�n�Ӵ@� ��]�\y@5�.ђ��'�h�Y�ciUN�w���m����$�������>;��S]��d�7��-RJq��]�X`�&!w���2 ���X�Hq�(��t1m#��M -��7�y��� ԥLى` ����DW���=xUr��8Ӑ;�@`���D�6널�����~��+h;A웣7y��ڵrroG.�b�[ʬ2���{��5�h`8���')=Bz��V�+uC1r��\]uó8�8j<�^����֘t��Ezϭ}��q��ƨ�sZ�U�db�v���jD�0������Q���!���?��/!�ߔ㦉��� EC�r��K��]u�L�p�R?�F���"�j��e�����@��uM�IлB|C~�j��F��ޘ���6*e�1�䛤9��Pn�a��Ph;?��f�R�|2����҈X�aa��=�U>�k�Yb�ju�s�<F��r"ݴlBD�|��Q� =��g��{�Nh�b�cI��"K��=� �o��2qI��q�B�Q�[�(�R�Q�U�n]��[{�����4��i���I�ؗ�� 9� 3Z�� ��g�rP�m��-�0��3W�'��]� Cn�� H$R>ü9��h5Uu�;��l�_(�D��������� ���"m2�U&П�r"�q4E��ϴ��W~UL��a L�c�tHe`�;�:;Ek|i@���'wK�x����a��?����>�Q����ɜx=$�l��YN��*w�cJ�`�D��z��RT،&���7��`��%t�z��`L�ߕ�� ��y4Ld�{����]��q��D,|!��n(�d`���1t����3&��F.�Q��FQ(* ĉ�d�c��![� ��+T��KwkU���N =ОK�}�}�FIL��́@a� �����~����7�������%|�Q�LY���l�K|��mH[����?�;e�2o8���y���-l��p�j:��:a&���̏���5����힞MM[��+Q���w��slm�t�� �V�<N.̉�� ;ʒ�h���B�%$�m�른�A�g�P����m�N3�vLB��ɨMt��&뼠 n�����m��/��@�b1��j@�k�ʹ��'��O���}�o�:E���PM ��*P���"{� 6��N��T��͈C��K�>v�����y���EL���"���h�����MnFY�5/8o�)�^K\��R�܈�u,?��������4ڡ�+��g���;��x4dJ�:���ㆢ�nQ�3��(�Ș���X�<�s6"�،���5���^Q���~�z�Qo������`?T���D\rP���/���v�u�����56̦�-;���!w� �f��"REL�L#�G�l,�D������O����͖�bn3�a^�6�x�b��yԣ�����RC�gȤ��@�H�RĦ� z�t��<>�U蓋nc��<�Gz��y�9��^�V~ �w������,C���� �_X��NF����d*�3+P÷�m��~0���f��>e��=)������͠�g�q�S��X��ټ��U̘Jj���p�cx &�z���v�bE��9�T����f�[�<����5�TEw�\"��s�҄�`�M�#��9]�eL��V�/������ӮF��js��� ~��3i�M�,�0�p��0�᳒ߕ������S�*K�i8k��"�$o��pYiǢ��Yw����Eg`q�؞�iE}f ����5����%��A�g�ͨ����N#9қV������{������ݫ���_�������DY�e߃Yo�������CM������)�̳�R�(�hzS�1�O�o�\�u�Z��h�3�#4���s �VH��5K�1��HX��I���ľ�RN���fdŴ�'�Q����zfk�BE�2>��+@�!�� ���l��%��zA��,�)�����6��u��r�uv��놩���A�^A��S'ךϛ`�����'Ŵ|�8��!�e�|���Q(a�u�~O�����O�@�q������8cp:1�y�b&O/ 7n����F�6@�>�W:���#sd���������A�s��Z���;`,�r��ӱ[0oa�%����.''������XH��!���vq��Ҳ�6��VE���J��bkѨc{��5��*~9����7H~MH"�������u�W�!&)z��$5���E[�s)�K7?ƛˤs��N|�&Ò�5Fo��祣���Cvԯ7�7Yk�1�4���ң��e��B��h�2�c}���ܗ{}#��γGv����s6�|�n��� K(k�7�"w,����wq���i����X�D�mD�����+#��_.}oMf" _:�pyw�chI�:3�Mg�Ct8�vS �Ȭٍ>a�l4�' ?�_Cd���1�,B"O�~e��y$��m��H}"�#;s*~F7����*�GP��{�4�W�4`嬔/gI�qM�-��-�9����:�D���2ƃTea�Ě�I�>cD���k&b����B�N_���SY��CSm��B�꽂��*�[�V��n��X.X��ą����>����>������D@-%���X�OgS*�fXd�) ��xw8��2IM�w!����߭ y���#���P����� �kTȫoŚ�����)��o!��. ��f�I�`�ò=&��=��s�s~���*%gf)#QA ��YK�8�P��m�"1�uQ�t�iB��� n�m��j��ԣ@��%T� hDKj����5>�y~�P���R�q`*�O!x���ѝ�zշ�*Em;8z�E�-ާZk� �A� 7n�*b�G�o~�$���3���0#]2V���,1x�۶Ҭ<�F�FIFw^�ƣ'T��t$LL��Dy�4A��8��~��Ѕ~�U�qY���l@�[�cd �*�xaH�/l|��5Ϗb'�-�0�S��Iy�9>��1{�ω�d��X��$�; op���0�3���r}�T # �|]���ۢ<�@D�����ON�����U~f �w�g���uv+N$A�epB� ��^�I�
Behavioral task
behavioral1
Sample
b91f4addb459cb7eeb6ab917bddb829a.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b91f4addb459cb7eeb6ab917bddb829a.dll
Resource
win10v2004-20240226-en
General
-
Target
b91f4addb459cb7eeb6ab917bddb829a
-
Size
821KB
-
MD5
b91f4addb459cb7eeb6ab917bddb829a
-
SHA1
2c5c0e59e1673af32fa774057a9e31f48f6011a8
-
SHA256
fd2cc0cc7ccde258f2fab46e37a1041dda7165e36b41b662cb4d92e5996664e1
-
SHA512
6897082f6a14477da2cd19bc8127f1fb34dcd673fdb8ee6b462345b297af2c11e6a63e1afbc453b6df25f80a2fedd537b7ee0a430aaaa6d39ba56197b4d2f7c0
-
SSDEEP
24576:A12x5KWx3uYD3CPs3qJtqAK6iCkhzq5Vuqk:Ac+WP32JwAdSqLu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b91f4addb459cb7eeb6ab917bddb829a
Files
-
b91f4addb459cb7eeb6ab917bddb829a.dll windows:5 windows x86 arch:x86
7dead4e8e71c50d75e5472811ee7c7fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
MessageBoxA
advapi32
LookupPrivilegeValueA
msvcr100
memmove
msvcp100
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
psapi
EnumProcesses
wininet
DeleteUrlCacheEntryA
urlmon
URLOpenBlockingStreamA
iphlpapi
GetAdaptersInfo
ntdll
RtlSetProcessIsCritical
Exports
Exports
Sections
.text Size: - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 819KB - Virtual size: 818KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ