����`�̀��� )��(����g��7��C��*�� ��]�Y�ҙ�ri�I�'�1\ :����mVn�i��#� v��3W�k��fz�P��sZg�I�6d��JeC[sm�b�TsT������'�=S��N�����`}�5�y��z,Ѵw�!�UJ��c��?�%?�?�a �ǭ�ȩ,�&���P�op���@�,���Ӝ4|t���c��fa}8+-�u@��!)��' J�Oo��HNǛ���|Z��Ľ:f��$8a.T��6�yMv�B�����!b���~�ٲ��8���1R��کUG��L~�="���0yf�[�ޗ���7Uu��m�>�u�!����z�N�:P�d��|ŝ�Au�}5��gX�Y_�E�&�X&�X���Weq���".�;��悕! Q��' # Q^T�?�� �����^,Zww\ �NJ��'�+����;�������� Z�G�i���MX���Z�4��e��+V���ړ/N������Mqv��O>#�a�Р<�DYc��)ϝl������&\j�`;�G����:�N{�sQ��?#NY�em����̫�OoLZS�I���o�o���U����� K�'aD'�1"~�& ��g��ps�t�Ŕ�s�{7X^�Em�ْ^)������BH��5 m�d�^��ί|S��V�az#���3Vdh�FN��]؊0V�z�9f떉(�U͕���G�}�護�@��Qi6��������9����X���D��]�b�ه �ݦ��]JQ�0��qUY�%��~���>]�>W�r��vY�D![p���������ڒ��\�f$�A�����i�u�#p"th���ۄ�d�6}�����x�őß�!�8�1�_X�<#��^�Ɣ�y>���������4�,��頼7h��� f�%��#�{5��O�P��������m}���u�Uu� ��>�LYs��,���u*Q#6���@��^ J���$*��Ϗ�:�.��cp�Q���=�5@����̨������A3��fH�E��kxٲ1�O8� �=�~���->K<�G��$��ɩ�י�������%{�Ӷ�!=��=���5ƭ��~^�6O@�z~���X�=�[n`ݶ�$J1"��靹@�P�Dg�����-��� /�I� u~20���8�E�T��a�{Lp�3��vt2{mj��a";���v�ɿ�'w���Աci �1=S�8�M�����8 ]��1�+s�:��\ܰ���8IxV {��Wevc���[��Y��2��le ��W�u�`?�C�b)��J��据�'��sV����[.�%��˗<n�Wb'�-��<� e��= b�j|�;Ս&�Y��|f9��K�Kݐ+"�SF��B8*j]�㔹�ʝ$>���b�M]�b�'��r4hOyV��x(<�0�s�X�����r�������N���d�%�+1��'5�uf]��g�u��1�U^���R0���aĝg9��z�������G���D�=Ҏ�qsS�� �Ď�U�BE[�''�Eg�^��#7 �~�<d�W����g`�ڳl���> 춈DM�u��yp� \�2T�����Q�Ǝ4�P���1YU&B�Q� V���z�8���j��u���$G�y�v��qf�^�ܔ�Fw�B�՚c' ��D��7�Z� � w���(l��� �R6��B*�.�m��5����N���cA�a�d�yu3[����������g��=xӍ=��^>5���5�6�z�p�KC�� HUJ��E�xt||�w��/u���������z�=l�Hl���tQ��vJ�f\x��Y�,�����k�`�Y�ea�!=�D���1k�1H̳������?[�z�Q�c�n����@��>����EBԽ&�r�OO������G���yF"ѥ�~%>�4+ƿ�&�O���z]��Ρ�'���G�gz ��ܳ��w�#>�s.�����g9�e��M�$��s���clGK�����P�>�\C�G��|�X�u@�#��q!�&���%h�$q5c>ʦ4�fzx=Wq5�f��Ý7��+���Ywc��((��M�M��J�'���8�pU/u�bA6$2��x$�E�^]���DO�r'PŃ���Yp�r ��|���]��}��A*$o��Fk�r��3��=����{&��ۜ��Z�4��Ջ_27���_4I2��-6��T��.�/�)�f?���w�A(��P�.$��<��[�Eă�+�=(D]I�`]�U�_�� x��� ���J�w���b.���yƅ�<4p���bᙸ,�O'��SG�z썒/�e���k2~�V�|��Q 1qKu~d��l�O��,�MSH�H��I�V���V�m��O2�;1�����>�.���DOhv����5"g�\����:g�(s@����ⱟ�y���������%[l��|�ڦK}����)�Ô/�{��G~�w��㫜Y��N��%�ܸe�H�U�L�~O3�.j����b%[9������A�P�>`�u �^��n}��1D���� ��>(����!��k7� A�B�ry�6;�!��ք';�O�}�������F��Н-�L���p:�_��'g�3_�,�Ϣ�R���U2CS_��F$ �S{��b�9H\G�#>a���ZFӔ��Qas^G��IzG�2H����>��րNX�uX:�5U����w�TM����/��(��j,����4M��u�YT@�k*�����=?�]T8M���؛?M���������<�����Tj��i c� /�Q�Ơsٸ��-���b�]���w�H��U�8%�W�zQO����e��&5,ޤ�w-X]�ó�TC��9�I��Y�9��W>tO�F�+�j|y���Y9_�t �~��>� ��d��m�E�s �����P�Ȍ:ū��5=��%����y���Sc�Y{��n���ݛ �,ȩ�g$K�'��.E��0�K� ���I&�_X�����t�$ �X�����'� ~�.�Ĉz5�+"6bs�ܲڻG4�6�N_�g����������L�
Behavioral task
behavioral1
Sample
9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd.dll
Resource
win10v2004-20231215-en
General
-
Target
9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd
-
Size
5.5MB
-
MD5
5152dccde3a7e4729c7c0245c429a855
-
SHA1
ca1bd5be968d356cdf26861b4b097e10670a5c8a
-
SHA256
9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd
-
SHA512
2f2b21a6c9921a856471475d71c9bb3cfe386c8d5bd66116dc68c24ad96c8e9c19597aee3e57aac831d8c3bbe9b6557798f6feaa16cd5c1e84339e69b3998730
-
SSDEEP
98304:kNrhJo9j+46At0tDinZiE0aa6/zv9LWThFfQmuTeLXDj4G:YC+5tuEERaYzv94hVKeLDj3
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd
Files
-
9444bd6f336a877610feb7686baf282f457431066c0cfadd2227a972ab139bcd.dll windows:6 windows x64 arch:x64
e1c053e1ee3242bcd1dfaf821cb06263
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
WinExec
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CallWindowProcW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
winmm
timeGetTime
msvcp140
?_BADOFF@std@@3_JB
winhttp
WinHttpReceiveResponse
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
atoll
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
_wcsnicmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
roundf
advapi32
RegQueryValueExW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ