���z��?�\�����͆@��q�����=�u���w�I1r�DL�(���mk�>)@Ui=����Œ��_#��מ�����#�(+��QT�dA��!�g�x G���.\-��%� ���`̝R2�����M�:����F��;0�A�mt��Xuu�n�#<�I���i�xu5�yRʐ�Q��BZZh`&��Du �N2J�eq��v�1/�D s�Q5U0[͓5�,�b� ������{f�&;k#XUʃ��"����=6bXå�a���e&�{�q��)�)�<���B}(9/H��g����/�%����E���w�(��:��z�a� ?OЀ�k�T����Tw 6b���YFGH&h��v����� A�����YK���g�2�͖Mڜ���)�ն���r1��G(S��)�u�1��9䂒TK:�Ak�}��|]�S��盡{��F�뀽Pc F~��,�� .!�舭J� K姉?܄�Ӷ�~����v���cڄRo���{���B>Tu ���U���MZ���,#����E��[6W�X�cL�!!�8���{��MR����1o>[��T��=�Aͻ��i�J������8"nӏ˄Ud=�`�a�ģf��ꚼ��Vu����U�sJl,)�����eYA\�i�[����Vo��r����v�=�z���J��P��ٯ��a)2V�z]w����ժHڪJ���/��z��d�UO�2��l���:]5Q��2>��ĥȆ�`�Lx�������(���k$N4�Ȏ:�M��@��r��xĜ���G��xq��^F�5�� HΤ)C~]��\��diʃ�QCdһ�DH�Ytby9v'`v&qaz8��a�=6��ƍ�My���W�� �/��@nx8{�.e�}=2�M�(տcq�g0��]t�(}��8�'6?7��z��|p�Q�y[Nm�5��t+��7� ��I�$�ˈ�/D;���@�B�eJ�Qp_��5�Z|,�&[}�;�@d{)�uK��^}����E37`}����6� �=K1���]�m�Q�b���N��������00p���I���n��*�����m������`��hr��IP�+.�c�+8��R=��������Z8~W}�7U�q}�Pm��(a���v(C~�� �����Ѥ$����?����Y� ����c��q�Z�Q�'?U�~z�!���E�ZJ����?� ���*�g&�����+�2q9���t�O�*�Q�7d��uSd ��p��<��? %�����= �;`���7��J��n\ X��;p|h3����M�A�O&Iw$��s�) �IaY�9��v���$;�Vj��L9�������P�� ���w�B�Oq�����8ԑK[I���|��JC��FX����1�X9�t7�E����]\Iඬ�2�,�&_��aWS��g# �~�Ş$��'���8�9�o�6��9��k�6K�q{R[~�![��&�*Fj�}�{���ִ����$ϲɤ�8涚��Z��8U�˞���bX����2ؐ�Y�ĵ��V2S|��Vq��v=�P��D��qt��sؘ��R�W����;�+�C������o��/��Jh1t�Б��e �w�Ɔ�.�+&���*kd�ˍ�<tnȺU �Qx�T��w&Xy��:�V���vU;��Snm��%�%�H�0�7����b<��g²"�sۗ���7Z����v�B���^�Nd pl����Z�O���/�B.dLbF��v�.��5�`�\��@�`Ջ����Zrl)����`���� �{�y���I����]gŷ~���q�j�-gx����X����N�!rG��:pC��y��O�K��1f���i�E��;�)��^�-l��<;lZw������qi�눆�k�����YN�.�"$:h����^��0D}�uk-*m%�-��v9�X����p����*g�hK3�j��9h�V�z����Z���~,tr�-�!І7��,P��m���ݽ����������0ЩQ��0-��8*(6@}ɡ�Π9��� ��iD�q2�sMKٙI�K^nMQ:/����� ��K�q� /$��_��j��� ��ѵ@F���� [�N ]�Jĝ�Ԅ�b1q�? �4��g��@��6غ���Kx������k8�.SC�o�H� O���s�O��-h�7*�SCT������ ���qEd��=lbIn|��b��d,��B\t?�Ľ�������;,�H]�3Lѓks�&���.�<�?r��fMN�6I؇k2h�I��ib������ VԄ��K�&�[� ��X`g��Q�P|�4���5Ye��DQ�Ƹ��8����P�ݼ�O�k'Q �g�ŕ���w�eϬ���C\��pI\�� ��n%'R��H�A� b��s���9���Q�aP��Z��u%O9� ��*w"Ő��I���S�����E�̘��d�W�T�G���d�,'���r�l�W��_����@ԟʤ<�\v}.���$�!s���C:s���6�^䎄+�S�&;����<)I�}����3c%H������ ��N����bg��E���VM������d�Ġ]�Xʊ����%�j+���v� ܢ���"!����"D�������z�EXE�mP�@�Z���JMF�XL#���t�F�|�[LU�.O�[[pi��sy� ����Q�S �=�Ǡ.��ﬡ����Q�?�_�R�n%am�f@ 8?j��������|{�ۊ����_��`���Y(j~����=4�FTiST% �y�pN>��� ���p�4�Oez�.� �,�@n��F ��q�ɯO]&ʨ.+rdw��?a����8J~���㧄����ƜW��m����З|p���p���Vo���)��x�=-���B����ze��y�����[�@a����0�e��>�+�T P�X�M��;�T�Q-��,ӿ)����Ib�X���wO�i����Dh.UC�ȑs�;"�;欋����h4M�.m��R��y߇>'@���Q��2ai@�@���K|�l�/��"�Dy��Gq���`��b
Behavioral task
behavioral1
Sample
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll
Resource
win7-20240708-en
General
-
Target
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN
-
Size
187KB
-
MD5
f8beb027776a0af7c171899532ff14e0
-
SHA1
bf49b964301d11a4167beb454c5d80d669ac0d11
-
SHA256
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3f
-
SHA512
5f25778955d78e5f12827e7ec1630f96af113d6126522f12a72ab52873e456141f8df1fba99a6787219f16cea9ecac6a41d40822c22d305777a13e501a00dc5f
-
SSDEEP
3072:v8PNPo4DPRLCqdMZM4Uv1ikJd0JGUhrxXTsjp+xq7RJZlbka7kDZ1copUXdHLU5j:v8P+yPRLbOU4JNDcp+kRXljgDT1gSF0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN
Files
-
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll windows:5 windows x86 arch:x86
bd025e68331d16f250d40dc2d2a295c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcr100
system
msvcp100
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ