�2t�Z�8{u̹�&1�3��~��ϴg�*I�q�.�Hn!ӹL�_�l`��'.���D~�O���,yf�Ȯq��䁄�X�`0��c�������);!ͤ�I#���NPsce�Ss['fq: ����n�&h���4��J#R� rO�T&x����f�0���=����GY�+C�P��^���~'kfj� |c��?-�����`d�ι���đ����O�<9* a�N�� s��c��n`�&���)*T�1iB(����K�ߢ���m_M��:i0Pv��(����$' c��x -F(Վ�+u"�x�M3|X�q�ݫ�_@�L�rAJD��hK�Y�A���á��u������J'Ö���k�>a�+��{H��x0c:�t?�W��B��#D��?�Y���%�H�ʥ���GM[�^����J7��6����-;�ɟ]s���t5R�5�*W� Av�6H�`�:�u3�3���^�U�b~����s8��<�y��'���_����h{[q 2��.f�u�U-浌%�%m����T�pH�=��s���TP��i�]�����/~��`�dϣ�q��xAt��Lϓ}���Ġv\4���t X�\�6����4��8�_9�����ښ˾[�\T֪C��so~W �ʬ�Ùo��ok�ɯ5����&y��:L��������#s�`C��h����an��bc���!�����vwv��u�&ͣ�^�g�(��>��Ӭ��ܫr�5"O���pb�nO�˸�|} �V����]D�Yj��j7*����-r"�;���l�%�����K��ņ��9vn=���g�\�B�URתmQ@�O�!D� g���/!���)���)�n��8�-����f�|��AoL:J;�GFA��?���-;�ͬ9���6���&a����1'��Q�L��D����1[L��zEY���Kg��`�r��1�M����0BوF�:���u�1E;�.*ܥr�N����ٙ-��ֿ��w�*>��i�W)z�����ą��~{�.S�)�l9��ۆM�>�k�aAf�Q���RL���6%Q�|k�hʞ��M���O��K��Z_�C��,^��Ԥp��|.7;LΰC�J}P������@RN�b��>�?W>ZL�%s�������u���V�sN҄ ���� �'��5�I,I0"��_Wȧ�#�e_v|�����%�=?hAP����Z�m�$ U��q!�ތZ"|��I�a�Ҳ��wϔǍ�1,�x"'��J���R k���7��RZ��T��Zq$ֳ���H︸����A2���U����<�����}�GQ�]�˱ "�}��ν&ۄ_��zc��c�!/�:۬y�Ga��������*�bϓS1kJ�P$J���D�1�Q}�y�F�����)�����u�Rs����$'�� ~��[)P �@�z���B�ȍ�c���������6 HH��R]�R������R'�hK��������@+C+��_�:f�zϨ��|wc�*�:�)=5���S��P�����C�C�/2#ꈍ��M{��l��>J�s&$t$��4M�w� �����S�Z�mǮj�/w��t�� 9�"s�,,eݰ9㔑zQ���˃�Ć���)Oi�9��E�,0͗���x��98��=�p�sR8��J�:�n���Wp��Rd����'=��u��}7���^���c�Ri���"� ���4���<1��IC��Ӹ�zUs�>�N�i�[^�$g�?&̧�]mz��!=�^�Y�G��d�N�S���"�ڬ�J��,v��t���KD�.:�q]���wE���'��z�oظg�����<kWs�QC0q;#���"z$������_k�M���¾vh QP�H'����)b�rB�q}���� �og�;��/J��x����8-.H��Dd��Kz����CÞ�`Bhƪ9uY��Q �sT��"��1��~�hF�Q��ؤ��N���aKy&D8�m�h��it��C7O�tQ�]Pf� �o]AO^����������6�0Y��t1M\ͅ���;fۀJ<%`0 }>e��C�� ���!���!�9!;��l*/0����a�A5�م�IC��6�͟h*�����ɚ&�ij�Y[�{j�~���z�":F�2I�u�ٮ��,CL��i�����5�� �aJˇ��c2��J�TK�����us�r��tݿ�#�m�^:TȆ�w!��'��:�ʶ���J/�����D���+�x-(���`7�oA&xw����T�7+ʂ�\�@�=rF �r?���25��*��etd;GY�AWđws:,�\60�3!:R4��)xё�1T��2H�������(r�p5�~�.���<�|%�7�5YeHyJ�4��Dm�����{����p��idC��S^������U��2� `��K�9U�V�3w?�ϐGi�=��� |��<b�fY���.�_�4�N{������XG� x�_�[����&d@2I/#���B�cgNdĆ�/g��a�i{�!��3HJ��|�1����;"�ĩ�Gn���l�R?�B�.\�I����lw������@�gEL���ҿ���#���3�̨j�p���%+��� w� Q5K"��3�5~��K�0}��T$@0͑֟E���.|�kq;��n^rv0�h=Y�2E�bQ��#z�2XC��^�R�������!��;- K �c�+��{&Mΰ@F��;-���bl�0��SS�Q�����!n舙Y��+S�gi�葀�o� ��&t��S�=�?|�$�ʸ�d��E����ސt�ZDRV2�w�_"Z�R����r�)���؝�@��mU�L��>��hs�kþ�/-��GL��u<���ԇ-�l���������N�oH�ִ��H]���:Z?�a�x?8�;��l���1����S�=H�����&�ۇ~Q|�����R��y��/��XT����8�/˖�i{�^�����n��x���f�Y,53ܶJ*W,��R!O��(��'"ͳG�Y���Ŏ[���wO���dv��];��ia��@�&�,��-7���o
Behavioral task
behavioral1
Sample
0b58b9b40d3cb6ded9aa5f146870f53b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0b58b9b40d3cb6ded9aa5f146870f53b.dll
Resource
win10v2004-20231215-en
General
-
Target
0b58b9b40d3cb6ded9aa5f146870f53b
-
Size
337KB
-
MD5
0b58b9b40d3cb6ded9aa5f146870f53b
-
SHA1
7c0a1f52ab62d4d86a941095180b25d57fb88f63
-
SHA256
dc87f082f8c4e261bc768575dd69d9d61c8da6c13e063c53484a989b10144097
-
SHA512
c2df97c3240f2cb744c493027fe3885a5724c8fb1d3704fec0656978d9ce9f14b9527a3d0d3b7fe8a7f8e8c01328402a4554290efe5261079221b6790c1042bd
-
SSDEEP
6144:+8k1m1IS6EMWvdbk0+uunFAqGqVaCy+3/cwSDsmZ+/KyHMa8RNh7SpGYl+:7Em1CErvdI0BIFAzqVaCXERDsZKkCwGQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b58b9b40d3cb6ded9aa5f146870f53b
Files
-
0b58b9b40d3cb6ded9aa5f146870f53b.dll windows:5 windows x86 arch:x86
1bc4d8041f7197cf0c2b92846f49d659
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStringTypeW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
ws2_32
socket
shlwapi
PathStripPathW
psapi
EnumProcessModules
Exports
Exports
Sections
.text Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 334KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ