�HS� ����=k���[�RlL�~��"��۹.'m<����lT_�dC)J���~�����٧�㠽"[k�v�h � ӧ�D�p̣�x��� #HU�}+�Ac�̅'������ D�8窓+�p�j�rW�S_�[�DVPV$��${e��ճ�M�IB�X%Xll2n8��L�i��؎����6�K���>����S;�.�L���W-����,?����Cw���y�X2��Z%�߃Q��~��$� � ��>��8����-t:~n'u���k�2PA��r�_M)ژA���*�vq�u�v%�����kn+�[f;Hg�����+��Ij�L��77!���e�F0����dY�K>[*Yr @�&t�%bZ$������@W_:�%_Z6�F�%�Wɴ��ȑ#H9�� ^1���$c\n�t �{���]���Ït�bG��nΎPU>��àȒ@l�m�Q�\��o[#n�Õ��5(�M'�X�܍�?�}���w:��-�L�D���K������6��� h�C�v�8W� @-94^��X$��k`�eL�:����y��@j��H3״�c65Q�}�����$�0ҟ�n��%7O�W4ܑYB$Q)��Ý�'|�a�29�NQ�_B���v.�A6�E�돉�+��Ǧrc��-+C� k�p��a��6P�NW�w�e2��]L�"O[��-4�,��@��1E�P>�nB���I'q:�ca����]�4G�vu����` 2����!��ފ��!<^y�L�3 9��D+J}L >��Ӹ�,_����QPpwCC@�H�G�{�:���)8pV}��Z$6�ln�~��j�.)ꁝ��_c����/�)k_�{@���64��a~��740j��K/��*_�ĺ�AY���Z�_��p%���S�$�E���V-���<�Kv�l0��-�*��GP2�E�sX�>.��İfn0�B�&�D"��]�~��4��bUU�;��#S�l��3���v୪���z�+[���3҆lטz,��0P�n ��dJ��}#Tb��s~�yl��!�j\�����P�� ܷ�P���ؤG�%�����>�ٲ��F8U���AYd|!W:e��������)"��@܇����4�+D b�:�G���4��aH�f�1,�wo�����?�K�cc����:t'W� ����-��q�:.����Y�x�2��?EA��Mm5H�ْr<=��$�,�g? � �_�at_ ī�����|���)�C{�I��A� ��Z(�xl�.4[��M�ma(ƪ��Ҭ}�Xk�'s��ή��v� ,�62�U���4ꎫbj���u2ʵ�>���y�����\N�=^��F�b��}�/�st~gB.}� ��k�`���c&�LV�Ǻk�7��D���I��{�z�f�n:[�vj���{P�6�E�m�� 1���7���!·�|�� �: [N{����Ə�WNH����T�oŧ����)k�g�-��K�X�v�����"��V77IG3tT��������`z{QD�&�d�@+����T����7W��Q<���p6��h����]��o��N�(���粵�(�Cr&�`2�с����:�7�ZOJ�fͳt��$�뗻o�פ"�te���Vo��\a�^\�\�˃�>�1��)M�A I+�z� /���>�Ȏ>���ygjFf��a��y�H;�l7/��1e�B�fh�7�X�~wR�I���#t��W%R~1;�m�/��|� &�T�)�������W�������`QC���N*4(%7���C#�.go�%��*UT+�\��]�Py��X��Y�;R��L�j���7\�蠚�6{�y�ԧ�ꛖAcxZg)���baL+bon������dS�}����O?��r��y�#0[PZCl����Oe��ܽP�'cY���f�H����&�<q�e�fgk���?���`�CuF��4����7�fd?P�?0JZ݇�L�s:d3���_��!�ۮ`���aG����ķ��o���҂�]VJ9�ȀϽ�Q�u�iD��L�#�}�ޡ��V ̣W�P�!���Ee���Q��~V4��'3�֪4yldɿ3܆��i�:)[�s��W����5��D,�J��8 ��� ��6K�)A�F��k�wب�|�P���B@l�N� �3�G��9eW��8f�THZ�"�- �FϺ�/U�,9�d���?Kͩ�R�/�p�Ƽ?�bx0���R;v�,^�����Y13�\�T4���4|:|Q%���a~��nԄ������&�G3��*}������Jw�=���;��`��m�/�����FRLV���}�e2����$���p�u��d���~.<x�5�����1qς�l��11�f�HCOn�P�"4����Ă�{�\�$(�� �^�F�M��)�`�m�;�sN���ę��Mu;���e[ �6Is���*E��5bt0�u��eV��Tb�}�{����1�� fc:`z�4h>�y��.�GH"��_� &w�L����gՁP,���VgD����F�P�������c��ĈoQ.W������1oX�:�mX�e�1����fb�R��#3�o2�ˡ�a��d�A��yϯ��Jz2���Tݧ�m��>��JK�O��ԸҜ���^�K���E��a��?n�6�s��S�{��\=��� �O�C-r㯋� ~�BAeUd�a 놽B�,�� �|;�c[%Xe�\�� [!c��V�U*��=���{��tL��,��><��O�n��De�V�ύF�������!g1�����<Ƒ��[�����)�1�7���1 ��|���jjk �� ��2;�0�(T��5�̠����V�f����4^�F��Q1�Q�gp/��}=9ʾ5���`�LD��GL�\3"�6�����<x����"P��]|:tѴ�������Lͨ��i��Ȕd��,\�b�Y�E��dj�?=��]/hXj�4�*�R�l$����b�;~#> h�� ��A�@�u�{�j^f��]3�qilY�y8�$/���-�����:�[��\�i�3r�;
Behavioral task
behavioral1
Sample
261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e.dll
Resource
win10v2004-20240226-en
General
-
Target
261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e
-
Size
3.9MB
-
MD5
6373886fab2b5984722cb0303b0e3344
-
SHA1
0b61a247d012137fe037c54e8d8b04e3ed179015
-
SHA256
261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e
-
SHA512
7440697b3a18791a38ac63dfbdf3378ec671282f199e3cfcc97f43314b26f4083e27e89ba44cd0c65300a2e92d77f74e5a63f218ae5c7236ee6b9b3c42b81724
-
SSDEEP
98304:rpi24pRHQrBw8zyzSS/YwvYq21zRKhFiPtTo3ZzSB:rp56wruAD1zRKhIFT6ZzO
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e
Files
-
261676d97f1e65f99548662f1d22e5ea64b455e91e53d7a7a74426db62ce015e.dll windows:6 windows x86 arch:x86
5b30a576c6b19bf0b384b5153a27d1f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140d
??0facet@locale@std@@IAE@I@Z
vcruntime140d
__vcrt_GetModuleHandleW
ucrtbased
_initterm
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ