0�Y� �~W�4@�������*�� ��� ���ʺ'_�2�;o����Z8���k����8|���И��@z�`\ȸmݰ3���f�W�ԅ�lG�0��"}:$a�(�SQ((R���+�e@��(mO?�:9\ne�����K2JT�/�ݾ|=�����i��a��2f��B� �c�� �&9��e���Tݦ�eF��Ϗ= 1���?�*��52c���1U��������r�L��+�R �_�N#�h����`✿�� 8O��"�i���Ov�0֏����7�����[�QfA☈��/��:_tԾ?��P-�$}E=���,�Rb��!� `\����j��?S��hs�/HTPʠ�Б���'��mo���T��[2Sb����C�B�Q�ȋ8�,Z��ЗҼ��������VN�+mO�I�1�1���w�y�͕8KWz��Z"�G�Ԛ����ߪ'11��9#٦�_���E��aWiIMס>�"Cj�L��Ə�8a�O/��喿���?ʦ55sanp�����Vn���Q�Dy$^��K�ߘ1s9*�IIL�/z`b������v���;�/"��^q@�K��f휠��# ��Ҽ�A��>0w^�ɓ��x9Xx�k���t��IX��Ͻ� ��=A�=����7���m�x�`�8~6$�L<�S�LdC��b�uYk:@��>�#p��4p1D�r8Ė��s�/>��p�KVY94�m� �7�4�����ٷ#��KWt��;����j��y�0d�~5��n.�~�w��*�^�Փ�u$�C8�`Z/l@ːRT��g���Jq_M�u��4K�z��7��D��w��1�:�,�+�!��qij����T�!+X��c�i;v@+�_��JL&C(���� ������k�z[7h�2��`!��w���sZA`�Q��Ԍe����A�耍��).���0�%�Y��2;�/��3&Yee����\�n���� *��QN�<�R��P����,���3��aδgU"D�;[��}~�|Ys����Y�Ѹ�ռMH���ݝ�X*}��A�#�F��17(58'�*e��k6��=7#�@��?��<q*햇�l�U!:U,l��@}�{&�����^y��w�(\yRx��I��E<�߱�ɅXsF�堮�0�g�5'TX����/Z#�\/�.V�ys^23�s�C�2���Da���� 7Iڸn:M��SH���W)��|�h'hk[�G�ռ��FQ�@Ř�ߦAFw�zL�N�-Mt�ik���Y��Z�y�(���5tw���8\�Zjވ���MȄQ�k o�`TĦ0��rb>g���{���5�h��":���$�"�}N�X���0E���;2p�N�#�]��]���jy]J��5�)[3�7���P��+G&���!)r{�R0��3s��1�/�C���-�Q����R�XRҞ���r]@P'�$�l�9�����G���=��q�h��t:k߆.9E��g���/�cj���>��-��+�:)As|�9-��f25Rk̚���P�~U{lJ�ZE>C� qˏ���zmr��a� M�G�Z)z�{A�f*?�گ�kL���������v�6r��p%�?ܶѕ�^��8��jD��H~P�)���W�ﯡ��O��\Y̓1�"��o=+�&�g������J�s/9t�]����@�P�L�pQ4�X��E����YVkBj;�Q����s��C>�O4B&�U3�8�[D=��լd=~&�̤v���:�+�V���@^>���f4� �*2�6/�y�U���05��fv�c�Z�R�'���IR�r�s ���O����0��;��uzs����q�����^y^�FD�E6�K�D�ʆ���VUx���j���(���}�������!�I���~��-��� �;9-X��[]�w��aWT9f���_��Ch>���M�HasFA�����C��1�|GÏ��_S���T�R�h lj;̞s�Gs+�� :��"[s�]��@ &֍{��!1��u2�qgᕿ�/H���ҐH�4�����������I�R�_Ӗ��Q�7||���� -��ۘ�����N�*�=ڧ�[�gX���͝Nb�Z���mD'b`Ex�q�5c�o����-qa#�4X�����/4�h�Ƙl�\���i�y��idw}��J�O�l������c���א���*�����] b$~��Ddx���Y?5��f���'�Il6!m`ବ�KH��*e��a6����cG�dH��_��ie���;NuF�c�����&ۡ�Z�@@��m�& X�� ���F? �P�;��2���@�ZR�zҗXA��J�.��Ʈ��˪�'��;wt���;Y�0�4~���)ʐ--�������N�!,s|L1��[�՞Þ���Ī�G���`/M̵�.b:�YZ��b����F��#�����K1�V&�-�� ����BF�PR;JCp��0�J�=��3p)"rT\<$қkN ���}����&��_9!��]��T���yO*�ӷ����@��II�k�v�n�+L���<�G���F%�m~:�E���8a6躣�A�3��*�f+�0��&q�Ͷu���y��.c�B���?�Xt�&����~ �Zt��F]%e�9`�¥�"��,�J�+�8��i��0!�Z��,�B�/I�$�������%��l�G��L�Rt�3;oJq�N<Z��YV:^� ��FKY4������!�8�)�#�A���`�Z�Ħ�i��NX�Z�s��ŀ����ɻ�J9�R?$���̍�N���]�{%-��`�]4q��r��(c�����s V�g/0�h�e��_8kᦋ�6���d��xHyy��j *�9W���a� ��o��.P���+"���Z�ӅP:b;`Ԉi�6B |˄���M E� ���{�� ��m�J��4���{�ܒO ���6w$�]H�?H��F��*�a�@�����g曺M�cN�M�(��|#���kz ����5� ��ot[���kea��:�K,Z��ϹF,} �z�_�;�I�Ǵ�T{��Y�n�V
Behavioral task
behavioral1
Sample
a6aeeba6f28a410e110ce8c448b6d6eac7f8a491f3e29b1b99b2d05292cb1532N.dll
Resource
win7-20240903-en
General
-
Target
a6aeeba6f28a410e110ce8c448b6d6eac7f8a491f3e29b1b99b2d05292cb1532N
-
Size
346KB
-
MD5
feb8a0ed22f0d9f3b23587d42f978fe0
-
SHA1
632f7925a604fcba517b2f9c5c8b82d8659680d9
-
SHA256
a6aeeba6f28a410e110ce8c448b6d6eac7f8a491f3e29b1b99b2d05292cb1532
-
SHA512
80beda280ff4fb0faefe0992f9ed71fa4f7479bef206855d3738d898900262e880db4d3269f1567a1a23d70d1edd158ec18de5a6e8574dc45b110693584fdbee
-
SSDEEP
6144:t9VIngIh6gVJPf9t5bMHMp4iG5sfzakQbF8x3UD0GLeq1fLB+6h/J8iaF7:DVIgCVJH/5bU3s7ax/vLhfLB+m85F7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6aeeba6f28a410e110ce8c448b6d6eac7f8a491f3e29b1b99b2d05292cb1532N
Files
-
a6aeeba6f28a410e110ce8c448b6d6eac7f8a491f3e29b1b99b2d05292cb1532N.dll windows:5 windows x86 arch:x86
0e8fe871eb1f55d29f314547662c8bbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetForegroundWindow
MessageBoxA
gdi32
CreateFontA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 344KB - Virtual size: 343KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ