�!m��2���C�6Js��=���*�c�[��,U�>�5�<�(��w$cD` 3h����AE� l�k�Yp��9Y"��)jo���1�#NͲb�I0�GM�_�~���g�t�P\ey:�4���,jP�v�B��]/3�@�k�ٴ&,}�ܴ����H���A�l*^U.]����(���l���i딟�G���Y�#%w�/h�n]'Y��9�rp"�Z�� l�U�qh(3���cbNm��V����)�.���� ���n�cX���F X���i]�p��ز��&��M`%|Q� �EsX�1�d�<�|V���g_�xy����Z���{Po�~�X������ð|���L��{��z��:rC�L� a�.�O��^�ñ|���^ە̂��P��������2Z��>��X����Ga��4�q�O4l�X֓�(��衿UFЂ^��������w���f�(S��x�v5칫O��ao��7Mv(�5�n\�����������(;��D��PuM���%�i�_i4� Ρ(�]B*]o�u�� ���r�!�9����)|�_�z�h�.���1g�ѝ�/���bG�����93Ȟ����B�����C���_�Y��9y�j�2[�}+>� E��7w�/�������4�� ��B1����;���e��4�<�۳V1^\�ľa4-vl�d~{'��`�?6F��N�_scd���L���5!p����>���Gv�1(��3m��@Os���@1��Wf�B�h�b�}��o��ƿ2o����'���陿��D>�fӲ�<������N����{Tώ @.{�g�tKp��^��EK���ͬm�A���V�Y�������h: �BA�,Q;telP��7�&�$1�c����:��;�7^����\o�0�.ݗ�9�M� Dط���eI�gK5�4��LChˢ2���t�952/!�����N�i")����E� ����%��3�Z_�U�b��4��绀�#��ѝ�g�ŏ��Ͷ,H�#ۉM�u�E��d;&-������j���L�ū��AO0����=#�c�t���%��c��kWpA9 \����o� ��҂�E+X��k�zJ���[�9{�҇�{�1�>/�2KL]�%�B��-W�N���:W� t��Fy�����d��ք��]'4�g[�(�"�;EW�7w�)~��S4���g¶�ٙ��\���3:�:\.ua���ٷ����%���&.�W�k�Q�/�1,Tr�)_���E��Cٳk 1���E��(U_��O�$2�i��k��V�{�p`- z�'��Ҝ�I�ȲvǙ���(���ę�X���3H�e�c2���������(݈*��YP�Yޙ���#�3ه� z����'�� waqޕ����_���F�{F�6�m����Q�։1�z;�K9VO�i�!b���I�蹝�vӋs�Y��7��|���=�.�19gY|�g�B�� b4���-�����7�W����֘V]!-ʚQ�~[�B�}��XJ�u���g�mSv\Ҵ�,�����2���ɏ��/g8�ϕ������51:#����o��J'.���P$��Q�����`�!��&��Y�c �E�|�7�x��,Sl ������/{C,�7��6&]����$z��{�?�6<��r��a�璎 sBgS�h���W�l�M�MzL���%MН>�HG��ȓ�і���<씌�����Ccz?&��kD�I������E�}�Ρ�D��D"��txS6��4gY��@�(;2¬�$�CEQ�[(p�r��|.22��g�H�ډ+�9d�!��N�Io��KXjVavBY������z��ϑ+L)��b� )a���jF�yK%�d�BL�y<a��_ )��.jԓL���e�˾�ҡO����d��$��)~�e}�&گx-1�g�c=����)���1����� ܀�4�\�8�r7��{��;�P�����$J����^C?��� r��*�uI>|�Q�>̺����b�oA�:�^�|����<�6z"0���}ߵ��PՃ��g���@�F�t�Ovo�q����lj[Γ��=��rɬ��� @�z��'&B'�).gc���-@�P����FB"?������tD+�5�����Ҝ������V���X���G�24-�K� �^ӳ$=�N$�L�^�ۭ�v�bW��� t�*�Gy%o]��AP-�����=@*�論�PzK�`S^E���!y��wu��,oBߕ�#����,s9��] �I�H_I4���.6���A�r��(�X�;+́�����v�φa[��P@v �\�X&��g ����A=��J�b{\:�O/ �#���>uT��ɠ� :F��.���NUaF����/����Ifʈ����@�S�"C��.�r~�$|Ά)JA����S�꣢�'1(�̺@�s�O�ѿ{oN�� �@G�m61�?�zЕA�����~��x6���h��M%�g�ܩ��p���N�=��:�0�L��:��~�O�i4B��M�,��R�M�},û���{���1�y�@o�pL���;���j~�[�����_:G�`^�Bg6����gU�k굚�ҥk��ک0� �ޘ���m���+&���(��c����Ճ� ����'�+�k�P�`��z����$o�7v�GZ����#�7�W��Yx]�CS5����7� !�87���$A�o�X�*�ϭV�4U����BAa�5Y��Y&F��E;�^H$�Y�Q #��~h/�´��U=�xu�0�����?�@3�:�/:R��sl����Q�{hI � �]�����W���&�&�v&���R=����}�S!���PV%�[���d� �av���݇C� ��S�T���@0��)��&�4dȓ���u<�R�QO���6;{����j�$56��a�����eu�=��,�V�j=��-���&����^qjl1�)�̳��3$J,��K�Z��h�\h���}���po���� �g���F9��M���\8ؿ�&{x6��H��B>�k� �-6=e*�5S�2�8�^� E�
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
magic.dll
Resource
win10v2004-20230220-en
General
-
Target
di.rar
-
Size
9.5MB
-
MD5
5c69e5394868031238e03d1880bb45aa
-
SHA1
dcbd657dc7b30561192d06c27de6184311ffbd85
-
SHA256
48e06db50d9251069e250f4ceeb65b2cb33e2c3b66fc9f475cab3b4c08435cfc
-
SHA512
2a8f113391f2f056e84ab0dff546080f15df847390d27150962239746056a12b93b52bd1f862435790f2b43a39eb560b8ebd533a141d8e51a05c4f3a047171e4
-
SSDEEP
196608:xCVLvw5489WBtkJLjjqFCslUOG4St322VHLZ/Sn1spuTV:xCVTod2aJHjKCslUOG92St80
Malware Config
Signatures
-
resource yara_rule static1/unpack001/magic.dll vmprotect
Files
-
di.rar.rar
-
keygen.exe.exe windows x86
c2b83037dd537fdd575834f7bec32ef8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
RegCloseKey
user32
GetWindowLongA
kernel32
GetVersionExA
GlobalUnlock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
CreatePolyPolygonRgn
ole32
CreateStreamOnHGlobal
olepro32
OleLoadPicture
shfolder
SHGetFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 804B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 29KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 12B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1019KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
magic.dll.dll windows x86
72fd70267fe3566d35a4adb408f4ffa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
netapi32
Netbios
Exports
Exports
���j���������[o`)��@�X�B@yI�hg���(�����b�D�DND7�i�z�� ����Ҵ��ׅ�,Jm��s)_.p��[���k�����Usd t�QQ�^m�a����54 �X�0�3�vڙ��2s�I�J�0�����?���_�d�f�sW|\55��H���{�� J�T��}{�� 4�����7�#9�����6���@����;�婿X�����G�K��̘�B(h��pA}-c�r����b��oaT���BF��a����1�c"�T���W��Q�a���r�C0`;�{�XP�9�k�C��}t e � ?+*$��y?��h������a����Y�mgI�9���X!��_A!Ő��j%�UnX�9�g%���Z|���;��Z��l��]�����F��)QOjd���}��ZW�ry������놬;���lv���6q�H�$� -��M�q=ۿϻ&#��nLQ�~I�����r��(����� pD?7}Y�y2���f��Q��� �c��ņh:��,�ʄ���9W�$!ria>��R̊q�N�}�� 8\���������,sh?��I?7��)�hߞ�.�g�2$)߶���S�+>�6=+���g��jA��UN��z<�� u�=�0�rb�kԴ$����z�������5�����÷��'í���i��O\0�*��7��nಯ.>��B8m7 _et͟c|+��+�e�"Jh3%z��i,�߬��#u���sÊ'\��>���O�(��WQC�\0(K ���Z� �|���c�����k��r��q�F���� M�f��=���F��Lj�d���<��;xM�u�E�X@�� lh(�`O-�͋�aM�9����^���=�'T����We$��m]�_B�l s�A��#�{�FG�2J}3������ɾ�f���'Y��V+����!���Z��K��?�D��7{�g����)�����Μ�W2jЃ�ژhN���ϡ7F���Tevu�M �AT��A����G�;�i ��0���?<�Z�����Q9���Dn: �Rݡ�P9B1���x��.a�����A�U�Fl%U&x��)4'�A�c�aK��(G`7��Ϣ.��@�;������?w���Q���I�)�Z#�����>�x����(yECO��h+���[:�hGK��*��]r9�P�����No�)Z���eȐ(�*ZF�F/��@���uL������&�4�\�Ž],�6,�HIufj�c�9�p~��zM[�v�4�'��+��F�v�"�yI2QP�x��^��Ji�B;�:��Sc��C�L�YQ�0��~�K�褈���A�c�z���2��2v,�ӱc��w|No�?b�U�p�#Z��O��͘��;\n��R�I����AJd�/�foƂFr�ϩ� C�y�D\d[\(��:a���M>e�s���p�Vȉ���z2��g�G]n�+�*�Z��!�4�g����S˶Im�樟4(�]O9,��"D(>�4��_}/ڃsH��A[�rK$u�<®��;���x8�?�'����Rr\��DR�C�{������Rwi�������Ꙅ���5�����7��&�@ (u��)Y������or�;���g�pW�����Qއ�J���79/����֬����}%ແm��Ͼg��3I� ��k5�Ν�����]E���Kv��´x������9*�b����ˑ_�:F�]Ui5�q?�q��Z�`R1�~�P��bxı=Ыb�a�ì³��Ѧ(���Guo�;��]���J,��Xo3�@����1۽�t/1�X�-O��;�/����n���W�O\��c?�,"��BsP;��#����9��L�[�Ӥ�g���� � �RZ�c���P�`MПޘ�/-�Y�a���\�15_�$�=����^��Ǫ}}���q��Z=V�#�kI45��#��$]-�7���q'�����/J�J��; A'I����!�y�s�C������q˓����F�D������L� �EYM~�6��m C�e����a�-�u�Ɩ��e�<'r�8C����N����8�+���q{����[q����w c�~F�8M�z�ʚb�3\ hhH F��N�?�,yz��Fd�U�ySѸ�)��x�<�֠�@��4dJM��? �C,1��T�J�O2ˣ�$���x�'�w�2+<�y�O(��G:��l~����uzè�;@(/pKNM�⟣����1�����b�tz���!���({���I ���)�2�O`$J�$mD���Y�֪sҸ ��<^GR�v�m�����*(9���`����j��י�]�\��x���A�t���`�5{B��w���X9�͘Ęr�BilF�{N\�]z���|-f��,���ep�a�Vs!$ ����d���;xyv�?���@�O�9����H�-���%��ͥ� (P��gW:eá��\��YK|a�IX�j�4��JTZ��$X�\?��\�òj�=hw9�!;#|�(�%Ue{]G^�e|]"��[y�v�)�=��6y�Vs�%c3�l��!�c�fMR����>�lIJ.�r�?bI� ���q"McY�Ȱ[�YM�yβ��v��q5�5E��9�%NS*l��b���f�5�B#!TS\;�BZ�;��ݦ�?+� C&,�Q�b���i��F�a�����,0�7Fp4�I����&.���q�S�����8�yK0~Soh���Ʒ� �4z@��w I˲<�iN�p��ʍ_&��"6���t=I�,4iT��Vw( ������ή{�����N��,�_|���S/����%�'7WH������69\�H��eFz�7����[�W>��U2����)�8�\ƚn���=�a��hc�:¤H�IS���A�R��#�s�%�[���Oqf���݊�V5���8����������gy>������ zA�>����5����O�}���4^]�p���f�#J�Q�0�ٴ9���<�|�^Z2��'����l��{eze����S6K�\�*�;f�n��ת��
Sections
.text Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 391KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 617KB - Virtual size: 617KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ