�:N�&����j������\��۠T��kvyub�����N�G�w�����T�f�$���l��J�j��k��Xa*�����@Zm!���F��`E�v��������?�0���(��]��3yV��/)83,v��w_�a��ᕮ��ps�������y'�ϐӵ]xyn a�QPϦy1"��(��[w�e\�"�X�E'd&�v�`E�t�Ջ��J��Q��Lo ��vC뢐`mJ�K�f�vY�V��U�w�Uf(T��ǨƲ��wMP��o���<hN�VW�]��s!���m5��Gd�˴[z����K��X$�����%E�KZ�# �] ;A^�BG�̙�)�+<,���C2+j�7�th�aV+�\ t�����Tr�5VisXl3,#�zi��;?/�n|�{��"����^1�_OO@�m+�_%䀯��|���%�r�IF��>� f�Hj�`-2�"f�X]U��i]��嬩SkEo*ft7�k�~���<��{�Cb��i�K;L�&�*~2���\��bZ�5�$�`���nB���Y�=��]�������kk��'����DY�w��(qŘ�$y�����M����k�-��+���x;�(��庌`��f������A�R���E��b�!�%�A�|R�rZ�y��]sQ�_˼=�#"��di�3�����.�Wr�����l���hu�/�����x���Ż�.9yԽ"�@��h%M�2YPd?5�/�@���[G�M�ލ��h{u�~2N.���c�C���FL��s,>�Jk!xo�^�C6B�J.���� �Z���� @����V�ڕAU�.�z����#3�H�!��?�����K�`ɝ����%���ƱHS��2_B�bҭH%EK4���~�7ϼ�с��m䢑Uo���6 ����l���VK6(����qB�H�?�Iw?>˥�Jܓe y�rx�Y�h������97Clg|�R�֒��gXʟ��bЙ��.�B&�i[�#����^��@�&Ȍ���w��;'��$��}���2�����JT7 v�S,��0�4���O�f����Xx��v�N�lD�����!�[\y`փfa�R��:5��(��^���*�+�hNs���q���AZ96�.Ҧ���Ӛ!_�`̱����jf�G�G�ے�&�f)��X��S,���Ae}<p0�94��A�Ӗtk��L|n\0k/�sb �n{��|i�!�������3�ӊgX!��xlsJ�<"����~�j��b�s\Xn>��Q��x[��6N;f�lp�Q%�����&�6H%-��T�26k5lTI'G��6=�J�[�0z&&{�p�������D7��a��/$ E$����v����h�"����Y���)��5L�U�=@s:̍ ���>FD��<a��Ar���&�;Xl�f��zحg�1 �8I����M�55�QY^7b��M��n��zC�VQ ���5$OJ�K�E���� ƼVd��>P<'���zA��P$���I��Êm���(A�?�U����W�~��m����O����@|G����1��V���#��t"�o<�5Q[��,�� ��W�=� � �����r;�9����ω~Kp����R��e�Z����Y�S�=Ypm�m�)@�{;2��$0*�����?���)���=U�ƗTX��,�P?��[e �����@�e�`?�IZSX(��#W�J�ɀ˲���8�DO���c催.c�T\b�[��F��wZ@ V ��������I<<��Ț�<�N���^��W^B�-w��vϪ�i���L�<�h��,HV�P�A/)�iL�5��Ȳ.���t�ϵ�D~�3�w�"q�PT����E��af�X�s�ѿ���+ȼ������_�3ˁ�J���?�����õ��OV|TN�_:�mDO| �pzB�R��K�SPq����W;h�Y��o�I�9��-��/��SD݁S<n���ũf�̞�ɮ��Y���&�z�@_1��T�^տ3,���<��X�C��������̇��o���|>�_�������tG��7zG�8���z[F�!}�[1�i�=�]��;��((�hw�2t��z_���������8<^u؎}4��$�q|�̡���*N��g����++G��Y�[�XG��s!&Q3r��X�VO��W��]gD�0��5i�X�F��$N��}�gP|Ȟ#*��i���z���7�_�E�#�cȫ���c\��� L��'��(��&�$Y)�N��fh�v�+H��c��727���0����X ��PX�N�T=�8|�%|�`/0s|A6�a"w;��od�,��#����c�r��/^�_�t;�пT����<y��\�?�pv_��pN�����ƅvI�>�Xg���.�26b=DHd�Γ��9�f��<�4"����6�� D6�y8�<V��N�P��#�\$jD�I��Ct�D��͢�/-퓯3a��Ȟe@H�R��Bee͘�c�P���`��W�VG,�{�I|��C�#5(M+�:���UC�=���17ퟵ��'.����tLsc�ax�^�O���VH���~|�lz� �ԇ�X:�%>��8��`�m^�q�8���YCs#�@�pM$t�?~+�]��N���K�ft�e�W�3�eti�S�v�qs5{�����1߀�)ɐ:�֥��V�{����d�C��?˻��}����\���[;���+��d;y��D�� ���ln�G;����K���Vz�^N���bȶ:�$u'�2v�y�}�C�kZɍ�Xa����I�V���}B�o-�B4� ���� ;!���z�T��{/k�$o�.P�{VT$�r�)��U){�D�d����7��0�OBØ�S�jp��������X?��HR&�V�����*?BMC�f~,ڌ�i�����0`l�Sr��i���p�E���J7��kO�J'R�*��E� x���L+{��C1�eP������O(����9�.�R?�t�'�!�����o���E�h�51v�uz�B�A���+s�p�lj�1�����0����ۑ���_�l���og�E��� A�Z#@M_�Q�
Behavioral task
behavioral1
Sample
36753b4e0c6f797e3dec502350619929.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
36753b4e0c6f797e3dec502350619929.dll
Resource
win10v2004-20231222-en
General
-
Target
36753b4e0c6f797e3dec502350619929
-
Size
6.3MB
-
MD5
36753b4e0c6f797e3dec502350619929
-
SHA1
cadbe1ed88d23a44ec0655e8a4a5cea644435108
-
SHA256
d1b39b582a79fc52b7d49015c757ee747fddcfde0c16441b68bb5e72dce8ceba
-
SHA512
96ee897ba371b7aec68e4604845bece5bf79083326724f6840525412e823b0e11acf8085429f6cf3c65b8868f8df3f1e15efa739701a1163ff2af1d4b8c9d95c
-
SSDEEP
98304:HIXHCYrOtuZGHlQTCZOWE/R4HKuZYAp0ctSrdXzaDbq+VGPtmr97/vXE:HIXimOtu+LGeQAqgGgNz57k
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36753b4e0c6f797e3dec502350619929
Files
-
36753b4e0c6f797e3dec502350619929.dll windows:6 windows x86 arch:x86
2f0c34f2698f6e1068dfd50a50881dc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTimeZoneInformation
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
dxgi
CreateDXGIFactory
normaliz
IdnToAscii
ws2_32
recv
wldap32
ord30
crypt32
CryptQueryObject
iphlpapi
GetAdaptersInfo
wininet
InternetCloseHandle
imm32
ImmReleaseContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ