Ve��(��B��<�� GC,b\����UqM�j�s�$���M��q�D��:w�rP.�f���W�fa��]�=�@����� ���~�P 42k��8�� �e�M�ڴ�#��hP9�W`V%�ڊ7)���ǟ�*�W�������5�tښ�t�[=W����ɵM��>Z?�u'.��y��Oz'���&!Y�?��V� wJ��O�Қד��@�����'졏f}�穻_� �`dw?�Ԩ:Y�g9���~���c��L��J��aw����z�q�=-�9��`��ӗ��礪W^b�{�e�X>>�C%}�n��o I��>X�\-�i���@��Q�ٕv�ߘ��Os��6o�FT�C���@U|8�D��\�;E����z��\2��&�,��Y~I�l;S�C���>i0�eGe�5YX{(<�DŽ��F*���sT<k�K�hP#���Fz�^�>`�J�q �`���.�Pȝ��A���#�j��@8PA�����F�.M���B�s��*�zؤ������MT�%�S�R�(-a<SW�y@�&��yS�J�Z��yɩZ>����M�*���)渾:���i$h@έ6i�H��� ��7Mrڞ��t����(����$y̢����Jɪ�[ JHo2G��܈Vc;�A��q���q���لӶ�zٖ�i�a/Y�6�}��j�4{�A�5w�X�n��鮓']��$W>g�E0*ڣ>��<P����d�G,O?�:�� ��aEw[��E���d�7b��Y;�D$��j:Z3�u���!�HF��&S�V<.�Q��E6R� ,:��4L-u��w �w�5ez#���6�l�3|�I�8�h����*Ȼ�>U��7W�� �}=���_ �҅�p��ePH:������p<p1V\����k��3�n�$-l������ �T�Mƀ���� jj�<n�_�g-T��ι!�y!��1��Q�ȁ��D��S3ww�e}�\�$�t�O�?��0��5��-{��:���� 6'���� K�R�ۣ֗�8� id�R\lZ!|-��ZvN&�:��t�T�A>����g{��T|_��i���\��今��۩i ��8��O�"�}�t��OtS�'!ݶ�+�N��|�%���36���w��0�n��=`���fP�t����9a�?���+�%�7=�}�9r�wL\���E0�Âq?6!���y�֨�����R�>��mGhp�C�4ԟGh��Zm�a�� g@�>��\5%S�qE �#_ƞ]gƴ���?uGk#�q� ���i����hI>�j���b��8,8ӣN��\8&�V(ϖmbp;g;&�/ �i1��������DB�0b.�i��rV!���'i�L���}���B��Z��J���j��/}hk�w�h ��ᐸ�愲�Q��ۯ�K׃���4��?}|����d?|'J��J�_4-ͻ?@�{�W+~m"v�W�4��+(É7������%d$�����-�h��˕��z.�05C�xe ���ć���*eruF�E�t�7Ytc��c ��i�Gs��ޞF�C���!�*w� xI,�-��K]j�����9^�hl�� x�S?w��|\���LZ{�iMo�J{�#����V�LmzOgV�H�9�o�V,g�F�É�|��(�|�[#�CˎҀ�ib����SY�;7į`c���y��ʦ笒����*[��9Ȏb�����E����>&�ަY{F��F�<8K�yu���Y�A�BVi�|�T�k�v�tC�A9R:�Lk�Pz�Fv��?��Tt��c�KY�,�`0�p��(OK����ߤ�R`��jk�g���)M�{a���*��(,���b]�ݿD��&�����xnղ�e�ox�y(�Bi����h3h��7�7H8L��4��)�@�H�4�[�%���@ ����{��7�e����o�N��~^/5�Y4��=��v�zn?�K�a+RN�u�̿��\��n�\�*敺���yE��~d=��<��pwA���M�@��/5B����rh��+�:���S%��l�n� R� @�jE�+(oˢ����h�py�Ũ�G�3Л�Ĩݗq���,��#?RG얶(�+B���o��F�|!�� ������ k��@�b���CP�6���r ^��lr�SqG��<e��{;F�:�i��sȍ����� ڸ��Lӕq���:T���$o~0�ld���*C��W�����3Ϳ՟iЦl(:b��Q���2?����芏 ���F���[����v*���%�x2QPjL�P/��X�%z��2��Q������mÅ}v�볩�g ����X���8��*�(:���nR��JY3�,��{���������L&�Qt�vs/�'fR�#A,���2S�[÷�%�{9�Ku�h0��H~�»E n��J�� mJ[���R\F��O��&�_��>���J5��;#*�+�����!#��_�����زU�c������N2-��0�������P���:�ùp�q��I� 1�ɦ�+�|`J�x�D�t,V�撺� f^C1�Ӫ~'������ٸ.�����;8�+�3�L3���/�j�o�`������6m����%�86q�Q��X�Ʒ��ʿ��b�P�u�D ����z�?�1~�:�)�NA��?��\����2dg��J�7 � %��!�)AFr�~ʵ�Xr��-C�tk�:�?�J�X���m�?�^�_a ��RJ�Z]u#�m.�� ����+�m[0sn��9E%z3R(�E�ꮅ[FE�~���U u��)_��U7�'(4as�p �v���{z1�\� ��Qh��`,!x�V�t?��B�gx���/+�. �}yd�LW7��$[�<���s���2�ײ>�#I���t����윎+}�IC�>ފ��#^�噀�Y)�� $�"g�����x®k�d���ew��e�0R��9 I���2r�6�) A�In��wu�7�!��؉�@ -6g��Ѩ�Y��2 �Y���<l_#��u�D�N+��ǖ��]�����Q_�B� +U�m
Behavioral task
behavioral1
Sample
4d4e9c505db96c081dde9adfc757feec.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4d4e9c505db96c081dde9adfc757feec.dll
Resource
win10v2004-20231215-en
General
-
Target
4d4e9c505db96c081dde9adfc757feec
-
Size
125KB
-
MD5
4d4e9c505db96c081dde9adfc757feec
-
SHA1
e58b5136189b102f09d8a6096d109de1233b7736
-
SHA256
e712e59ed1df9297a72b51613454370d0b026bf9c9384f57365a8f667716cdf8
-
SHA512
de3781fd82bd786d46e3ac0746ccde92c95bb8bba747e69d917d1a05793dc8e274e37ae5b4ea52a2e4ff47dd15f60214b589bc51a84d539c99df965566f99f80
-
SSDEEP
3072:Jy3pFkIkLA4bXnriExVCrxApzZsz5EpXuig5mHmO+:Jy3pFkI6XlxuKp6m5+mGO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d4e9c505db96c081dde9adfc757feec
Files
-
4d4e9c505db96c081dde9adfc757feec.dll windows:4 windows x86 arch:x86
f2b60ec23c9e7a56f3617ef7bd6347ba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
MessageBoxA
MessageBoxA
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 279B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 172B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ