t����qH_)�P-dl��ٺQ<���[������=��(D`�o��U��en/ي ��;���r;�$q�a�8p�J�X� 8��Y8@��"A�@|���i_�F����רfn�1Jv�e�ʖ|�Ѻ��!� ��oE0, @w&���L�ϔ�=zy�/�ɫ�կ]$�}}�4ᥟ�������w�k4� m�w\����.d��,j:�K�U���/�x�մD�[���v�}��*�%���jXl^��(7XKሄ�� �W�}r����>���k1�3ew������i8��l!e��4�{�H"�T�FFe}�egr�ua�`�e�!r$�ِ��G �\ �#I������G@�*�R�D�N�[\2����|�uk2������6��?��l��&o�Y^��S��<�& ���˕��YKs��G���1��r�2D�4��-�uX��%U=sD�^���2���74$p��_�}���,s��}��ل����b�9��,�i�c��-�ѿ=��G�����(fd@`�oЛ���T� ���piY�s.��DVd$62�Dj%I��uY]���&��l^Ü���s%�w��V��6��z������c�Y+�"'�� J�2{%"^�wҷ�3�.Xf8�T��J�$���.#F-�/�*Zy��sP���)RB�+�/X�i�V��I�� �L����d$�oè-���*�~�}�o>�̴�~6_w&�L��[��:J���\��f��X��Olh��h>����f���GA�9��B[)'&?���S���ޯ��W��`��o����[�Y:O���b�_]|D���&�"=q�˼�n?�F���?���=��&ۚrD��u����Y�-�v_�Q�L�z��?�8�+�Lx���c���־�y��2Z��:m���b[v'���a9�یc� �&.��o�6�3��^=mǾ���x���|���� PM��͕�2�h�a��E�4�"�b�����|�u�eU� ��`���"Qm���[h�����p9��Y=�.r����6s{:��m� ��RE"/�� u�Y���#XQp*�N �yޫ%I�H:H�=�'ɗ~J�,�Q"�ƕ;Hɢ�p��\f�����zM6���N�����B��/SA|�3pƐȅ��$;7�s���h���N!�|3_R/d� `�@�[m���2�! ��tg�^�{Ub|�;�C�GD�� �|�r��O�9�K��o�mK�����.��ZjA���=3�p;mW�艺d ���$���q� Z�L�Cm��~aZ5#������~M��Q}hs1�A��Fa5~�=��� X����:���u�`XA��h��_`���FC�`������ N��W<�H��g�)�T��� � �w"��T���f�)�ȇ2_y��~���_?ۂѶ�#I,�U^���_E�%| TZ����&%b�����tR��� ��E5�ڱr���h��}=Jz���<�ur����tAy^�\5��ҿ��!�$ba�3G��B��`�F�p��2��f�Ԗ��s�QC���gV��EQ�|��[����|�\����k���RI��m��7��/��|c�B'�Q�V˓h}��X,�*�v��2� Y�q�.�ڏH�����.V tLI�P���O��\��T��%1����ו��'���5� ��Y� ����B<C���Ǖ,]�S�9Pb��(�M6�$=�ceæB0�O�ntBԚ/�,i�XB�m��{W� ٴ���!�(�@n�= YD]m�������J����Uю�xf]��(��J�T���c)0�i���~y�Z����V��02A2�/P�aA�^���)�^�V2���'`��c?i)�gi��USٿn���(e `κ7��5iv۷���Mz���9ݳ����ln�2��O|�x�`e�����1[���@�ѿ����ԧ+�}�T-7\��xx�u����X-���������b��s��Zo�����&X9�Y �o���6�K`.�(3:����G��at<���E����pA4x1� S���1덴l�#����G��i5CvBt��\$�C0�q���)�æQ,<N1`�.�T������4�?�K�h-��`<�x@�ke�� �)�X�<�yU/��.C�8�̥9o��������Ko�Ŏ�h��%t�=Kq,���j���|q5������P�nM�~܅��ѼMY�kxmn�����'���i�Z��� Y�;ۓXf�,���re����X�;�ѓ/s���k%���s�ɮ%�$s�}�n��%�)'��S�*ݡ� �U%ie�n�=(���3a���=��Q��3U�~x-��h�0�6]��o�M<B/���S������A(@�HS��*X�R�>�Dܚbtv=�Lcʡ�J�D����R�$��E�_�����6%�T&�ԋ�/���f���_�����%7,.���!�ɧ\�פg^I�Q�+7)cO�tj�q�S���ÔZ�=�D��`2]�+K�>��V ��S_T����`�vř �WO�k*���x�T��d$c˗�Z�m=���D3��wl���q�JK)z�9�M�1翤�nW���4�˦�:Uy� �1��V5��z�u�k�����G���sa�����-���ڮ�oV*i͉b�Z�'������uC�����C�PY\� �}D��e �p~� �E�k��p�FQz?z�bc����V���r�5��<B0p'0��nY�G���������>v{s�Q�H��CW�~ ָ*X��S��k���a�У��{�r��&�n�g�:^0'˛}3F��Y|�%�� ;��u���( \��2�M���B+|3v�0_*�R���I�Zl,>B���uT%���J�1�������i�tI6!�����y&� ���c���3k������Cj0V6(9��As���n��Id�L�x����d�Q�� BJ�����|eĖ�ŜJx� V���I��2FV/�������-��d��@������#ہ�{;���$G�����,�� pH�}��#��%��7��� ��%wd���B�4��)����|���
Behavioral task
behavioral1
Sample
236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa.dll
Resource
win10v2004-20230703-en
General
-
Target
236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa
-
Size
5.2MB
-
MD5
fd57c7c4747ba50d2bd9a076eac84b46
-
SHA1
0ce4a3ef3166bd74981bed983a8dcff3a3c06da0
-
SHA256
236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa
-
SHA512
f4b4b35b2b4fb6ccf7e476070c18e7a3fe03891009c8cab10518c671de20d5e7686881bf9f4fbc075c8bacfa1e74303f52b78fedb2ad5e093396d37056e36d3d
-
SSDEEP
98304:n+7hqjqOs2iP8CYYy9ngECm6FaLQwlvqP8WlUyo7RYHtUtFnY:+dsQ2nCGOECmzQwJqU7RYH6Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa
Files
-
236736ba59bd601f8f7666c71c9c4978dce1bee5a3ed2a3aa2fc90053d00b4aa.dll windows x64
9720fde6fbf85236890920a6ea2db24f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ksoxev64
DllCanUnloadNow
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ