Behavioral task
behavioral1
Sample
cb7132210ca5892c0ebf8f707394713f370f7807e995b0bd96ca2817e17e50a6.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb7132210ca5892c0ebf8f707394713f370f7807e995b0bd96ca2817e17e50a6.dll
Resource
win10v2004-20220901-en
General
-
Target
cb7132210ca5892c0ebf8f707394713f370f7807e995b0bd96ca2817e17e50a6
-
Size
290KB
-
MD5
dfeac7ef2647ce947391a58db2cfcfd3
-
SHA1
62584d35a6fbb9e6d3a39f39d3322f6a7f3002a1
-
SHA256
cb7132210ca5892c0ebf8f707394713f370f7807e995b0bd96ca2817e17e50a6
-
SHA512
a740e09ed3ed83574b0996d79a4de13812816fd5e4fa8348efd4a43d90a2c7c5722cb256eb0a4ebe798a190ee6cc4ab84c4c45ec9acc234c73971b9f2d26e913
-
SSDEEP
6144:ZQobvrDsm8H1SfQGBzq/5r8FFaartX3C/XKmRQ10h1Is74uJ8D7rIs53:ZQobrDsmnocq/5gvd3CfKY3IknuDf1
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cb7132210ca5892c0ebf8f707394713f370f7807e995b0bd96ca2817e17e50a6.dll windows x86
41f76c73cd2aeb7d0b770b0389696e4d
Code Sign
64:b3:89:ea:ee:d9:f8:96:48:0f:d5:26:51:7c:93:ccCertificate
IssuerCN=YoloNot Before21/09/2013, 19:09Not After31/12/2039, 23:59SubjectCN=Yolo6e:75:92:c9:cd:54:54:a9:3d:80:a7:cf:e9:c3:95:6c:5e:71:3b:f8Signer
Actual PE Digest6e:75:92:c9:cd:54:54:a9:3d:80:a7:cf:e9:c3:95:6c:5e:71:3b:f8Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Yolo01/12/2022, 14:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcr90
_encoded_null
gdi32
GetCharacterPlacementA
advapi32
RegQueryValueExA
Exports
Exports
9�2t����;����W����@^��d��ȉ�d���ذ[H+F#|�\����xh���R�fL������3$Z�>����|� Y������Ml���P�~��6���Wk!�9���po-�Zɽ�=R�r��� ��\tګ(W����p�|<�K���sȁܞL���6{Z�,�]~*$��K�d��Ǟ���Ꝉ��y9V9�L}��$G�J�h�v�8��������J=�I�������,N:�ٲ��>���:�6'bǤ���w=�,�'\�� ��ұ�Ԟ7I^�]���bO���@�"E�� ;��O%��`�&��T K %E�<L� �����V =S��]�*�,�n���<ěWm��S`�I��nr�N4�j�����f���S z���z�}�:�iJ�}<�$�(���:J}�8��z����ɵj��ʃ�mO�U�>�l1�=�-�?��!x��g��\M���������Ue�E�[��E8xy�8_�\�6um�i.���h�� �(-sH�ð�� �|Qo;� �Vr��kN����$]�����Qr#G�0�F�~*�i � ��� $k�L&�����wWn12[�gk��������G����ʋ���F��hW�A{t!���D~Ӂ���P�K�J�oT�T���.�:\z�TP1�8�2#��w��4�條��)b�Y�����W3u��8��r����ԁ��9���6�N5� �v����d���s�qE��m��<�7U�l��R�����30��t;�j@u�1K�J���ű�_g�� ]�H![w��3ʃ)6��,�.k�,���ƍ#L�~|�T���?�.�F�&��ZG^��l����%Rik�O��ooa�E�D��B��r��X��G�e���M�B;zi�/�����<I:+�����!rx����:�"����2A���־HQ�IQt�`�¹3c�%xd��B�χԺhp6�O*��z�=�0��V:No�E�9\�f��/�+��~{j6��z�V �x?��l����-��sYݣ}ɚ�e��)���.q��d� q���t|�m����mz�l����"�ϥn�����Z3�ȼ0�i7Gb:0�E���y�*�����ADM jQ�!�l��j|�vB�힏B��N�O~�鄄B;D�QZ�8*rRG�Q~g�W" ����^��l{��Q���Ҁ��/q�6�F��IrD��B#!\h-%� "r����}nq��WGӲ�%";e>��)s�&*lL�C�Xr��0>* ��."j��XR���Cp�ۼӃ�?�x���@�����U�[}Pc9j w�c`��~��E�;)�Db6����l*a�H��螡ꃶ��iI����@�����9Ncu�G��V+GW1}t}2�����'MwA#]e��������b v�~�X��r����)|��w�<5�@Z�#d��2��2���$=l��c/z <S#T]�h{�<6ѱ����:5���:"US 8��j.�� ؇t�������x����nr�P�%#�5x�*VFl��rk��T��� [!y�3Dg8�Z�3}8Ïb���'��MP5�$������O�$LRP}��E@�:��]�+ �Dݟ������U[��u ��F����w6q�Y�Cooi���A\�#�]�X�p�9�W��o�Ҹ�H�>���rC# ��� Qj��wcMD$��&l����k/ MoF��s寳����A�!t��O����X�qi!�z(w�$+nЗq䥂���5��mv�!�b� 6��,6�J���-���+��H[�ϸ�tG����T�]ω��7C���@ww�Ò;>aF*�0u���[e`�V�����aGx�F��Rq�l!#&���ԩ�zЧ4��qf��,����g�-��t��)���c��h��R0LYc�<��[:���p����vJG�!��(�9z6tF>�+�_�y�"�B�v� �����I����ɍ���n�� Ե�9��S�����}����w�k�.���x�*�a�#��'=��YD� �r�ͩ��u)��.Q����@9���S^OJ��Y������������i+"��Z�Kuӈ��8��ɗk0Dd ~H��(~dc��q�\��&��ڑJ5�q��,p�B���Cw �x�����֤�_�v��q�z1�`%7�9��\�Hk�����d�{눱x|�G�Ш�q�VA���Ѝ��$�OTs;x���>���4��b* V�����mqh����ݰ�3�|�8�s�*�.u�w֒��)/b%Tǵ\�yJۛ4���䒗܍a��'�]r͠qy�anu���Y�A��|p�������Z�i�T�02~�"r���yc�ڑ�w��&�-�� ��7��g$�+2�I��V%��H�T��|x�G�$���o�:]��\G��Go���e��1(X�����-��*�풮4�S�T�;��y���v[�6L�$���� ��"�+�?�X`���o!�����J(��ʓ��x�έY�{]��2[����J��1��z?�~n>H|.bC �qp�w�M#�DfM���l]b;�.�<�Wo8���ϩ����Z��5\��ӱ��`-6e����vS��6B5J�kε������.���xL���� t*0m�M���ǣ��O"��w�&a�c6�qv��;o�?�I����gݹ��y�E��������Ǵ��JeK�I}�5g�YF��/i/v8��x��^Ùhit<��������y{d��$��ݏ�=R����ؘ�������m��i��7����8��"�G�]�Ǐ��v^���n"��Կ�x���hu��Ч)�����6����qzۜ���ռ-�jڃwT�\f�ð�7�5g����C �$z�Ɖ~�vL-��4h���薬�F��! ��AwoZ�{�$�p&I;�al|ry��`.ڹTy��b����}����@�Hq�`q̬y�u���k(�>�X���zg_��UY���w��m�[����0-Y���,x��ZC����* �e,3����6&�Z�7���?E��(9K��A��|cR:�k� �: �콨UXmi-��iV,
Sections
.text Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 286KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ