]"��I�X�L�ҶT����ra�F���Z�4�V��݂G5$��W���Z��5| �� ��j&��i̪̠+��e��*�8M�V(���\�i��6�6F�wи��f��b�l:9g�5�ުmijf7V���5�Wm(�l�W�e���@HG�2����{��-d,�:O��.�0��(�4�濾�Ȳ�k�rs�O��������r�8��w��O �|u�.Ոep �X�#��b$qR��"��R���j�Y���W������a� b��Ě_J�"�S����g��kl����lv$K����iMM�?W1vs���6�!��é9�EҦ�xj!�"i��A�,,|k���l{/��M@1�Fm�H�1�H�$n�{bېQ���GU~@X����a�z'�U�?>G��d��+��`Ϣ�<��$�dw�I+k�14�ͨ�֝�p*0HC��M���-�WH�҃Y�%����������Y��g�=2w�O��� ���dz��(.HT��cյ�O"GJ��@��ѱ�I�3Z���!y��T �$�IW���v/����������9�ǒj�ݎ���I�p$J� �#㻝�tqW��'���f��?��r�F���*�����=�5c�0N�>]�%�Т��h3F���s��'ts#|'|+O��f������=d�3�����g�̩���$�����DL�Mf�E��������[̞���9�j4��C1�&����y1H��x�ۆ���]�4�b��v;�1����6���:���|*�\E�=�W&z�4��j���e�B�� �9��aV�j ���F���J�����#k��R'ɀ��j<4���SI�h�P���_��}�܅4��;r�R;��}�n���$9��������R������&h�$�u�����]��T_�ɬ[% �R/�=x�t�n�W������ŋ9��uϾ sCq�H�F�aa�2w 8K�MR^�n�5֯����[nņ�`h�].MSvp�C![���7o9� V������J�x�vچ�6< )F6�i�Y��H���E�vY-�Loi'�c��-*]�qs����i�ui�������{��Q��Ivcp��a �Bf#~2�bUn.��Ő���h��ц�=dT]+˅g���ZY2��{�̑�?8�q��s��'Tb1��Q\���S:Go���B�1�'�Z��x�M�s�AEo�~-��s%{�c/I�D�o�>��s�4s���T���*���~�<n�E�h:z���yc>aLd�������}@�\t۞���,9�Lv#>c!,ͱ�~�����s�@�����VM�3��|er۾����&~Ѿ�� P�ޅ�v�{����H�����W ����]���2j�}Ψ��n�e���� �6J�����8|��a h��>�� ג���h�|�b�,�X�"'�(\j��_N�ZX��� ���cbi]t��~�� ����m���b�*_���q8"re�0�9���p��w��y��O띑b�g�-4+{�.��W|z?ejw�y�K�7:�2a��2�#�S_�����i7S�NfH����.��R�c_5�~�_�m�f���>B']�B����%�p��e��1�9T������������V��D������T����y�nk�`�g���O�����q�YևQ�$ؚB R�a:֏'ʡ������ �f�<�i�C���1���n��}��ˡߋV敄U�L7�ڝ.>�G��5z�C�7T�QthQ��Xu�$�?xj��Ǧ�m��[[ WuT�rSv�*U��8�:�$��|���w���W���X^�����S�7j��X�9�L�'?���dG�Pb���{��|�0�^��u���Lo���)^��x*����dA�4r��ㄫ��a#�nq����. ��٤\����Íu�'^��o�����$�&n��'<XR��� ��A���h�I��ʐ�:�T#�q���p�嵴��P"-����Vg�]>G�����h���"��"(�T��寳>�c�-������1�7��|�"k)K+�Aw:(���k��|��Ϻ���b�9yG�[]i�>D�|���JA��HX?�!�u���;��<�Զ@��Y�8��M��S��S�QƋT�)���v�>������,c��|�O�q��}k�Va��*���,�7�@�~gt�Y��vI�*�I'��kaj���}1\��$�V�� <��=h����@�21���͔��-C匕�ȏLGu]�v�H�!��i`.�u�I����������am������ꠍ4"�CrVQ�Ɠ��r�8{v\g�M>'V��j�4��9EJ ^��h݅�����kF�%�=�B��?RhR.�����:�C�MJ�� :|�X���!l%rE���s��FO�+JUX.��t�f"�<�m��&�&ɜ��Ĥ�R �=�@�;�d�H��M���98��ʭ��G���5�E���Z�h���B�rH[���NJ�U~"H/Kh�B2 ��_E &������9����\��z+ ����sy=Hz��6ܥ��f�||�:���z�2�6�lf�'<Fa��{�0|g�=��h�W��WӉ m�N �]D���$'ų���M��H=J����:�9#G9:�vT7Z�,�P�GYkMy������ٷip ��;<�n(Vu:c��vf'���Bdpt"E���[ɐD��p�� s�\X�w��]����Y{���C(�σ8Ӵ&���{��D=J_ڑG��Ʈw���jѝ'��饨n�glU�����܊���}3�Q�0"9)?�ټn�ML��f�|+~�|a�� a~��˕Vǃ�z1�J�E���/]�P�O����V�+�&�no��_3e���=J~��c �T8�g��)�"X���L�WI<��l_6�3��c��2�=�x5&D�,L�V�$�o`���a����&:���(6�`���k�a�/7?f��93��sC�ф21�^�#z���#�?��I{[�T4�3.lb���q��[n�2�L���a.gOe��b1
Behavioral task
behavioral1
Sample
b48a62ce858c5d8b3962a56404ca0091.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b48a62ce858c5d8b3962a56404ca0091.dll
Resource
win10v2004-20240226-en
General
-
Target
b48a62ce858c5d8b3962a56404ca0091
-
Size
159KB
-
MD5
b48a62ce858c5d8b3962a56404ca0091
-
SHA1
bfc358e5a9aef3a1a79de3c616397500d7787a0f
-
SHA256
a35f75e7be59777ca1d188e5ec7371cb491ec8a5470b353860a6cab02aa05f72
-
SHA512
4af86ef63539090a0bbdfbdd4e7846b86bc5b4ea916266d028403b9e0a25e87f0b78ae19e80c2bfa85301c807c90a3bacdf8d505a9eafa85214eeddb0dc554ae
-
SSDEEP
3072:zQdhvHZzlrMHeiRWmuuLhPLBIS53lqp/6F9iipbVQEoavUb+FS6zncM0:8dhvHhlr1uLtqaEpyFVdVQfySAcM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b48a62ce858c5d8b3962a56404ca0091
Files
-
b48a62ce858c5d8b3962a56404ca0091.dll windows:5 windows x86 arch:x86
f96b2271b57f8ee2c2d37d141198630d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
d3dx9_43
D3DXCreateFontA
msvcr90
__dllonexit
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ