'�(��v5����Կ�S�"�֒���rS��{[τ����30���+o�-/��{�����k��M��U�H���!��5O�t�J��9�I���ڕ������+����}(��}���4����h|�pA5gl�a��ƍ��Blf��|�$jJ*s�u�������RU�v�����R� ��1%�� s T:�Uuu�������IM/�dAHW��� Ģ�*��'Py�xkm���o�y#��|^��]C��5��^I�ҌL��z��*+_�e���(��ں�x:Ћ�l�{�F#Ꮖ�o>��Y)5��,@O�TЬr���~&���k ��3�s��c�'C~w�ce�l�t �W��Z�-٥���ͱ��Y� ӐOA@�A8sM� ?��g����k\�F� ��@�3�=���Xy��i�-�M!4+�=�H���IWÜ`΅�/~����h]�܌L��a�'�tk�eQ5n� )ԃ���w�?1T�����S���}T��V��Y�7:Ec��A,G:�(��/���"�ҋ�y{�ƌ\�ՠ���@��RS�qX�F�_��;x���;(,]�q �%Ц�! �!A�u�Մ�j���������to V�7�+��� 0L垔�H"K�C�F=�CVX�����J�ykI�aKה/zf�gi��P��E�mK��ʋ��}-b��E�3;Ǘ%)ܹ��`�o�8�dJ�<��4��������_o�#�x?�wI�Uƍ%�L ��� �K����TĮ���3P��;-����Ӝ��{� ���#^K�@6�T{J��>�|V�Q���+�j�9ٺVS��k�Q"��y@�Q��aÀ#w��~���4�y��n�L:��;rn ?�4�?���_�h���b������9�f�֪8@��)�ɫ�'�kC� чz����f+N�'�l��4zWč��@��F�2o�ZRQ�w����3.�^rO�Y��v�r�nQ�p�gt�Y~���5ܮ����M&t�vv1cq�:QP�/%c`���M��VX ��K}�����{)Y_������v�:?�o�@LJ��}��ܩ�� >:�q�����Yl|1���IF&�C~j-N�Lp���x�WN����1(�ʮ�bח�X��Q�����Cl�͆c2d��D���};�kt^�yՇ�pT��� 9��؈�8*.2; M %�`�Xq���S4[��qv⠘�/,(���i�TF1�w�c��˛'�L�{M�����Z�-��/�6G�?.e��ϯgQ������p!y<JAװ��eya:��-=d�w�+�LDb~f:_0��8&��PWHE.��ոdt�0x���`�`]�2�Ңo��k���%�Zݶ�5���1��o �KN��>�jO���Ct� ����L��f�U�^*}��m ��t���̷5z�+P�26|�'���OHO��� )���k�)���`��3�8|��I��gh8xW��W��w��3�wO�흰g�Ïƶ�#e(n�(7:e�yVH�<MZV�Tߪ&[�� �jaW3���w53tą��{��6j�In�HX�B�ś���1���1�l:/ �).<���<#H�M����Ev���������; �kě��Z�X˷��2��W�����c:,���0��@��iaM(S!������;QT�.�ѱ�#�"\�K�ky�t���8&3����[����v�����q}� ���t�}�Q���c��aG� Xz��|�����<�Qw<���9J�>Q���a�p�j���i�[D$���5�)��Ă�6�L���8s�F�^����8%p2s��3$��i��H�����Ť����d4#S"F�$�E���5s쒨cc%;�ÇD�9 ��oq@D~�.��a�9���ےr�}�S��n!���#��5�}�D��`��A���L�= �+�������ŸG���rU��҈f��>��BXw�;����Ҿ�ns��"ф�� ~���t��$�\���\Hн( ]�O�˘3���S`���q�߇b>YH���%��8�2��wf��;��@�����bTN��4��yO�w��� !&!u��*�$��^S9�FvV�����aH�mѕ��V=�g�׆!��)�T1!��?�Ǜ�K��C\_�������Q���_!�cs���[��=��Ye��1�f��g�^d֫�)�6ќ�R�A�?J�u����������F�8u����������������P~0{i̓�VXr�����R0� "q�9��5J��q�����J-�ɤC��z�J�bFc P���B�� f�Z�{1���� G��S@��YzN���R ���$hX�r (]0uM�#g;a�o��g �{����3|c�Z�Nj� ʝI�Dž���] w�y�K�{^G/��o/����-��S����IƎ��@�+-�δ{�x�ZP�`lM�U� �~�s8�ǣ�|�%f%�� Y��.��2`,Ja�r@��G*�����<��2w\:Ȍp�i�uvcD��l1^����)Fʣl�$<���%?�����$� Dn>�Ϙ���U��VH ��Y0��R�s,�V!/�#6��k;��$�+��b��*XC-�a���z'��3�L>�;So���Q;����=��M�/���+���i��Ά�<'�uq�9�����J=�s�r�!����φV"J���J�6~^~��V�"�-��"�.K�� C&ـ ��ru'�a�$oy���GKG��|Vr͓ +A�^^��� iv�m�β�������C���*8����C_�� �ʸX�.�"��f&��9gqj <�j|��@��.� �ls�\��N�2��N_]�'�B,j�?ӇyD�¿��~���������n5"��̄H�(�8��M}���S%v][���f ����֢5�n�����74�!c�Q1�����YE�/}s�@��Q�?��������`)��z����9�<Ub�D&��#b���X$��YA�D�O9EuDSh�s˃�����4��SXVrh'� L�3��a�&ճ��^0`���Y�&�|��>�*���I-�;G����K���
Behavioral task
behavioral1
Sample
bcdc9898d607a40b6c59ccb3d6dd8ce5d095e56e86e9bc3f996f1b57e1e5a3c3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bcdc9898d607a40b6c59ccb3d6dd8ce5d095e56e86e9bc3f996f1b57e1e5a3c3.dll
Resource
win10v2004-20220812-en
General
-
Target
bcdc9898d607a40b6c59ccb3d6dd8ce5d095e56e86e9bc3f996f1b57e1e5a3c3
-
Size
584KB
-
MD5
b14b50dfc20d02674007241b8e8d5b52
-
SHA1
6c2292482bfae64af099eaba236375a7c8a6cd22
-
SHA256
bcdc9898d607a40b6c59ccb3d6dd8ce5d095e56e86e9bc3f996f1b57e1e5a3c3
-
SHA512
b93758bfa71a12e2958bb5044a89129c1ba35d458191d5d594165247432661b857a75cf7590c6934d5b16747360af58e9b41d6093b78b48cbd2b3ef402055f10
-
SSDEEP
12288:Xsd4xPRJSZ7RJ6f/ea3eDmcfHLRhJgDgMacsjE50BCHzuilPc+4ncFsLIwlEfOdW:zxpJMRJ6neqO5QgJcsY508HzuiL4c2Ly
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bcdc9898d607a40b6c59ccb3d6dd8ce5d095e56e86e9bc3f996f1b57e1e5a3c3.dll windows x86
aa3d770b62968e62b0b0732962502a42
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 466KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 572KB - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ