~����䌒y�G���j(��h��0�.�Ɂ�����>���"L��y6����ǻ~��� ��A�O��a}%q Ll�2yh%�ܧ75U��]�z`��omM��#Gs��w@NO]K���^1њ���|㸄��tK�����;O3��D��c�s����g�zܒ�́�3-h�vY�)͌�ݩ��뼒r���v/IПɈO�ɤ$5��1�>pF�$��N�p-LJ�����g@�<��Ʀ_3!�gh��m9o�G�o�v�b�#���w'�P=�"R�[��aB�Ù��!����$�NJU;��6Ą1h��y�t�{��|�q���_��-���7]>;��� �q[�(TsFf$)��=5��r��d,3������=�Ӣ|`�����<��G�)��1�r��}�Ҽ�Q�$����oy6�͉Du�Hv�"b�x�C��������@�%���{��8b\%C���ѳ���e��r���xr^b�����a�2��,�����r��V�?�s�Γq ��H��*M�|���m! Y xP��vЃ�߭͋�)� B�Q��`� љ�n���S8o(�W�J�B�T��q�}�D��[O�D�n�˔p�4t<ȅ{Fʊ�� ���K����5c�W����tf�[��~��$�L���/ ��ʢ wy#���k�����5O\�n^����XN&Vk/Җ)���������эh"�m����'-VXA��;!�z�)/y�*�_|���imb�.h��B�"��#�E��9��9C�1���@6� �*��A�c��Yg��X�����l��*n�ك�������-�?����/������ťB���s��v�m@U��t'��f(���@?��\?�G^;U>��+�J#6a;���������ěh�p��po,Q���~�ѻ�|�$�l���r���P��.Fa�u��u�g�$�m���v�*�$�/tr�lW����LEF�l�d�ܹ����JC����8���)�+0����6x<��J[U�4g�P+ =u�wf�N\"Ի�����Q�H8S�ل*"&d��w��}z�;$F ���atê&8T�i�L<,S�.y�E܋�����DH�7Д�ԥ��:�L�]ɤ���C���5ݗY�_��r�vy��G��.V�G��@�l�x-ol8�5��ᰝ]!w:���'�%JX�(�6â��qo��h�Yr�'{Fs�6��e�[R��D��5N{�k������%��q?y��֮Y.ʞO!�b>���R]ͬV<-#���h�c�����3�F}�y>>�O���$�@�j>���|3��7rT� hfh��]n��V�<�_.m�����vB�s� ���"��1�++��Gd�[����V1�dR�O��i�"��|�����u�$���*͗W�Y��Ճ}~�˺��3.�],-�W��n8�Ə��k4"�|��t�S/��jGf�*H���h���� X������"�uÆby 5�/������~r���.��O� ��+�X:����%�h��]�s@��~��E��+n�X�Ȩt" ��6B�!�Zq�M�fD���"���0��Q��C���}7TZCe���}���17�����B<�í�n 7�q.PZ`1̉���?҆����R�X�x�T+��ح���Reh"^��������3��a��2u�n$����H��5wv�xVG���.���+>�}�gB���(ֲY�&��ҹi�5�.&��pR��F�;F����[����ߧ/]��X�->�s�Ѐ��f�(�b�c��@���{�=ڟw%F`:�A�hh�Y���ޘq�ĩHi�\���=�v%B��K�6%���X�uqA��ΆR��x�nW����C\���X��xh�(�F��+C���3�D���<w�]��h����-�E"�eO�̺jqӇۨ�!=q��Z�6Iiо�D���qz�ؐTm���x#`����C����>#��'t��6���P�[TyD��"PX���}]R�v�f�� ��{<�^{�?:`�u���}���^�Z}��D���Z�U��G�0�W퀙�^��T�C��ʈ�VkO�H�,8�M��:vl[w���^ʩޏG�7��樗�mRb�ҩ�+���k��E"�!�(�.T����L�H��S�,֓e57^zy6�/� �\�T�J�7Zi�R��C'�o���]�U���(p��R��-1Z�l��6�)_��@|>d�ؙ�Us��1[� �Aw/6�������DQQ��l�F/m�9��Hfrk��B���崫����R��0���s(��.ϝ�9�x�-��h��8�z�/M�����f}E�*�1ۭ4&�fG���#F /�d���R*68�����d�H�������$ڸ������d��+!$�B�b�;$,$�E%�����:�|�t?�ڴ�̪��K����*q�2_��\���!��T��jƖ�8��5��E^/���7�Ν����N^E}OU���� <aç�*���n�����*�]�]Eo4�<5%� ����9_SZ8Y\|����F����`�]�|�����ي�~���d�k���{̳@U�=1q�|i^��Z�|�fu%p�_��=���a���m������;J���ʒ�zF}f��|����(P B%�4�2N���0�=G(�\[x)9a*L�����G��;O*�e|���i�����3%���X�U�D��)磆�����wL����g��q�:�w�'H�s��|��@,I�+��y��48}6дn�o���/��<�v�)<�K�.M�X6 ���m�B�y�����S��M��>��uTw���x�q�]i���x��� �\�bȵ����V������'�A8�҈������X�_-&:�� ����#�N�!���(*���� $0sj[���j�"��Mh(�e��'H�㠪�>�A��Jf�l���ˬ���ʕ�~��Tu���5U�����"�uw��YWC{�����&p��1��F�䧫��v�7i���g��D0u�@,<O��m������O�1�XL�����0|Уz4��4�F?�ĭPzoޅ(��IU+ ���AʺN�-
Behavioral task
behavioral1
Sample
5c9b4d49d26cc3d9c75e5f01b475da07.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c9b4d49d26cc3d9c75e5f01b475da07.dll
Resource
win10v2004-20231215-en
General
-
Target
5c9b4d49d26cc3d9c75e5f01b475da07
-
Size
135KB
-
MD5
5c9b4d49d26cc3d9c75e5f01b475da07
-
SHA1
3bff7f6e1962eba0ca90af5d151565ecaf6eea28
-
SHA256
e66a5213cc20150802d07a7adbe60dad34566f73928baa9991e04a2bd3c273f5
-
SHA512
ef727e96145fabd0373046a07a66ac64c3dc746ac8ae8cab135db6bc146aff80a534e21150e7ed33fe34eb43e428dee2e32f6219bcaac2cbe9209a4ba174ebc6
-
SSDEEP
3072:eV7nxSaJyFfSj5/s7tMgRuVMgnCsf3B2+lfKs2fY+gHbnu6Zk:kby1G/MMWsf3B20KsIYZbu9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c9b4d49d26cc3d9c75e5f01b475da07
Files
-
5c9b4d49d26cc3d9c75e5f01b475da07.dll windows:5 windows x86 arch:x86
cfd4bda76dd0642c370fdee346b84c2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcr90
_unlock
d3dx9_43
D3DXCreateLine
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ