!�In(���SĊ�[.^���z��8����_L�?]�����!n(8!�& F��H�/��ט�#f�&��Q�]�����ǫ�j3K��0��E1���$����d`tj��}E�0�9"P` *}v)�P��>$fn�)tZnT��=b�S��TxP}SH���浹a�M&�en@h �L�#�� �`|r:��JN��g��%�cæX�_ǒ�t�����DM�s��W|�0g>��z�xH�J�����1ZD��7h7�EM�#��Ǥ_���q���������<��'���>'������G�������N�y�xZܯ�fG�I�0���T`��nB}n&W�����Ft�8�M@<�&�>�Ǵ�b����^a��}����+��)�]m��|�9�\-dpm�Ը?pA�+�b�й�Ő^�� �i (���K/���ԜN�J�$zq~'�� �j��ے+ �<l�'(3#+�Ƌ�OMk���/��%˚�(98�i��� }E�3̅�eE�oKeW�nքE\05��:kNS6������))� �{����P�\IfoH��1���䐊���N���F 0,`�խ�6 B�b��\Y����&)%X��l8���H@r������py�}*pR�)]��j��9u�T~���������*%��A�ӳ b{�aL� ~�9�E&×��X��R�@j�(S~ e=���`Zi�T��>�����/Ci�jG�s[Z�����6k�} ���?Gڕi�Y.--���N��Y�f��{�/ ��g�dkD��cpeݱ��wk�Q��o%'m� ��3�<��^N�����b7۾�ZP�% �uF-�)[h)k(q���WA�!V�c�LҲ��"�M0l�h�P�`P��o�7��ʷd��@�EB�sk��� @��;�K�����'s'��F�Z��P��53��`q����ж�h5K��A��Ϛ��s��;P�M�6�>�c'���.���29���������҄�.EPF�M���Y����Lj�â� ���G��n��9�Y��R�$���`Β[�u�ӠH��:hBJ��U��Gw}���&�V��2M����TرÌj�/�����/��s�\M ����;� �+�l2���l�Hd��^ynf��'l��rX��{?j{���;C���B���̃BC�2=vo����6�~T�!�m�7&oA4�o0�6�����,��K��7�&n}���1���,),��d���0���v�T���o�3�j�~Bx�-��� ��M������k��g2���~��!x�����h�[)wWg���}�^s�`��s6�/�{Q�6Eܲc�i���sZ�fw߂Gk�p6J>ry��$u�5L��^So[�zt)#���J�^:����$1��ަ�ݺ��c��ܙ>k�� :����^9Ey�Q]k�w���V���Y��ٹ�#d?:"�) (��R'�DϚBp�?�Q���������"k�o�nT��\*�}�������dG"|�5��4�����ol_����3a�+M���������ހ<X�7�~��3�v8��\@�����'mҥqׄ�R�3�h q� ���X�I�Ȅ;�6�(�;�������R2Y,��ޱ.q��G��o��}��<�~�q��d�� ���gj�[N6��ж*D!C�ݙp'���gu�$7X�魠`"��>�Ȁ4+o��� [�Ig�ȅ���[<��t��I��x�]���,D�~ȯ��O�1${*t�x�k�ڝE� 7$�w����o�� }��t$m���^�������i�JτQ�rU�o\�7}��xjO�0��M܍�%4s��#��ȩ�,�%�E���54�#2GZ!��7=�x3�p4�P�6e�ij_R��ܻ����%����c"�w��J}��h�s��~�*0 ������ �R]kx(�к��Y��p+�QxQ��P�~��%t� R�ò��I{w�\���s~�$� �o]���{ݐ}�n�{��({�5��� �)���4x�bA�G����USO ��H���fT �"�%��w%༲� ���w|���X>�̢�7R��Z�+Ɔ}v)�;Z�_DN�9z&"��������yH9�U�j��e (�����>Z�q�FP����^G��!PP�!��'l���[l4�M&����=���#J ��Ȧ���&"�=�wf��^;�Qs������+Zڗ��=!��BX�Tڣ�+C���)�8�Lág��J��!���[�nw�n:A�_&=���R����=���������Ba�PCH����3Գ'�-{WY���{BE�J��X7�w������1Ry~��ÄU#�Vc�&S��� Su�"����A��\ٍ�:H����\��<npC +� ��5��/� \NP��p�me�����7��@��,'�;>��w>�E�9��A�`�����|ӗ3.�Z �{0a6A��V8Y�&�2&�'���/���Q��MQ���k��ڸ�<�a�s�5{��^��_Oe%P�\���ǜ+gf����dh������j����q��F����XNе%���HI�j�L�(@y��=����"�Zc_�ڧ��,p���6��Z�.�� �z���X,x�܌�e`�-Ԛ�ǚ7>q������)��Z� -6)��iLAF�!v�;:*� g���uP�%vۏ����ΰY��}7R �Kmo[��a��z��vW��:x����4�C8G?mK��d!=�n��NQRH�N$�R�������([Ε�������`SP���/����v�Խ���"7ۂ�Z�y3)�Η�o0o�R�� -�]]�b�"��r���g`h�m0Bw`���K�v��}�[Y��L��j,}�zW��'����ܻ�U'O��H��3�m��ʥ�5��wWճ�j2"���h%���t�����k�]4�U��c�x Ǵ�kx���������Aa���h<:�؛�W�'喓!�k����?£�%��{1 N��ҡ�����m�l7�n��j_4�g�e5��A�.:L�}�p�;4�#� �o���O�m�E3��D����c�lp��KyD�`��ߖ
Behavioral task
behavioral1
Sample
e0e281d6017fceae5c00aa4381ce1e30.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0e281d6017fceae5c00aa4381ce1e30.dll
Resource
win10v2004-20240319-en
General
-
Target
e0e281d6017fceae5c00aa4381ce1e30
-
Size
1.8MB
-
MD5
e0e281d6017fceae5c00aa4381ce1e30
-
SHA1
76e70781bfb26c0d81ee78fb26efa23aefa2cca2
-
SHA256
6235b969dfa6f678be547c43a0699e37280533c004a0fabfdb2419e9bd00133b
-
SHA512
8557cb1bb3774b133d94a28eb94087441a2591f2cd6e5337db41bd88fbd4ecb634906e77a5587b7158be2b06d07ab651b7dddc4a1c16ee8a7fa247a581f743c7
-
SSDEEP
49152:XV+OXN8Dbch7zAO28IGeI6gDfpSOqm7oncEHsv/cE94GIxQy:XzXN+ch7zNNH7onzHg/cEeH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0e281d6017fceae5c00aa4381ce1e30
Files
-
e0e281d6017fceae5c00aa4381ce1e30.dll windows:6 windows x86 arch:x86
4a8acad1ac3b1ba301e41a8b24efcb22
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
CharUpperBuffW
kernel32
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ