jЫus<vG��ki{I��`w�C���E�S;�<��YFi@�?�d��_�N� [[����u;��j@�N��ͻ��ȼ[*�������-�F�J��>?��Y;N�T� h����д̣wT.s�Y"g{��5O���#S��k;�d�ۺ�Ek�'H�����bᲰ����I�W�kȣ���~��miK��-G�ռ(��y"W7��Gf �Up�r��"�A@[��$���+ ,`s(���z�=���F1��˛b�~ԏ�����������ΎJ-��Ϧ�1L� 4���'s�����no�<v�P���X ���gPX� Sg�~f�qAA��n0��(@��r�8�@�/Y`wՓ�FX` -���t��6����9����Ԁ��L�I�(E��ހ�yAL�;�|s�^����4��f�($d���)w�������3��+z�GR�"l� (:x\�V�:F���QԖ��xC0�џ�Fʍ�?�]GQ�|Q@K�^+�-��ܑ����q�G��ԚKx§�~#���f�+�}g]���>�S��6#k$i� ny`6���:k ���ٮ~�2j����|ŧΪָW�!0�u�b�Z�Ue�b"�_��+�j�ﰡ�9���KV��h��z#*y�.3 U�]�J ����0o1����>���I����)��>� ��A*�;��?�M�z[�{7k�J_Ͷ��KH�U����t��=�Z>Gҡ<�3��1��Xgm���-�@��`�s��O����vJ����&�&��*��0�v+���JZ������:�&�9�X�WK�p��c�~����{��a<�A�%� G�P,��r �p�#ظ��Mm�Մs�Ⱥ�f5X-��~��I]���[R�]�+N����H���B�j�jй G���EC��6d��6ǒ�e` NA����|�`�M!5(�#aÉn;��5�9�\���C�.E��I�&�\勖%������c���a!-]��:�Ln�H�-<ԯ`_��� �$�;I0��t�뾕/9�O(�����ߊn������T8#[a�Qבf�x�zn�磑�N��ÎX��Ni��7��:)�'���18�}`C�W}D��ڟ���~�o:��WmT��L�tٷ^�@/���£*�a#�!oI"�.�Z2�/�����P�>�"FGV��Y�t3�%�bN�T03[zL1k��mK�@���A�QDVˎ c��L����a�l���~Ӫ�])cp`@����F[�m��e;�2��M�����-����S�:�����4(�dK�oh�Π�ř�r* �H���sDSi��v��b��-~W��]�Ѵ����>��B��'g��X�$�{|�,� x\���%5����z%�s}�yϐ� 4e#��L�y��}�䈔�<��W'�6֤����HƧ���C.ѷ�Qw�7���7g���&�҃ۏ�*�e(�b�T�_�����+�2ц��?��?>�g&`E���:���3N��O$����"��-;�P˨� ���Ի���-���8Π�j$N�%�z���.?��g"Кʌ���4 �7}����a��8����7*4(.K|��*C��3~y�ΑGK0��/�;�i"���p �|(�?����a�4J�o^���G�Yxe�g��ԏ��ީ� u���a�L7�OiH�R�r��M��||7H�w[���Ԋ[hW���w5ٶO(w�Y�{t;�?���/�ݡ�$��Sd�F��t�Dw��:nRK@�X���m�}?L����5�vHLw Js���a�u�"Yj��a��`S��gf��M�s �c�"%�I�e\� B�E9A#v2uV�]�Oyb�IF��J�1!�o� ��X\9śr�&q��6�V����S��I���x�&M9�lE��{? ���Ϗϯ] ��m� ��%<��.�wf�bFQZ>$J��t�&�<@O���*������z�S��s`�+����9k�G-�͜���b�1�@OKDf�-���d֡2M(oӻR��]�,����r?Z��-`�Ɇ�{(<���#�X�R^&1\���d�ِD��q�a���?"?j�� �� ��?�>.�ϙC��!��C�K��ɠa�`�|��̣�+@=3��p�1X�����3�zu��!Qh��|�+�[z����)��"��3D�F�{Y@o��l��AEV����=��"��t�ȭPU&QZ����/��)/��5w��ľa.�K��H C�v��)�"] nK0���2��;�J�_.e(b?��2gCq`P.¥m�*i��(�e���G!�R,|�vJ� w�a�I�p5HR)����������0��k�-����!�pK�*W��N{>?�e�<�Ǫ�_AN��.㫭_ ���"̐���f�R_odo��m�i��;f��sB�w����&�&�>QmZ�a<�}���gX_I��;>@��.S ����������6�R���"����"�0i`g�3|$�片R����/�8��\+x�����u8�$���&�e;-�of�M�+Hhf����˃�c+����K��{)gߦÆ5O���M��I���M���F��ͲǟKK�$��W��qv�x��TJ����'>h����_u|��l��e��R�=&$���w-�>Q,K�odoeD�ٚ)aK�,��3y��o) �vYZ�qv�$����U�ײ~���R�!��(N���� N.'R^;����`���/RlQ̵w��|}���uQp�-?�P?�g�j�m���$��|�ùcC�|����4��(���_��(�z��=��5x���k����C5c,�81dl�3�˷ȋ�V�����q2�Ц�88x @(���:�R�fw��8�K�����&|�qW���^�j�kG����������YV�2I�>p%QL1�pAcL�(��軀��f�㒔q &2�2$ �\� ʜ@:v�C���v��= Q�/���2���l6[�ݖ�Û��QD�B�^�/\���5����S��C��zȼ��$�)O�Q��16S7�3}��bY|�47 �dE�6r�aN��"�H�c�1����C��{n�4R��k3v�
Behavioral task
behavioral1
Sample
516839f48f18be51869db34d8beb6c00N.dll
Resource
win7-20240705-en
General
-
Target
516839f48f18be51869db34d8beb6c00N.exe
-
Size
476KB
-
MD5
516839f48f18be51869db34d8beb6c00
-
SHA1
d91e09b2979d908a83d2419934eeeae5a01e31a9
-
SHA256
2e348c6bb14dbee5f9790d7503a222a03c6f33da0fec54e942c33592af1f2d86
-
SHA512
e90c68a283fe69a60cd853df1cd86050aa65671efcabb852cf221eccdd72035338b7aaa8d2c3cce5323c5ca677e45438e51ac3c0632c2939ab4d212ad58ef7cd
-
SSDEEP
12288:BFmcTg1ZLjye1ePj/QIoUDnIqQkYVaR0mziV:BFmJ1ZLWVb10qQkYIPzi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 516839f48f18be51869db34d8beb6c00N.exe
Files
-
516839f48f18be51869db34d8beb6c00N.exe.dll windows:4 windows x86 arch:x86
4d0db1a991af89bc1f8ebfbc33a018f6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
d3dx9_42
D3DXVec3Project
shlwapi
StrStrIA
Exports
Exports
Sections
.text Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 460KB - Virtual size: 459KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ