�_�����r*�I���L���z�l�͞����/և�3��(��<� |I�kMB=��\pJ�����(�� ���abA�!l��R�C��K��B����@�2�T����X~�<D}�Af�0?�����[9s�5y!�sdaƿ�@�HX��^��%�^����My/�}cT�+��Û�v����|D�'�ݨvl�)�f*ā�υ��6lq��w��"A��߳ߨ^�B��ذ�ڎ̵���B���E�~���˴u��(NA�Qi��|z����YPl@W��ѷ����&Nl������H�%�{Iݡxc̣:��yu�)!f�eMzTQN-��Dx����)jt�B�.�pp�.ټ,�::l�5���ֈ����B���:7+4g(�x��L�D���~@�ӘE�`��4��(�����w8aŤ�D�k��^����? z����c��1��<��3`V���&no�/.%��3��Q�I�tG��ܟT C>��nz�($�~�q���j�����.8R����6C���l�*���E��RN�9}�w+��y��;��D�l�^&N�Rv����疿��T�}�t��X��3Z��������i� �&�P������a��]x�Ix�f�e巓Q��9�#��#��{�٤��k�����V�ǟd�gꯟL�j��*���.Z�# ��Y8d���C r5R6��̚�ӀN:�04�_���),���yё�G{��Al�"�c7)x�vS���U�O�&L9z^�=n)�Q��"��t" z�ː���}^���0464j2#��Iv��� �]l �K��]G3��`���Yr��Rǵ��R�MG��2�L��xch E�T��jU�:<+�U�I|2�e�K�k�,�s�h5H(]ΛY_v��zw3�=) �<�}�oe;�z�p���E�k��Ò�~��շ��L��6�"E,�(�2�,����X�ߒ�V�M�}����s����z[Y:@�{}��0���Տ��7bd���m�цD�*�r��r��2$� ���*�����������%�8Y!�7e \p�Z)D��*;������e�E�C����nv�� ��đ���UG�-���_M��Kn����>�����6��Խ������)��O�e���u[��2�pA�S����l�R��vURq����`�����E��*���v�'�ؠ�EHK�j�_-%�M��6�ו�_rj�����An���w��Agd.l��!�j���8�I��V�xomx� ���ۙ�IE%�����~��MU���gl|t5|H��>��a���_�����ύm���g(��Iq%D�6݄ǡ���O�I�7j��/�?mf�h<��xp���b���ym��刟��C�Z������^o�z.��Tw=����@�}�w���?��g���Qᨚ ~��M�K���b���^�����,�֙(C`�2W���;8:7��q��o�wv�P�h`� /V*��(� ,��N�ba2;n�j��A�A_�R�GjSl���(]�o3M�ά#��N�z�iAܽp�� _>�-X�D�!H����dY���zqU�yv�E��l ����]���;�z9i���]��R^ ��h��@^����d���>�)����,i�|��N��2�ĭ���X�HP�~��̵���b�@���6 �hr9��@�t�:�W8|s/?���d ���K����ozծo��}]z���0��/��?���WVT-�5n%�xּ,�D�؍X��<�Əd��S�#и_pĘ�$���<�$nA�<�����niJ�2y}(��n*7�%u\�}Z�}�Uڤ.hc��(z����T�ůc�D �>ͱ�A5����� �#6:��g�9�}*����qc��!���+rX�T5' ��# ����� �)�K�E� ρ�"�ʓ�k��>p\��R����i�������cS���_p��x�E�O�=y-9P�G���`��h��Zs��0���Ȧ���I��i輟Ck*��d���q�.��$�g�F��,�`Dt\'7-H�M��+��Ҧ䘣�v�8m���P)� ��I)�Q��ab_+R%�t��y��i�{f�'�Gh� ���<�����;�c����]В!�����@���(�*��-8T�u��gUq��J~�f�k�?@�xcQ0>�(��I��n�18 mZclh?t=#!ϗ,-�M��-��7hHFSzp&����cmU;��D�u���L0��A����T���ˮ�ɥi]�i}Yy����b�2V�C܋֊�˙���y�xЁU5"yc9,Y��eIx�vzB}�R3!�iZ/n�ƬR".��fBP��(7��×�P ��=�.^����E��� R�����5_�}�J�]��bE�m���:��<��W�Z�W�>Ե����!_7����~�`�Հ����J�+���Z��L��dYc�y��%��>� �����Kk�l����&|_L�~�%e˅� z3h�8�ʼ��d�;��g����L.���l�z�����}1�Cl\݉5��"S|�]ax�[�.�rGqo#��H�����4V��L�*A~Ͼ��~�,e=�4�S�r? !�|Ǟ6FY��}�8@ ������\`�,�$��r_�I!�M�7�&z�#s��J� <|Vҿ��䱧��z�b���UAo6�'|0�;��\E�^C��H��ִ �A�n��Q6h�m��2� �2�3s� S0l2�CMXr�l�]����z�';Y�s��I �k%k�}H��_r���A�l�`��;�,�k�C��=a�h���g��%�{IF����p�x���m(��Xu"uyms����z9#�pGJu�v��y�.��3�w��#�aƾ[��{T�r>�>��Lb���`b���/Z_�aE�/�;��Zr'��Y�Y�+�+Ļ"��1D���c�^��sMa� *�U0�oY1���hF��� z� l�q����Z�m�I��m�͉.�5ȧ�Ï���,��ϲd�#�"�b�m=�z��y�����-C�^���{D� ��_Ұ}����c�p9
Behavioral task
behavioral1
Sample
858b1e614de9ec7aecd7587aca30ee5e60a656cf557bb07c1f24c66012c83350.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
858b1e614de9ec7aecd7587aca30ee5e60a656cf557bb07c1f24c66012c83350.dll
Resource
win10v2004-20220812-en
General
-
Target
858b1e614de9ec7aecd7587aca30ee5e60a656cf557bb07c1f24c66012c83350
-
Size
84KB
-
MD5
d46a23f45697208dda286f812a48db45
-
SHA1
6cb16d0a2da3bc9a616350cb12e2b53b2b71caed
-
SHA256
858b1e614de9ec7aecd7587aca30ee5e60a656cf557bb07c1f24c66012c83350
-
SHA512
b3fb3e65546320521dd84eaa66956266de35cbb893ce7801e718628f1457e205785e733efcb0e2a8897d61a47c3f3962146316763574739fe53b7d0f53a362f2
-
SSDEEP
1536:6LEmlKcI+PPSei2/Ow81arH8BBSRysAGhLb1NyUL:6wgKcZSPR9iRysAwLBNt
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
858b1e614de9ec7aecd7587aca30ee5e60a656cf557bb07c1f24c66012c83350.dll windows x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ