�.6��qAƧ�� �����q�S�߅� b�ی�+q����w����i����)�W��O�[���q<�������2�r���ܕΨ�д<�F}��rp�p��O�ԧo+|�Q��pP���:���ŝO�L�a�z�Fb yyG�L��F��ngE���>���f�{�G`�^I{�-���J��I9>]_�D��By�@qP���)�#%��Hp9=�ϋ)���s%Ӳ@��P7���������T�U���QN�4�DL��Q<���:�2��7/q4m�������*�R�������a����yT�+�>1�8}�T�����^��1��]��:��@���#�CJp��D��z�g���aW��',����;H������oj��K�8��1�*��8���|sr2��:�����^�q��� �j����B�1�!��N���)�f�3e�%W�R����E�i<x� ߩ��s��K��@���r"�:�]J���ʂ�]�tv*�H��vM}hڞ&��:� �2�^~�7 i��U�R�Ɲ���c`u�]�����F�؟���=�6� T�8d�E\�xm$���9����u�ϩ7K��?/�b]Ғ����2G �;�~㾖�(�<U:nڛ�Ĺ�^x��_�R��� ���=�AC'���Zd��?jgBD��J=ߣr8����zebf)�'��O� :�,$0���v{���`c��a5��F�/K�*wLC9^�����m�d�t�}��2���i,*�sDn�&����SA�сp�e�jm�҉&lj�J�R6PQ�Q���b�8���~j�q�"�0vP������t��A����Q$� ���P����ω��i����$~�b���%f^��L�r��PB����� �����.H�X���[�H�4�V�K���i� ��r��7Q)p'.��R)=�*�]<C���?s �RGu)s�OQC��_﹝SX��1v��r҈�&�дx� �&Y9 �E�*���;��$QA5��xu�^��ǹ@c8��]�-%���4W�?�NNn^�!��J�#�0���`�Tr���$6k&\p�5�#��!8���%X�).� Z��2�XNgr�9��5�T�y����B3�7]Ŝ1�*g_��;AB�p�*\J��S���N���Ȓ���@��Z���O���*�b�u�u�i��7ǔ�G�I���x�o*A����#Z_�ھ!� ��&�T�oT�Wsq����Ge�*���l 5�(�}��-�:�@�y���r�ݱS���0J�#%g�U����D�&�!:.���S���v|y�O��G#k}y���`�G����qxq�$���E�4�2�r���X�Y���P��"u��B�W#20d�n�E��{�!�d� �es�Ϫ�I� Lb u����M�a�qϒ,z;E} cm0��z0�8\D�H`JF��$cɩ����@碐�����cq����a�?� ��]�����᳘��4�r^Oz�X7/���ރnLa͈���o���]#sZ��P��Z��,I��ܸ\}&����<H�hw����WMs���4�F[��QN� �b��ߎ��5s�'5����m���"_*�;ܖ�k�l�e�vβy�<Z�Z�xDZ��y�(����X�r�������Yqq�f��o��o���5���X��Y:U��&9��:�J���4DU�IQ[�B�e@��1������(�9x6��z\��t��?��ys�6�N�V| ����sf��ߣ�_8�Խ�Gr7���0��������(�#W;��������(rT�T4a�����a4�Hwg�Ū�������q7b@���1[�8�E����vc��uwXG�2g�{�҃m���}�x��� [^�lzSL +��}��'gc���Q�9ˀ�r���q��ӂ18aЭ�Z(2|��÷��x��3S���w����X;��I;��h2�����O��`�X��4zD,�#�����5F�����t����]W+[������T!xY&�o���j3����n�#28����G�rߧn�&.K1vsAIQ�qW�Cf��l��uFU9�e��"����1�K���\�Cd�jbL�3v~'��i�!Y53��d�7��J�M`7��<*,�R�w��(4`w�l~����~��k����,-��F+hk︕��\��ڿ��P=Q�:Þj��L�O��ݙ ��Ӑ�,������XU#3zZ����{8�+:bg�)MU��&B��w�tZ��Nd� ?� �]�Gm����K�d��G��`���h���g�<�"�o1us٨�E��5pW{k\�(��%F|����pO���`�t1���֛0�e����a9��Α߆�L:3G0�P�ߋ9f���02�[��¡+�w$�}�ػY��E0:i"N�؉��Jc�~��\��":y�ԕ�@l�1v���"�H!CQ�(4�*F�y�8=(5Eɾ��2 ���B������SAMR���E�W��������{gΎIZ&"֠��o�3�j���u �������?�����P4A/'F��܅�VHr���ђ�q��v��t�G[.��KeGl��U���z��-u�q� ���âFT����!#��t�-m��&+v�i�S`�����ܱ�7�9)e��vP��>�L��`� �bK=fTՈ� Y�o���'�axJ%�x��K>S�Ѵ(%g��=�z�,�vnx�`�ʰ�e��o�V��Ŋ^{D�~3���z��1��͐�5���З}TỼ�m �6�`B�M����q8F�l�ɨ����\WUD^��4#)�[D�oj`�|��<�d�$���;�Z�|SŗƤ�w@���NLY0�фu�J!��*���I��'�>�eN���=a)�*..��m������`w@ �-//f�%?�b����|���7ҍ�E,p���3�0�,[_ 6n���Ƿ���Vt�{,eÅl��L��4��x�ǐv\k]��p�s���o�ی�tb��dw�C�2�l��u���o��@�0kI�p���:}V�����Y���sԐz�U�f<,��<�
Behavioral task
behavioral1
Sample
87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0.dll
Resource
win10v2004-20240226-en
General
-
Target
87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0
-
Size
1.8MB
-
MD5
8f06223c2db81229bfea36ed7c8ee96b
-
SHA1
3163f30935314359cfacdd11334225f7f22cf9e7
-
SHA256
87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0
-
SHA512
c4f28ebb1d115d52cc04c8be49872ac42ce505a2952df0c8dfbd5e5736545f34d1fc44effe1374ff97e14e88e44a5215a112d658275a6bc20c6addcdde395418
-
SSDEEP
24576:kjpeQTfqwjEogOIINQjL1kHnO3kFoDCLkDoNMAhIbYYJA9lrBxCvaVYuiYmkCKKy:kdeQTEhb1kHnFHSmrj4aJiYmkWHS
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0
Files
-
87901fa4013575aa9208fa5d325c180d00c462779c7682b73b7f6df93be919a0.dll windows:6 windows x86 arch:x86
760656dfc17ad89eca19046fa71db53f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetPrivateProfileIntA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp110
?_Winerror_map@std@@YAPBDH@Z
msvcr110
_onexit
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ