� -*֫Qk`j�ghr�0b���8{�Dy�l_F) ��;�s�M1WI�;_a�8�}� �v�XT�a�Sǭ��% ����Lg��1,F�������wT�G��\~�6�IР�/K���ӑ*Ѵ!�8��7�^q�<��g�y��t�JF'��2X*��A����S����?&���$�uO�/!#!>���)8��}�n��(�'�g���n�@;8q �v�(������k��/� �N�i"�m��^��q�n�kG�?B��&�?$U�ah�tK�E����u��Y�3�:X��O�(ۦ�xb���hH�y�_z�k ����&��'���}���7 9�tv�����i���<#���/5Dʡ���܁<�9��SI�خ��x|&eH���a�(�h#�2���6�.zH�Ɂ����П�����\G�ڹ#Տ�iÃ�����f�SAɵ�XFd ���������S ����G$Ԙ��l�����oǢ��(B�f~pFO�vkcgCT��Nv��F������>-V��/�7��#���JE`�ڬ@���:�i�ދa^O�����L�Ӝ���Ke6u�u��2V/���%�m��Ri�X���&:�%�'FcQ����$iR��t]���7��v��L^�����L"�-W�61�a����q�7�=��> ������B:���-���v�۸ T�������4��tV�db���G� �q�~07<Q��u��}����˷- e;?�������i$M4�K�\�=�}K`ִ�\)[м�;�����{Г��(���kS�#UGY��n���ְ#yl���/JpV�U �9��N2(E���@z�t�OH���T~ཿ��_fc�B�$��x������"��D�5Lê��DR�!i�7ʰ��)@&$��ɐ֗D���@g�lש(���t����N>@~eܒN�0�i<�=�xu�7̔����/,�� L+w�Ҿ;���t*3��5d�]�������J��vʴ��w?�ۿjp���&� z���FY�I�$#�d%/���N#9�(�[�ژ���C{���j���)����J="���쫽vÃ�:� C�Q�M~�J�$_����ûT��ȳm��D����Aw{A�_=՞7a�Z�q���A� C�0z����$Bh�@�̠��.0��eS�/C�CQHZ�,xJ��x��JO=?�|ˇ�G:��U��d�h�k�N)R�7�� ��K�e�xa�&����)*���ƪn�w��Slf�D�G^����R/Uk��߆%���Ys��I[ײX��>����&������ǦN�T��J�G�}&�����nڅ��<G��\��R嗹����c�sncP��V�e{q\��¥�-��ki@=J��Ҽ�2D���Z�Z��ͳ�ݱM���͈=3Z��ݦ�h��`�BJ� ʞ�86�k���g#�ڡe.����)���Pǧzq�Y����>�e/�3��N�P���t@��pxC�V�Y��x�k��f3$`fu��zQ�WW5su[�\1��VzF��Ge[�ؾ���R�` ���ۯ�])'�%�O$$�����d�r�t\s �N&~���������(��^�L���/�d ?�8���D�{��"��I�xbC�z����X��խH�af�ʋJ�v�3����0��jD�k'�x�n͔fg��:��L�ont�d5E\�#S������"���9���M"���}}���zg^�~;�t�~�X�U�;I��s�v�2ǯBo���Zb�*����p�l��PMJ�3��s(�(���x[�p���o8� ��N4�5��~u"*j�Kz~V3���^�"��:��?(.?n6_0;�i`a����� ��W����� ��Wv����������a3�� L�<2LdY^�=g���?ruM���$/t���gb��YС\o��NFD�4}�<KP�^��v��z�&��|���mT���M��0$q�T�q���z2�1�W IL����!9:�[8��*%��ʄ�Ή�G��o�Qd�cA�c bd`o:q �( ל@*������ʤ�MGg��1��_�u�V*4#���\$�*}��\N�6��=��._�s���X .�+���Al�Gq���t)�}0�23�L�w���ݜ�Hn�����u��7��?��!ܼ�θ�B���T�]5��R$���8�zWtm��v��������#��ޤ�|*������zy �¦vƳ�� ?<�L�"��^Mon��@�1�NI^����@��)�<��K��ˣ`��@Ю��r�h����[L�zI��ꆇԬ/�N=_b�� $x�+��5`t<�Q����u���ARMm��ߘ ������m;e����Q�?O���ھ��&*��)����b�ԢVj�F��'QZWp�s���fш� x�J�Ŏ,���w;,��3�xK���;,���������dܟ2N�vH���~� yl"<%N��OA�'�w�z;�#k��1m���Lђz!���Z��yv���h4�K��'���r�>Rm�2����d���"���k����w���B�ajK)"�'Z�������A���[?^D_���Q�����<��q*S⣢���p m�� iLBV.ƀ��^�;J�{��/4�&m {����>��n/�\��~��1��}E��WNK�F�~��a�W�J&�¿0�L�b��@4f����� X��H-���I|k��Y�� I�9I�eb������k�!f����IU���Rd�+��s29#$f: �ֹ�/FNr�-�/Z�¨�A�{��~���v������B�]�m6_ЪB�0��������]�^ �>��s���S;����RN�g��������t(�Ƅli2Q�M�:�Wi���`���<���/��v?��~;���v���^��RP����YM=M�n5��Ρs�6'<6�Y�ՅJ��r�ɩ�I}���̔�����t<�(*��AC�\z����G0��{%M��c?1��m���V���q���O|" �=���> �&�+�w��a���9���wf������7ȼ+���N*^tJ��EH+���U�Ċ7h
Behavioral task
behavioral1
Sample
ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4.dll
Resource
win10v2004-20240226-en
General
-
Target
ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4
-
Size
1.7MB
-
MD5
282ae25e51d0d24ec73d5e9b71645fd6
-
SHA1
ff72efc608a4362382e0ee9b8067266d44a4aaa2
-
SHA256
ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4
-
SHA512
9d7d78fde3f581828edbeab80b111a77fa367781aab559f4a10c3d82455a9696ff4872708d583150c1cc47d5f904c4c605696a7cffd2ad7b6267d7d490958a01
-
SSDEEP
24576:ZKdLvL3+J8vhkmN9lBqN2ZYgQNwJZcoRs4kU/AnYfj2iaVy:Cz88plnDJZXQczZ3IIj2ia
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4
Files
-
ef1257a19e8ecfec326a5ff4abcf9d6723659565ee206f7266cfaf01a4c821c4.dll windows:5 windows x86 arch:x86
5d0db50f61d1255b2e2b73dca949d7e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
Exports
Exports
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 817KB - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 817KB - Virtual size: 817KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ