͂m$1��/�N�ƢY5��9������?y� sz���C����VݘWq1�dq����{��bu���̷��*�_��mۛ��R�/|%��1g��+s�[���b��}��f]C��_]���+$)4;����^�9����>�2��j��Ƴ�@��\�X'�Љ�Y���P�s>���~�H����<y��R�nt��㮒3_���q���z�\!Ҁw|H[�Ar�-�6����i������N���ݯ��]SQ��1=������}��V��Fj��\��cG ����Kͫ��,�'t��6�v2��V}2�y��90[շ�NI�řJ'j���za�.-n W�N�����8,�#��%��~�gju��@Բ��C��54�8;iyLvp��\j`�G ��+�r���!N���5����%E'������P4�h%��\��JӁ� �u�>��Vsh���S�z��u<���5)*����A��ϬZ/��Ϯը�� X���sl��}��.:P�ຊ��p�U��H�DM��L<z��9���9��g���p�c�|��X�:y�J�dT��!`V[J��m#�xO��H���4��v�j�z�h���#�� lC���C�bn�9WG�:�b�B\������ =��kX X�&���f�re�̌&�&gi�R��ʿ��Qg ���.J<o4*�؋�S\�8\kouyۻ#�XXpZ����9�3��{ZY����gU ~��O���cnq�M��u����w�['=�{w��1�S�n6<*qܺ�:��3��u�;l�8��e~C�9~���� N��*5ki����Pvl@Д��ˁ0aM3_m�S%�+� 4�;gUc`'����@e/��k�F!�Օ��1#Ϊ0�}o�6k_jn���h�˄Z�������nnM��TR��O����Ĉ�ư����mc5�eԊB*�l��u�5��Y)�(}Z-��&&����d�*cQvL�/���=�9��QE����O})7�CadA�8I�ȒU�^���70��j�5}�Os�1%ˉ]�ڸ�G�����/{�MAԂ[��#&X"-�O�� �浻, ��5�%~��M�Κ����� g��.^9�ሳ9;L�\�d9z��a�ߣ),'-�!�emyg�r���#�G1�(���Mg�/~�_#��\�?���R���?O-Wu�O8��"��)��oS����˓_̵ʧP'Ãe�����(Ra/.��)%ؐ�a/���'l��Us7��Iq?x��~�;�q_֙i��a��� o˹�B�2ݼ�����{�G�OlG�)�]��G��|�R����-:�Xp+�g�T�Ե���m���K�82�Q����z��Є,tn�@f��G4��脰"NS91rmV�������oN�IM~t��F䔌�U�B,0)�\�pR�Z`�3�-�A uU��G:��?p�V���֤�1҇�E�֗7�ÿ���ҝ/<E���Y�8-j�EPTơ��Y��tj����e<���~@�۸vA�ǘ���~�KMPTp{������;Y���mQ�^�W�q_����ƨ�bpW.����Έ��EƗ8�( +��U�P8w������`勧��V���L�~\���eoJ�R��O���e�̆�ex�Q����/@<"x�/N�� �'��~;9��rA��R�~��^u4 � bm��� [KU�d/�Ų�L�3��goĴh ,}G�h'����P�/�@ySIV�i��=���Qݘ�ƭ �/���4�_;1¹���7' ������*�u4W���撓IwD����/���P��N�J)���k*�$�r���eנ�� ��%i4���&�>]��}�/N41��������.�&JIH����ŏ�� M���1ȏ�)g���lh̛c�@u|+��~�;*$Mn�CrT��L�J��?&ܐ�K�8il�L��@��Jrr�|�M��bƂM���6ƊmER�&��n �i$цߍ�G �W{p1����i�X�;56�*c�4!yz�"��y`��xu0���G�s���Ŀx[,v(��h�.��a�N��G"�op�z���� 4ͮbg�nҲN����(\ȃ���'�+�K�!*�k��,�A�|�9�xB���\jeq�F�kͩ�J�o��������ʻR]si�Fx(8��6m������P�4�LH�)dM]����\��,�k���B�����D�0'N��Tmٺuy$IK,��^�G�(��6*$�����(�ѐ,�gR"O=��Ϫ�A)��{>9Ou�Ū��|QVl����]��M�eĜ.'|��E�s�.�)i�]�2����7�B��:��ό���树������������6^1τq�{?�۾pt{��i�G��d��D�������6���5���9� ��I$J�8����|}�GWBw_�������MM�g�ݚRz�0L��ܗ���W��v���bA���=�Yĺΐn��\���GFz9�a���T ��R����JJO1���?V��)+��O�����0�;}2������;ɳ�|�Uș�r� �;"� Ja��ǔs?�|)생�^���a_n[U�q��?�~G��c/�ωljL�|�4�݂���'�C��V�z�_���v�b�y%�0��4.��|�a�4=�͡�����+A�� $��;��t�qr~y�*��tߙ� �d�/ȿкh��=�Y�n����j��9��b����������v�\�u=�qg��Z܄��;h���o�)��S�6l՝n�������vh� j*�Ye��z�+-(�����ʦ$}�+��orelp,�ӳ��x�3m��i\��#�/�j�a/?�g|�6�W0X�'��e� �(s�bj2w�ȑ�ɟ�P:���v,���Q�����^~����7�6mhn�a�������d�ߖ_����JA�]�~n�����g��,C�p75Kl"��cB�Y�Q���/P/,�$����9�e��!18���[�jnr\�?�4� �u,��$��b"@�v3'>�M��j�C��_��Y����7ݨ4 �BO��a
General
-
Target
Voltage.dll
-
Size
7.8MB
-
MD5
4199ab3dcfedce0222d218fe05a8d671
-
SHA1
2bba87b4086392f98bc0faab168110e3787049d8
-
SHA256
891c565e5bd50cb4c90fadff1f268f99c192220bb6af6d73a1b2b2448e642074
-
SHA512
c997b8db12d566f013e39c0ee921588ad5d8f8c1b5d7f3e5972a20e90ee0919db5ac29e12dc7ee65c27e6401fe4adc1899f7cf63c98ce91ffdf054fe331fe061
-
SSDEEP
196608:2UYL/P/O+u41s3CjFl9E/XThk+GgtT4x1BV:2BPOJnSFl6XTigt01BV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Voltage.dll
Files
-
Voltage.dll.dll windows:6 windows x64 arch:x64
97f1f5e3b3950f0049c1996d16f39a1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
WSAEnumNetworkEvents
kernel32
GetSystemInfo
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptSignHashW
shell32
ShellExecuteW
urlmon
URLDownloadToFileW
bcrypt
BCryptGenRandom
imm32
ImmAssociateContextEx
d3dcompiler_47
D3DCompile
crypt32
CertEnumCertificatesInStore
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ