]���6�Bⱔt VX� �$C*J`&���������� 2����9����B�D�2�#��8=rr����1*���-����M-k�W���16����/ȑ�S�������{Z;i9��3?s��YR���ې�$Sa�4��-^N��|�û� ����#ҥ|z����ICVp[��7��kY3{��Y@����o��J�c�#�7�l�l@�D�&(���0o��nOl|n�Ȁ�\��Y�)�f�#�E�������$��Y�S = �' . �mZSHV���0���Ld���t����Zu��Yd�ZY���0c�|����(ʣ��:#���kKlk�?e�v)(! �۬l�����Ƀ�#x������`��?5ѧZ3i���;�U���c�Ž?��z$iWN]��ཝK�l�H����_~}��t±<�i���L�+���| �)��PIF ����ܨ�Q7 .3�C�Gm�.����A��9��e�?v�|.R��H 6��������R�������2S�[.�~e5�j{��\�V7b���Q�mM@ȎRo+��ts��}�9h-�V��t Ϧ�h������V,u�4L����#M����{en�H#oɻ�c���Ɲ#��J5��{X1* @��vѠx9/0�i�r�t�Y(������C�4�v��[�6�r��U�zYU!�����Y���X�@2II���SS"*J+����L��&����Q�X�?K5���_�Z�M_d]b#O4��>I(� �4��4&g�[���O=���J�J�����}��ү�m\�wn&7�wޞC��g9\ΟNi��zzB���ɴ�v�]�܋��K�=���a����+���)��R�k�N���n�BM��R���B ��H���'A!�"t'��jgRt��t�V�P�����J ���,'�:�'�>_�H�$�q�>8�9q��ȯ��WvS˿t��m�@�_������:"�QO=(��z�g���+��Q���#N��op���1!}����z\ﲛ��\�`��= ���94��HB}�hZ�C0������H���_9��h|S͇������g ��Ȕ�I�L���/���WE�B �X&���*F��% `�3����`���lSH��붡f�����R��Q]��)��]�� U��ݭ�eM�wz�<��+�e_����.��L�ٖFko��ZΈ�JK#K���_+z2$rE����@m�쏪)q��u)f-u�Y^�=X��rmrK�SZ�}���l ��-(�t��b蟾l�NQ|�'�����O-�U���$ń����N�<3���ƲvB��\m !��u�+�#�~�[� �ŝY�(�E'���N��پne=;�ٟ�l9-r�����H��U���ct7��ð�An̏B���F�⟫��V���Qm�7�����H[@V6<S�e_j�{��tv;wq j��ǮjAL�ґp�O�C � �������h�_����x���������h�f-�"�Q��WR8U��j_�(�9w�'Rt���`���Cx����;�Ls}UI(��W{DS��T`����*�>�^Vy�Kb�`l�@�Ξ h��QV`���<�L���T�m`l{T�:��)�p#�\Rf u����Q���5{���S�@�''�in�c�A�������X;���А����O#0(� �Y���F��٫bbP&R�<b�7��.}\<�%� UԽ��D��Ø���w�8:)�;��?�!�����Do�.k�8����)��a߂��8��d�k@>���B�W&�[J�������[#�=�">���s@���Ყc���M�`$���G�-�P�����,��g�C^����P�TG��pِ�6�HT��hz���ʑ�����*B@��8W�6Q�����-�������&��,L�D �Y̋�i�����d�-w��r�� ͽM��f3D��鶭����Ay�̬�e!H{[�(ʂl������J���fk��84;�qiI�`30��h��e�/�m�������k(�� Go`_7^t��煺9D�7�"����PvIL/��MU������*�����q����lA���� 'S-vc�A�d�da�8�Tjf����0O-�j�qx����ro���T�7�5cKɽ�+m�4+F���#N��l�r�:w����˳�H<�wm�/���+G��� ���*�\wvO,j���9���z���ӇIT�>�%���w;�L����I)/*L6�H{��M^3PY�A��"��֧�Pb��^@��E�˼*���6����7:����Y�0��(��!;�6����+�Ȧ�BYa�_R {�ns�����Z��T�Ҟh�<�Wּ��0)e=���EI^�Iq���;N ���0I�Q�h�M�2�����87(q�� �I�7Q@�?Ԝ��V諣��������%'�VBF#V�`�@U�x6���_3���8܇��f���8%���*GW$.���>XĊ��"�p� ���N��t�ds;.�-�_P�{:H$�+[u�T�t�Zק�f�5�3K�� �)��1P *]_.�L&��*z��\X�E��C���V~bj�{��aZ>���,\�&�y6WaJl��f;���u�����`����6�G����H*.�!�N6�c��k�l�D�Ol�̦�!pmm|�K���=�UօU��VOJ�sdN�f��� =�F5%��u��7[hic_��!.�k<&E�~�@�i�ց��{B��~�7Hl�h�Ȼ�0}��\�X�Ն߬�!^�S�BS��ۙ�M�mM�D� .�^ΐ�[�G��|4�RΕ����3��%��/��I� �����ț ���&��:���u� ��#�T�D�]g�m����ڑ�v�5.�x0Q�x�T�Б�&�V�.ѡ<��48��N }Zt��ٖ�>�AS�����Z�e㲊������O�>2e��P ��h��1%�i-Q�QL���� �\A�g�����e�n�E�t4E||�.!���[}ɇ�8�C~���3�Yt8���M�هL�p<4�
Behavioral task
behavioral1
Sample
907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570.dll
Resource
win10v2004-20230703-en
General
-
Target
907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570
-
Size
5.3MB
-
MD5
84f6c958457c0e30dfc44f66e3d442e0
-
SHA1
0f0c905456ea0ff92815205ef9b172a0a2a4dcc6
-
SHA256
907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570
-
SHA512
debd74473231a05be4143492f7369d7648579a15929ea3a3d7a64cc16d3b2077cded5e49e7fe3b55f6e2403ca93f2ba985c7ae94c4af7e4c379e7daebda4abd6
-
SSDEEP
98304:Kno5pCqj0OHdv2hFQ+JA+o1soZrCK5d4oWkdHV6VwSExvQtDCrxy:Io5pN0O9eh+ssso4KbHW0AHtDCQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570
Files
-
907660a81a0bd80266e0657c2c8d531695efa55d60c8c383814d687ec7c34570.dll windows x64
6414ec81f197039d19515b066bcf9cab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 919B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ