�V������ubJ�P�G�� �D���h�%������~�<�}?ư/�C��4��x����?�Q�-j}�f=s����o�@��1`vdl����B6U��Ц @���������i\��76�/�Y�N����xdII~wR�bS�=$(0�� ��]%��>3,�k�VWf�����@"�j���js�W7٤y��'��g���;��u��@Ӟ�ޜ��ɲ���P�/��f�ߦ����g�@�������rj�36;�#�������-�*~)�_n��C=tF11_��������[3]�3߅��������?E^Sj�`��! �0�z�X���ٶ2 h�F��^���*3*㖠�F��I�������/���2`���]���q��:�@S�{�{"��F����Ė� 0���F��M�!gO�X�n��c٬��uǃ��Lٖ�\�k�;VԿ��0�,u��?�(,e�!?�L���ŧ3(T�#g:P,J ��������P�4�KF^�]HL���ZO�����[Ռ���F�s�@x��EUY;�.n�c�����G��ByB Z��[cY�?\��s�O� �+��(Z��4���r�p?��j�۶LLO�{v�ۈ)�^��u:��g9���54XT�]�ϗ �#��3�V�L(>�VRqbxl��=`S��WZ��9��\Y�/��w ��=g�>:k�SZÿy Ė��y$%�Q��G�~/�`��C��p܉�y��E?�1~�䄡~���1����}I@z7i֠?�*��l\�=�f`����_�VE��g�7p�^8���p-d�*>� ����������=�oU384Wv�JG�������hl&�Lv*e�����L�z6�&C�x��r�%<}f��G�[�,r��^a��f"t�GAE�6��x\L��{І�C��b�s�a�{��--��H�0Z_�� >wUt1 1R��v�Qa�}��v�}�8�Ý-�)YQ����yB`�@�q��#�s�6c�����.U��x��Z-rZ.���4>X7<<%!��<j%H�r�����9�R��L1����D?.mʔ4@� �w����Ey��u3;��ܝ�����{cRU�}$%@ �X�,(͠ʣ%�VN n���`�@ժ�Bh�����W3�K��Y �ȳT��~���eս�nK���X�<4|f2h�܉�n��5�ON��=Ǝ.x���6�>O��Lz�-Qg*Zg!<f�>Qn[�mA؉�Plt��9]h�I!fB�F��~�G��H4tk�ՠ��$�.�A4�\V=xdZ;�O�8o�\w�wF)Y�V\Q}sͥa(���Ɉp�a�^��I0,�2�&XC("�NWbF=�#�˭����u���}R0�3 ��)*�/�f ˘�[�:nF��������-z���6��-4-�t.�|jmj�f44[s^��W&�~J��:#c?(Q�P�d�F��� z��BhT���Zi�n43���?t�?$rj}%����jf�}S{�b��jDyO������b��,�S#��]N�_n�u��3Mtt���L>�����/�4�~��Lv=����$�[�\> ���0ھSc4�I�C��L/C��B�S�k�*=�X|�2�X�PRO��h ��K6����Y��?��^Qݤbq�p!��l�l�q�&�]��4FS��)Z��\�� ��V`Z�N�Q.n�ʶO'��{r�%$��C網��)�d��9��"l�D#�-6� �V��-�b���`��t���ҭ�Q��)�� d}�xD6�� �� �p�� ����DŔ�\�� DjI>�x�#��B�܈XQw!�5]!S���@23dI*� B�0&����fލ��\>�~IkYL�!;h_hNհ������-�����q�)�x7�� <k9M�j =�G�|ߑl������G��j��#���-+vߦXa�Z�]~n|�'T������y���D���_ۆ���>�q)�;Cm6ס�ٗx5� ��|F?���&y ���b��F��#��ֈ�u���2m9[ X`?y�T�m���������X!S�Ro��xat����.�7}��{�7nv%���z����Q�kF+& �X�!���S̩c�Fؼ2��>���M �����,���2}B��y��Y\eS{�v�AZJ���_�ڽ��IUG'J/��X:�ޏ�p��-<��h�y��bSVV�풸���85� ���l����<8�u0�T�Y#���hlgЭ�)�4�#suU���g�`6�����g4wW����T;L �K^D��P�j�NCy�� n��y����ը���@���T�x��l��#�Ht\Z�$����uN'������_�lMrهc7Fr�dU���Y+���h̋"�����h������.�������NeU�d&�^�H^��:���$��%ҏ+j<T� ��:;�N��p��y>��n�5+_��.Q�xn�� �t��mU��H�Nܒ| �9^���� ���ds�#w�G��}�X�ߵ������d�.7�eEuZ97{6�d^HN?Ý(���1U��e�Q`H�g���S�#�$O��a� ��-���Ep�d� (4(]cE�0�����4����v�匌ΊW����Hxn�u4H�0f�<����-�9�:��q�7 z�����V���V����_f�;|�U�M5��g+YJ��s�;#��0��ԯ�$#���,�E{�m�9K;�N�X4!<�j�d�3�Y�3�^a>�z�khV~�\L��[���g�����儬��PRz�+-��w�*��5���H�^]��Y�R��R�%�c ]�FZ;�R���դ�����U��<�mzسX g�����yc�|�����ۋ�ɴ��}����֍��0��}hS�������2�}�-�"l��"�B.Gܾ�〥�ª��紑aʥ�K�qFe \\��{Z�T��ic�e��'N�������W��ߏB�1�p����n����0��^Wdu����2fQ��"�~Q�3��i -�F�q�L+T���[�Do�%[�b�����~�B{�$a��b�&] O�H���W��������/Ei
Behavioral task
behavioral1
Sample
98eddc0e5f40b7620a4253481936eac1.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
98eddc0e5f40b7620a4253481936eac1.dll
Resource
win10v2004-20231215-en
General
-
Target
98eddc0e5f40b7620a4253481936eac1
-
Size
116KB
-
MD5
98eddc0e5f40b7620a4253481936eac1
-
SHA1
ab70dd79b5bb08b57113a78233e2106d6548e4f1
-
SHA256
0315a553b1b3c3caf8acf35abcdc725cb453869a3cf6e8bf82a8ff617e65de92
-
SHA512
4f13369299cc013e9742685ebaabb74957274461cf7530b904cdba55698b3481b649e0e137d41600e23f5d81eaab26ce79189a86c0af5fc41770606efb3dd00f
-
SSDEEP
3072:n+YO+0RMaXP6lz5GMvcJRF2Fyg1nCZaW:+L/XP6ltGMvGR+yg8B
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98eddc0e5f40b7620a4253481936eac1
Files
-
98eddc0e5f40b7620a4253481936eac1.dll windows:5 windows x86 arch:x86
276269e240df9eaa6c4a19c644755a21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
MessageBoxA
msvcr90
memcpy
d3dx9_43
D3DXCreateFontA
Exports
Exports
Sections
.text Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ