�2ns+&�WwY�jߝ��pЌ�qQ,�Plj��1��2+jM�9h�7siS��r\xi'��W �~ $����w�e����ԝu��Dz�8�,�E����|56�ȷ����A�pn�'!����E��U�U]�&���Gӧ�5�Ӌ���Kz��8}�T�֒�\6�]���Z( �73��l�;8��j�i�㻤�P�`KK;3��w�lۈ����d"&�����QX/�_�fH�¿�����v�_/MΦ�Y3*|\]t��>��1� ����l���rr��6܁sl>b��u�K����칽����aO �R����nD�F-��w�~�V�J3���Q����9���;+�!yO������i�H�od}�e��΅H fC[�Z�5,��+t6���o�̐%駚�7w�(g�� Bi�.�3.A�M����Ye�|�� � D �� ��-�[���sUF�x<d=g̃�Հ�iSWf2S�mߴ�z�;zz��ԗu]�= <y�}��Ŧ̷�������ÖL�����M���/��KX��NM��gsy���4~���n��j����Sb�U�����ᘅ��{D^���E����cJ:��CX��n⨰6�Wp�vro�?�_aNM[M���S���dW��@���t��GN�m�&b"��a��p4#�G3��Ϯ���'��n� Y���\�%�g�;����ݗ\F��ϒ*Fۭ�!���Z�<��Q@�Ā�?�Ub��7�{��T��eKg�2�=������Ӊ-�Ɛ�tȃc4cUs̿��T�q�G�-���ݥ/�V�v ����wB�]Ew5,�΄��c����AK��65z��{��iL>���!�2�xQ�9"r�(f�R}�%�V1���ȆyȾ Zd�^q�U�ϡ�Tt���@�%AQ�l_����Yc~��=i�̝lkXۉ�7/˩,\x.�җ���O�?�b��zY�Ҿ��Ⱦ ���om�)��)�Q2��%=�q���ã��ICs�_��C|��C9��){�?�Ŷdf�Y�"��o��hR#~��G��4�+����E%�M�sl�����o��n�c�I�3�b������ !�_;�al�Λc�Bv69�7�\w%v����R�(l0� 1��]�i�U;�⢊G����>�����y��#U)/�v��Q�|F���{Mݯ)�\3DzF���zqO����h�K�9��l>�av�:���g��H��3peoX�ڿ?�Wm[6���B���a�1�Ҍ�c&�� <}��WTv�&+[4�Xh�ךU�&�>$�dcv��fl,������������9��77���u[OB��'�����>��:��3I%I��Cڜ�C��h���:��1Woz�Z����� ����WVV9�\�JƤAHe�G� ��Aao�㗉6�m��vb�\`a�,@/!]�h6��3���d@'��?\`$��Ҟ�x�0e=ۅzJ�� 0/iե�ߵe��')��rzíԲܖ���܉}f��ִ�>�Is�v�T��㯠|��}�f����ߍ�Iuy.=��{!4��m$:akߕ6��sO�ֹO�J3'y�B���.��Rq7l�P��0A/kJ�qْi��|��v���uS�uv�V��S��q���`)�y�櫛tN��\�����Q�R8�Ɋ@i�4B�(���t �6�x��B�y�������xsI^�!\nT�S��.���^j5�õ���V� X3z��pcP9A��MRZ����!݀x�VTb�4F}��ZW3mS��ѐkП�@�u��{���ն1V��+j>�*����������ԙ��6�L��G^܀�*t<��������q|ֻ\F�p<�f��H;Q����zƶ�p�]{����Yub/!vr��?���QL��(E�bP(yn|����7�L��dem��1�a�����_W �>�]PCR/��U��f�=Rb�<-��V�X�K�+ ��Ko>��f̕ة��!.}��U Q� ���PL�X�T�qɑ�9#���b�a�k���6>�O�\���h �k�:j�� �䕓����J����PP����m��FUG�69���'_����jƩ���1.�O����|�x������q}�@����6%hWn�e�����^�X��s��,&bNj�6ݗ�S�>�V�A/|���746�5�CN�}�X@O��qzC�O��<�D�����z�ܪ�����ݻfp�Շ]�si2+��X鯲|5"@a�>�%���4����2X��2�Zmw�]���Lf�}c�V+>�̀lbYFpTP$A{��̮.�=�����ЧU/f�ɰ�nprf�;�彆�x���?�����=�Z6�<�YLp b�=�K3�<��pE�1�$;}6��k[��c��`������v��߭��6���O��������,y,��MB!���E1��ެZnt� �o���.��C\#YX9�J����q�WL��$-��L��},�s���y�����j8�pF�u�`����6xS�thF����[�B�t��hx|0$�%�/d3��:LpR����2���%�H0Fsx$����1qD�<m�lȣ �_N}�M8 ���;��u�E�Ⳉ��@/ ��6b���'�iW����X����;�5�1�?������.�;���;yHt�J>}�U{<#/R�FG݄�V9$\�UΆ�Q!2d���⨫8�6:��_���f9��77_��Os�N{�q�|>���0ߗ�����������+$]��? ���O,��U+A9��mAz�zP�u]�hY����n�0�8���[�2��O�A�_�b<]G�T� X�V9��pa��:��z��Ć�Ǣѭ�s/ڷd�a�^o��z��So�g��܋+�V6m�#�l����Hs鴶����e?n$5.a���W$�L������a_o�(�/N�<JQ R�ƨ�'>ɦS�n�Ԩ=����n����L �����תD}�^X;�=�F����� D��e8e����<K���y�r�x��ļ~��B�/�<&�%�����-�!�z�ԗ�����*:�s���~������N���7A�"�wV
Behavioral task
behavioral1
Sample
c1ec8204c74c7d673e45d529fd1db94cdcf0be47f4fb67f2c6f748d1ca6ec63d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1ec8204c74c7d673e45d529fd1db94cdcf0be47f4fb67f2c6f748d1ca6ec63d.dll
Resource
win10v2004-20220812-en
General
-
Target
c1ec8204c74c7d673e45d529fd1db94cdcf0be47f4fb67f2c6f748d1ca6ec63d
-
Size
512KB
-
MD5
93ecbd3db4a98aca0bf1c3ef7a30fb1f
-
SHA1
bc2c917d797eaea31be5de5b5ce6d6edcfa5d7af
-
SHA256
c1ec8204c74c7d673e45d529fd1db94cdcf0be47f4fb67f2c6f748d1ca6ec63d
-
SHA512
3129931301e4daf83b98dec33d825bbcbbd50b672406b8067ce53ec8d54da2ac54cf629c6c162a2c72d6d457acc0f1d1cdd18f0294d61841f1166bf42c68bfc7
-
SSDEEP
12288:DsNPoL9IZbjyhibtGJcjZode0zOjl7mdpgaB6yfxpu1ciI2kMAl:QaL9IZb+hihZ66l7mdp7B6yfju1ci4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c1ec8204c74c7d673e45d529fd1db94cdcf0be47f4fb67f2c6f748d1ca6ec63d.dll windows x86
f30df2f54fe8ccb5312c4a7052d313b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
malloc
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 500KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ