Ǜe�K���}�!�yHpo���E����f�5f�j*0���;Blx�����/���]d &����4qP�[�w��|XF *�R�Gx�݂��?�ڛ� ���n}9`_�%�,����s !7_J�6������h'a�y�_,y�^[��;M��ʹ�9���/t�K�sd� ����j&�5L�E�!j�3�,�QX��HD�W�@��e�2Y���/4Y����q|�JC�FqAH`�R�PQp��6�)v�.�|Lq� bq�S�D`�����j��S����=\>ms!��l���`�����$f[����[nI�xmy��:�̺/�رyf`D����4@�-B�օhDbu��O��˻�F�S�`�����7�V�~U\��{%�ȈPpA(�O�)��"�ڇ��]#s�9�:D��T��zb!�5�pꙺ�m�X�e@�-��=��?��O�n���9W ���I��_�w�]��t����㖜�����}����q_�F ���忇G��j��a�W�hR��+o:�<[��w7�y�Fo�l/��˙���6����Q�pKQބ5gJ�����(Aʄ�������6��t���Q;������l�`�O蓪[���`�p*Op#����b�'���Ϳ�q�=j������ӏ=H��� �-^Kz��~r�-���`}�bM����+1p��d�n۴�s&�1]�� y�� w4K�JM RS��Ms����5�����`���A L�A���_��Egg�����/ ^�k9�+@�_AI�-�F$�~x�7�0a�5[ΌgX� �z��U���!U�3��}�0�j�R��|������xU��H�o����]&o�Kआ�t �St�Ќ]�8�4�K�v#D��������$z\��,���+O6��31_��Dh�e`��8UM�qi�.-(7��dj-h�s�>��^T��T�tY��*~qa��Sv�D�E��;2_�f-��҆��Q�D�2�]caP��<�p0Z�Sv(���1 Fw��3y���>e(�5"���`j��i�a�� �� ˉ�\9�'V`hD_�I��K�Zf�����>�^�T��NI�s����r��X�]��V=�]O�B��;Լ]Vn�)-�Ǘ�o���c����iH4y`�BZ]������t�kx���8pK�tw�~6t��>*�`5��D0������A��Cfp~n�2C�,�y�<�h��Yع>�%J�C�1�ɠ�wxpx3X��NH�t�PR\$�������Cm� �ϝ�����.��O�����Q����ڒ�5n4bK8�������g�a{�ġ1<�T?auR$(`�?�l�YuQ�Y�[b�������n'���+FD��{�KRk\�H�-W}n6�T�N(�N:=�В�0�?'%#1V��y�6������%} ��M�Ҕo\����H��;�A��YnC�;J�/�GS�����w�������F�W�ݔ�=���&3#�ċ2��5�Oe����P��k�����a���r#��=��O�b�����pz-�&#��5�d��'Fe�yl{d�mU��3��I�[���Ny*��gupI@�O�38H"��į����j> ���ݰ�0���l��1������{����|+?H<� �&<� <� տe T\f :Z�Fs�Z3�<Ʀ���VR_\��?�4���K����RQ�n���)%ެ�}&mw����M��I"��p<v�IF�Fo}hF|7N[�<�M����Kn{�U,�_��?Y�v�lWܛܝ�u?�7ڪT&���$6}�Cd��**�p��<#���}٣����8s!�*A����)ў�z�₻LQ#풏 �eF�Q��{㛬{Z5���+�����\��'�����Vh�*tOcgs�8S���p��!�� \�2�# �u��e���VG�=WIm( ��.u)��fwvu(;���CPd���E��/�.�=lvv: S=~]�Q�EP�@\{���vAMk�;X�*��H�-N4��c(�$y2�k�W�����Vl[��Cp0&2�^1�cW��;Xv�2Tz�A�:��e?\]�Ҝa���B���h@��nl�c&�9����@tK����Ҁ�"8#B��j�*=�����靸H�]��?]�u/,���;Ԁ���jx�J��0 ���N0S]՟~kk����,��}�4�k0BP^���fI�Y߇+�2-]tO_�v�W,��쏇���t��h�/��{����`1l�m�ۧ� ���?����.��Y�=�U����\_�:�1s�G6L�5_s����(xwu�٤���nq��2˝6H+`�)�:�G�8±A�H��e����D��YϻcS�ΈN[#�^O�XN��a��r��{���#6`�A��} ��00S- �Y}��75y@el��<�o�&�� �/�RP���4��C�X����o��D��N��n��[1WQ�w��gPNR���O��,�l5;�;��vt(��5�9茴>��D��e'���ew8�lJ4�r���{y<�&�%�u)�����.��5gv&�t���L'"�r)Q� �eh�#�xFQѮ���ʷ��V�E�{ӳL��7���U���g`>,� ��R��Q���b�c( ��<��N dVF�kX�År���+��Gυ��v���b��UF��"�1�ك���5 ���aW9`j¯��~I@qClcX��(����V�����4�gTp�d;/�&<�h�0�OL��P��[��ۘ8�H��O��[nk�H���v�+�"�/�?W�!c���j����Ou_��ʙB� �{|q4�6��!a�t���ӝ�={��I�*�N��uG��B��T{HI�wX����D��R\ ē�dGSK���@�C喓�Xy��-�i�i�dž�/�!@����L}�w�r�~XD�Å�H*������CEW����j|�%e�����R%��78M����V� ����SOnf�r� �&0��?�~3z��[!��OpR昏3��`��}3�,3��/��N���KYXQ�Ň,Oz)�jI���L?�1#݉��L���
Behavioral task
behavioral1
Sample
5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d.dll
Resource
win10v2004-20230915-en
General
-
Target
5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d
-
Size
3.8MB
-
MD5
d2cbdb5084d3691aeb5face9e68da8ce
-
SHA1
add86bf083255b285cc69af8bcab5c9eea4bc9e3
-
SHA256
5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d
-
SHA512
ce100e3b3d8fda4023aca35c1750b3decacba704635cef65d59d7871ab240dc2dd5765da31ed8ae945fbae3148861a319080c228b64a0de328b7220561238744
-
SSDEEP
98304:94IH1c8ZFwx2s5Zjs7YLXIMgRWden2fnh7jf:6AOitqYYLXmW0nonh7T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d
Files
-
5752efbb6aae835b51ca90ae4bf39b4066921e49e380ee7175b1f8478856dc4d.dll windows:5 windows x86
2ca2ef2da7feaf78485943f356d0b280
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord5300
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord815
ord561
ord1176
ord1575
ord1116
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord3811
ord551
ord4274
ord823
ord3831
ord825
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
msvcrt
_adjust_fdiv
_except_handler3
__CxxFrameHandler
_onexit
free
_initterm
??1type_info@@UAE@XZ
__dllonexit
malloc
kernel32
LocalFree
OpenMutexA
GetCurrentProcess
TerminateProcess
CreateThread
Sleep
GetModuleHandleA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
VirtualQuery
VirtualProtect
LocalAlloc
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
user32
KillTimer
TranslateMessage
PeekMessageA
DispatchMessageA
SetTimer
CharUpperBuffW
MessageBoxW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 824B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE