�8����%�ȑ8���f�����!柺ϿhX�8F�X�_Κ .`�{q�%��=��AM&"�����h�֕���gˠ�t�F ��F���=����&�Oq��O�}�o%�U5�_�'�_�Eђ�����o�Ků��I��4:l�=�����@ܕ�nt3n0F��s�K�>Ԁ���z�� }M�r�k�m1O��UpfJ~��<)�s�����ZGcdb�;p橍��#�p��v�)��a@��1ȶ���X㌵것}��8p_.�<������e`��������R���8YI���uȐ�,�խ���$��|R���t�6�` �5 �5�=:���Hj���AA���K-��ώ��<��b��#��>1�._��f 'Q�TE��������됁���&���A��,p��Z��p�tܶ��7�j���-j����^HuV�����(�Þq�A���̸5P4���m�l�ތj��"�n:�!�4���[w/UsiH��O� F�[�<���\��ct��JrA�T�./�j���T��GC�$ك�b����۷�es-�Ի.�h��WOr��Qh_��`�"� [Ь�p�6W��9���蒒�ii�ɺ�� j�zS���*�h����s�~�|=�{,B�R������;�G*�)�#�d���9�y�U�jR�MJuw/�����7���x@�*��y��D���Fl����NC����M�S����dU���n�*]������ʙ���_D'��k;9᥎�s�����A�e�����Z{����@q�><��s��|�G�\ܔ>���M+(�ז}"�gE�[>h���C�S���T�y �A,d���`? ��,�^{W/�cT_�;�;��-M����N��I��s��$��+�7��>8��[��Ǘ�=�� C��.y|/���jκ��u����X]��r#�B�i"�������AU4����D���B�by�j�Sɼ�\��s�r}�[Q,��L� �:�Ĕ�p��ƿc����w����xY#z'�,A�*L���V�v�pi3 �oo��_�`�!O�NH~t��� ���S�],��[/&��"8�+�b���`��M����!eyO?����f��i�*"E�7�lڨ����YY9���0Ƞ�(H�������ώi� }��tP�!װdQ�K�q�����C;WQ���v,�RVN�w�Y�g�e4�=�0=���>��zkCM�BP�"��Nj,������� � Q��[���L�_�^�x��=YХ�P����F�< �ߓ��� |ws�Q�blЁ��^�0��1��Y�S��z%cNve�� Jd ccuC0vuzN��ωj'�4�iڌ���}�P���@� ��1i.�35��a��'�q��"^�W:7fa����q>�g^}M����vJ#m$Ɔ��/_�3�Ã[��MN�S�ς-<� ��m�/���� �\B��+m��jR�Ap�F��߉�ꌢ��%k���`'�q?�t r,[vM�J����<��,9�N8�V���v��� ��~r��vP%�����D.f���N(_B�'�e_�A&�J(s�յ��$�Ze�^���J����)Wܼ��e'�J$��S)B��Q�^s�]a'�^/8Ѕ��uF�!��/^D qu�c?+F��,�R�s뵉T!<xR���������!'(���GF\eSF�����d��YU~���W�4"�����G�_B��0u0�3ؔ���j�Wf����(�+ѝ14��z�3(�F�S���6���Ŷ,���8�\�v�y2ȝ����S0�I m*(��O�xV8���B��٪�֧R4�o\x��Ց��F�1���äJH�K�pӭ�����Hs6�1�����!3�� �Q��q|OM{e��#V@�a��N�A�O�Ԫ:�G2�y�$�g���Y����)1�H��*��׆��G�k`O��x�`��)�ɬ�X:���g��cߟyAb�$ ���l��N�H:��h�cd��O�_)v�4 E�/��� ����F�0�2jt��m��a�/�oq �z�-��u��L\�G>��e{2��(>,��Cͪ}�����V����������0[ ��M��vNw�v����7֡�%^�%��`��wXt���0�Y���W�H��@Jjc?��]2�obPN�LG��W}����O ��윭G�ፀYY���,`��Hg������JnXI����˞m+A�x�p�gu1;����;;)�;���o{5ɱ�E�yU�"����$���Qp�P�ܔ?CS�l�M/��V��y4��M��pC��g�6.ܓ���_� �Rg8���(��k�0.k�JR8�����R���4C���_ǂO��\�f�4F��#���o^����p [��P��#4�GA�o�a���uTMi:�����?R���Ӷ�:�\ܛ��Ă��r�FE���D��X��g��^�1���4}o���R#~ν�G�dj��܇�H�Nb�q3��q5�rDT���$&��X����uX�X2�V�8�%W�a�6��u�b͛&����Џ��d�d�L���tJ%� �Y[�qkD�9�%�_�E��i��c�f-%G�2.���CC�iH��}Q�&��ݒJtH(|ɢ�0���5u9�<�n��͍��ɬŠwT�����|�A��-��{N���b�KJ�=�tv��D�ei����6�F[������g��`baϵj-��4?�շ�:����y���V��!1�E��$�=`��/��(QY�x�63r_����I���mw��*�т�~Ϧ1���i5g��ى��Q���p�5?lqK��Y���T��������z��1k���"wӘ�"`����ãh���W��Fi�{N֓��Ȯ\>�j�HHL6!��ȟ8��fN����P��ٿ��E5 �$�<��zH5y#/l\\9��S@N�����q�?���|�@��;ϫ4���q֫�ԫ!A�W�%O2g���gy���O�~�����Cx�=C�yfkm�,H�� ����>bu6U��+��ĥ�E=�Lթ�z�}zl����ԉߟ�]��2r�ﻟ�!#
Behavioral task
behavioral1
Sample
27bd370c4017277fa59d6e7097ce5f96.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
27bd370c4017277fa59d6e7097ce5f96.dll
Resource
win10v2004-20231222-en
General
-
Target
27bd370c4017277fa59d6e7097ce5f96
-
Size
584KB
-
MD5
27bd370c4017277fa59d6e7097ce5f96
-
SHA1
1fd358acba58d297def475982360d39aa5cab513
-
SHA256
e3a1e27be08157840547255d8ef5e031e1c0ec294a158220946928bf86c6429e
-
SHA512
cb455ce512207a61e06a1d00b70c58c948ecddf3b6e1f894cdd1624e14a86ef7731a78a30cf785e0c7bdb71d58b3aa0512bab1079cd6a778c727093c8bafea3b
-
SSDEEP
12288:Y9zPyrfpzNU9YkpiPaF6vxWXXWHV/x4xDIXp8NdN4HR5+0hk+z3aBRP:24fVi9npJkvxWn+VwDIXp83N4Lh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27bd370c4017277fa59d6e7097ce5f96
Files
-
27bd370c4017277fa59d6e7097ce5f96.dll windows:4 windows x86 arch:x86
b7453002d91c3b776a8d8b3514fb47f8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 466KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 572KB - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ