX�?s4w!�2��H��)�#5T�p�RT+�w��vf3�fP/��I�z�? ����H��=LE��v�����j �s<���'�OYQ@�@Z0��tΑ[ŐU y�CD�tnزP����n���[RO�up��f6'��m"��Ey��{:dF�U#���Ñh�SX��5�p�ڪ���XmHѠ��)���CJ��9�����2�f%����)���EB�3Dj�<�Ӫ��[�U�+�G���#�ʏR7����z$p�4�^uMW�� '�h�vH�t[�0����%Q��ϛ�S�j�Y˧�<7<6��P��~�����D�zph��_�P��wv[+���)%Zr#7��\��ac{�\��uB0e�0�-�"�4�;���� �}Z�:�.���u��6�f63}6o垣�j]�o�V�OH�*ָTm�^�2s<���F����E�}|�d�]K�mפ�2��k�iRG�"%K$�.�췅���;����Vɡ�Qg�P$"��)R���X@L�$��@�ֵ�O"�V>�f���X�@dD����a����ޏ�j�����C4[�q]RXB^��U�Y���P~���Y�UU�������ڡ s�u��#:��s$�m �������������;���s͏�).kv�h��~p�õ y����U�~���]���<%���e�*eR�ں�U�\H�L���>�$N����69��p����� vL�4�w��M�tH�����d�v�6��doz��Ub���Q�JI�Ԧ��K[U40!W.�Nיg#���PF��������Z���u�ecҁ�^2�2���5@���tN��/})�vH�q������s���u*�p_�ku��N q37B<!�~ˮ��Ÿ�6H�����6�y���E=oY��i��O�d�����Ur(h����|��,o�E�9K�I-�:`�E�"�K����l�����e"bD+���E�����yp��N�w�ު�)��=�Dw�l��D�����B]w2�(ЎZ*�_ *+��*�9�t��H�˱%��s�8�@T� Ğ*�;�tJ�h��&�I �%c�<b[���p1xL"GE<�:ǁ.�;�V������v�X�H��;j��J�;B�4V��ǘ�8������JCUޯO�ll��)����S�z̀���- ij}.��։� ��I�� ����s�N���D8����b�E_aߜkmԗɏ���-*[g���Sb9�Ǥ<�n�\�����֮ !o�K�s���O�X(�.z�g�f85ͣl��9�w��z곀����6�ʞ]�����k���dl�����B"&�7�߆�_�qo�X��@B�H��+�Gw�&J�~�|��5���&�g ��.����c=�Y�^}�#�͒���D[H@�s�?�'�KPV���ْt��+����O�P!��i����_��6�=���$�$�<T�T�O�#;�L 唎:{x�%��٫�I�葠��ߖ:�KP���<�h����.C+Ņ��6�J���#���Z�_�p; ���� �����ƚ}�X�yK��M�F�+F��z�Y���KQ��l�?�( ���5�������*��f$�Ƒ9��rI?Pr�I���K���ɂgs�gߐL�-�cpW����Fg;�րXc`*�Z�J�� J�{���(W���-�6;��T��ʓ�L���B�|^J�٩ _��]��>A2h�IǠ&��i����a����%.c_qu���I��!7Rh�<(�G����l��u�-��G�8���/�q�m�%�E�X�����w݃�ʧ�<i�@'�;��*Q��1�Sy��.�fO�z�=�?jX�y���)�֞�Wc�O��و�8��F�{�$n�D�s�����!��f6�Y0z�-q���С������)o��eg�H����`>�9�K�C����!�>����x�^:�2b��sD%��I[5 ��Hv���K��d��!�m� [�O S `�~l�W��>1��B�mY��oL��u��hu4�݇Lh��L������kb��`��KzvJѢX���{�/iP�Z��%A�rߥ�|�ų��7s �H8yO�"���Bn�*ׅ����1�Uf��{F'tW���sut���P���3�9�1���ZY�>��j�m��&H��_&A���i��5W��`��)�K�٨�QT�۾v ��]x�ƶ�N�~�+�~�9'�D��� ENK�sZ[�®�����V�� e��Q����R/�<�|5+6��J���3*2�) �,x��RF���{)�X#Ci�����!��Omj�
Behavioral task
behavioral1
Sample
d07caf00cd6186655b2cae25d3f706beb9cac5672aede0c5e63c17b56ae05892.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d07caf00cd6186655b2cae25d3f706beb9cac5672aede0c5e63c17b56ae05892.dll
Resource
win10v2004-20220812-en
General
-
Target
d07caf00cd6186655b2cae25d3f706beb9cac5672aede0c5e63c17b56ae05892
-
Size
84KB
-
MD5
9be664d7a26fcee4d1fbcdbfa7730b1f
-
SHA1
ebb380fda561c5e494613fba16a8599061d92bba
-
SHA256
d07caf00cd6186655b2cae25d3f706beb9cac5672aede0c5e63c17b56ae05892
-
SHA512
606d90b8c246297597e52aca2335d226773b3b1595c3b461ebfbd96fff0c4fd3601da5dfaa48bb8d0115a697eb1c84e9ab96974c9fb78913844e82ca5a3a3819
-
SSDEEP
1536:f0UU3i1sR4U/pdWgJBfbtXpB3GJjlJVkupRRatsxlw:8UU334gbHXbtZBAPVkmRRatsxl
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d07caf00cd6186655b2cae25d3f706beb9cac5672aede0c5e63c17b56ae05892.dll windows x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ