܈0��S���� �/;Z���-���0��D�4"B�1�]C#�}z��̜?#7 ��W�7Ā�n J�T{ap����������0�'~�w@h��Z$b��᪗O�n�3ԃs�}6���Y&���~�(c�о�#Ɩ+`��B��,��{Ga��L���:u�� �>�0W!���ޙp_�*�i�qE�\ M��p�����Ky��?��_ŀ�ۦ����Q���������#�\F��?�ڜ^��� ������f�~�B���o�t�����BK>�A�ϖ=]ΰ�[�8���/C����a�K�o ��W�r�*FkUBC1��l=X��.4���8��ԇ��iO\(���ڿ����/^3%�a, �N<�P��ۖ�`V�b�'���Qڅ��IU%�TpkwX:�.�������鶤ƒ�h.�OGܽ�����mb�@��k���JM��x��E=p<�oJ� ���3q#���(����10����Z���u)�{ޓL��_1�[%;bY���6���)X����D��fR�A��u��h�N(=o��?HH��k��5����v�w��\!H��(�loĩ�\�����~MG^%R���qU`V�s����i��12��a��.�$��Po��f�XTV��ku��M ���LOR7�!V�ă��b�U�Zkh>H,P����ǦeAP��AF*"9�ß�����ۑ�4/F-�crF�`Z��1J���0���M���E��V��0��}~{*��\���}�d� ��#j��p���F"n$^����x��B��Q �FDDg/ T����{��$8��B��֡vK/β��8]��{�D�.����<�s���]�FW9���(�Bh��H�j(�W'_�!�W���vqe��bY]K���w9��O��:��I��1��5����q�! �M��(hW�d���k�D�9`��瑜rb?Z�"AR���B�z��-�ޒ�/F�S�h���l� �z[�� X2I��\��L�4�P���C�#�� ��ۅ�z'�o��E�����Mz$*"��d|�����:�נpv�}�a.�O�Ie�з�6�5H��2r��(-m@{�8"A�?o��Q����U�S �������qE}��=1��t_M�����|�u�%���1�1K�(H#��+��Kl�hSf���E�i�C��l;��[���X �ĸ+�q������q��iP�tS��<�j@��u�'W�(}�rC-=!�^0W9��� J�nD����$���̭�⼻�L����=���M�� >Σ%�� ��aJ;wSq˰^.Rz�����v~����5 ��KMG�4��qX ���C�a��P�4�V𮂀I1 �g1S�)��Hd�1F/d4K'NE�$��`G\Ú&q#����06�{X� d�J^�zP>H��9���QI�$�qG��;��kq�{]b6f�7���l�ܱn°R��ڰ2�hso�k�؟ ��b5�-��;ɕqHJ#b��A��բ�@r�#+2⏖�C�������U��1�J=?���`�[D��]�oVj�(`W�Ώ�~U� �� ql��x��g�������1�+Bл�����z�[��8glL�Pj�<�9)�\��ʵ "�G�)@з1�'��9+��U4c�2"��Nу�'��3gk�a��Ӕ��\hp��x>�y�E����[��diܶ\�b��>��3xvj�zy��h�8�>KH�#hv����}s�,���_N#/Ko����9��w[t��b -S��6����������ǝ���t7�l���˯D���Us,ddEfl�1�����-��_�fO�m��o�2����5�f����ˉ�)䣻sB��JGo�j�s(b�r@�'��ϣ��+��� Gc� T�1Y�'�*9��%=Ò�Z~W�|�� ������/j�����bRE�̣j��<[�R/����w Q����n�&�xQe���ҹ��M�R�։�ɼ�k`�]���L��n-�M(�NС#���՛-a�����P�}p*������: �(`�L?�ds�k�z8lo���)�8Z���]xY���čs�*�?�d��#k�L9�H�yν��2���'Ju,��Gb �6A�aI�ߵPz06/�$5�����a+UoU*�k���ҧY�A��� 3�[��D���N�U�æ��9�E�̼$o����!�<A��Nlw���P��{�C�7YO[�ѡ�,����3I�ũ��#�⌡8�ӟ�t�B���7��;�H�5�a���:�g�;b�C|��[Yw�����pQ"�9 ܦA����"��m�R?�5���D��b������%DWB��zp�U���Kd{g'g�#��;�X^5�;��L���+^���(cez����� �Ѫ��H��TǺ�� B?ò���uA!l�G����D��oY-�7�pD��GE^�ӊ2�{�:�g�=Q/�ja���r���(f0����s�G���Cn�^x����0�ls(T�����P?D��.���:bI��ż-dorA��)�X��af2t�g��@�P�^Kv��Z�(5�bw� H�1�����w|��x�lV�5/am�cj�6Un�P��l�������,~8ѝ�I���;�BɗOy��?4+��b"Aw�hI!2PH��#�ޓ��� 9�#���ҍ3� ��#~�O��:A1�س ۋ��I�#�]*0��W5~��j��ߴ��*Zz�d���`��E)����-W��+t~�=�de�t ����G��9V�(��':��.�Z����B0�o�s��3l��x��&���²'�n\������W\@R\���bW�%�1�a��Q����i|�7Q���{2N%гC�z��o�<i�I;�L�.�����nύ�Ͷ�qgp�拨6��.n�i-j�=���)@Ib�`��^Q����8�0�(ӓ�4́�+Hi�n�@��;������EC[�?�����t�ʊq�������SV�ޘ�g��d!3"��M�ٙ9`��q$.K�c��,:�ɲw,UX��r�ʎ/�Հ�b}$�;����T�
Behavioral task
behavioral1
Sample
953826981d3bbacdd39db76484738a0219fc500b36a9b652c777f96b29715f03.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
953826981d3bbacdd39db76484738a0219fc500b36a9b652c777f96b29715f03.dll
Resource
win10v2004-20221111-en
General
-
Target
953826981d3bbacdd39db76484738a0219fc500b36a9b652c777f96b29715f03
-
Size
656KB
-
MD5
955ab46647e515cb354001f5eae8d58a
-
SHA1
7b410062aeabb8e278d47cdfb575cb18bc50c8dd
-
SHA256
953826981d3bbacdd39db76484738a0219fc500b36a9b652c777f96b29715f03
-
SHA512
21a20a4c32b0c9c6f13494f802c5b46c96e7191d0a8baf492589babf7f7d9ca4aa41f0ff608f56880c62fff2c77e4abddf963247390fc520fceb31e4e7e008f2
-
SSDEEP
12288:3FZEF3QqKD86wndcps2nwdVXoQxvKpsj7B+2nLbEb2DBtI6qN8wusLFNqSOIgXl0:P+3QqKE2nwlxv8sjFD8ecZN8w3FB1gXH
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
953826981d3bbacdd39db76484738a0219fc500b36a9b652c777f96b29715f03.dll windows x86
ba32b1eb053c13fc5588a629faca01f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
Exports
Exports
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 644KB - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ