}�A�u���,x$T�'������o:o�'g��GB(����5�>K�>��~M����顗f��vߛ��V��~�͖5���N����ɫ*��b�9k�� �����<wʜc�U���DK�� ������s]�!��ll��S��Tz鿽C� \�x=��j���4��g����}�\��c�� ���i��M��nMm�ZՃ`��D��Q����Օ��o5�<�����)C9 �P�� >��\c������a��@����\ ��Qh��i�~D O�7ՄJ$�ƨ?�h�o��7���=�;W����3 �|A�d����zU-O���6>���������=A��2r��s�>̆+�!���Z�x�����f�^����:�O�-�+�kj7��v��`�X�|���� �ץ}�H��VV�o�E����\ �Q�v���%}�^uz�y�`���B�< �_��$�*��P�8'�f-��Y��oϢ�*��� ��TV+��'5��8&�|oT_��ٯP�y{��ͮ+�A�{"��H���햮���"y�uo����"��G���`L�a4�2ۻm3j��J�N u�0�By"������|�2��'0t`p��WFt���SP�2[ǯ�A0B�3nR�O��NL� �[N���;܆N���� ���ڨj����jP1�}X!Z����ۜU����wB������8;D�v4_��"�� r=py|��(�}]b>oKk�-�����o�[q3K1�^=a�@~9T)����!A�_,<�Ia�%��+��� C������ñ���t=E���Yt^���d̜4��i�0"��Čn� �66����8�M��>�=�&Zc���Fna�w�4 a����C�($U`�'3�*S-�K.l[�O��T㇁2��T�(U��Ԇ��]�s?Y�[�ČJ�W��%����D�?�l�F��H9n�����-�;� �l��<!'(Sز��d���F���5�E���{���=�����8Ɓ}�g�Gy=4*A��'��Ǘn��Y=��1����toW�@���]E��e�/���o�j�Cu����y��������ڬd[���S�R�w��de�,鴏�MTO����1C4h�dˎ�#g�H�b��,V[Ԥs�d��.��6��T�2�@*4�(-�Pqos"g�s���A��{�.�QVA�|A��pumA$K���?���Zw ��pY��)y��Z��r��U9����.0�)�S۠b����h���'N��O��DZj�)�k�O_���nc��UP�xACw�0�:^��qz���0 |��w����gǚ����Cx:�Y"���R���B6̙��6p��~"��X��_���K�L�n�?�O�X&M����b� ��;�A>q Pi���e���,��f<���H �M�*�]|���ae�z����c@%J�����Ԡ6�MSae��.��d�EolWa2�Y&0��* �9��J����������[��~�˰�Cy�f�7|����!�?���.����ؘ��eNJ4�<����v�ȩIv$��6/oW�қL�M ���h��?�H����O�"0��/���b�z�l�b�sCr���,t�ΪJ�3c�?R� 5Y?L3h��~��l$�[��$���f��@9s�6�'�S7+��0��qT����=�� ���Z�b>�/b�y�~=��F������l9\j�L�b�����t�nϺ����� �`��~��5����-iV��Wo��[[*�r9� 2���<р�p������'�����w���8����H�<:��q/>�e��T��ρ���\�ǖRw���x�c�k��+�7(��u��#7�]�-$ >�,f���|׀i�z��}�۶�Y�M S&�#V���(��X�p�}줤���Z��+Δ���)6�0�$ey�-�9sv������X��a�5��uq�����2���dz�X�Fe��� ���}4�aFЯ������éR]%�d����R3[�ʉ5dK�`ʭ�?g�fz4.j�ұ�D�^A��ߠ,p;]I�Ồ�ɏ��h)_ʼ"m����)���?��H�$Y��"^N����\�{m�*���������{CC�&Q���kB8[@s�!�o��;���ʻP�N���p ���=����'��`�J#�c�6�Z�p�=���ağ�<!X �L��$��>���bN!q����T���kʸ����h.Y��l���p����h���m$FE�n`�oݛVR�S8���|�Aޑ�au +Z�^�~Yߧ�A�$��^f��������%�vK�^ms�\�3�N��0!i^�/7݀c��,���V��}|I�>k��&}2�6~j�d#W#!�;��;W��ca NvrP�+����'����T���y�K�hO���tY,��k^ml]�LŐ��m����-ص�Ev����+��ԺЏ|������y�~�H��2� ��������Ɉ��ˉ�tMbG�N��w��^OC7��:��nO�cQ���Z�XM����̼z�*��h��D���#�Jԭ�!3���D*f*��C�*��JD]H������W ��b�� ���%�G��ks8m�pQ�����}�{ fc�4�W����(a�z'`w�����[-_�8F��� �`a�����'��f�k�<<�gut�??�Cx��w�_�i��5a"�����FS� ��h���������Ǹ��M̜/���̡a,Iw�.@u�R���`��:��{ӫ���.����U�A >�x�^�g��\��v4.Y���@WC-����7;^��C�H��~NV�cXW��!�+�X��-��l��F }g҄E��s�ƽ����{!�Պ��)�|�O�Bw��oS,����t���q�7�քd�I���T�3^d>L�߹UXh�3f%lkh)�C��,��p����@9� �+AbhV��u��v�Xݶ����կ��T�N�����)��O�+Z-�!�ׄ��F�d0��WF�)_�VJ�+���f?�K��+���xvŝ�sݴ�rq�ivG���a�{r?���n[�ɿ;±�pu `���Ǭż�R���Ky�L��
Behavioral task
behavioral1
Sample
98c9b5f8d9b61d2c46175524aa1cbc7741cdf519449265ee7c49d94d83274784.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
98c9b5f8d9b61d2c46175524aa1cbc7741cdf519449265ee7c49d94d83274784.dll
Resource
win10v2004-20220812-en
General
-
Target
98c9b5f8d9b61d2c46175524aa1cbc7741cdf519449265ee7c49d94d83274784
-
Size
268KB
-
MD5
9687efa299e2b8e4d8741660856cf748
-
SHA1
2f67f667a2a65922d1b432b4ffe03d5e6acd0297
-
SHA256
98c9b5f8d9b61d2c46175524aa1cbc7741cdf519449265ee7c49d94d83274784
-
SHA512
1448bed7b578ccd9472a20369194c2d18bcae14fe84f59e19afa2402a34a48cbf75d403b1da9e087820be83df90d14a46a35fd06ae89c1cef5cf656aab21aa21
-
SSDEEP
6144:G2j2WlNfrEeIPPm+07Y6cijAk84MokyJKfg+eJe5Pl+jnt2:nK24P++08sAk8d1mpJeZlot
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
98c9b5f8d9b61d2c46175524aa1cbc7741cdf519449265ee7c49d94d83274784.dll windows x86
d1307b53bb4cfea6d740452a9d0d164a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileType
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
Exports
Exports
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 256KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ