��:��|3`�/�h1ֳ��`F�o@��Ρ �~�=��/VU�S��Hr�mR�K�O�y��qV_�X�ϔʽ�d ����g�t{������ ��ca��d��?�O��4wKAi�[[��4D�=iS��.��݂o�MN���r�m�LY�&}����p��FT���\�D����]��l|#3& o�13m<�ln0GE?y��=�)�����P�����`���V^�n7��资"�<:�W�S���X�K�3��� �'y�K�:�p�3�L�/�ٟ|$\���#P>#��o��B�������^�wT /�d�\f���[pT�G~1q��v�ۢ5I�Ϙ@����d���^����jc7#B�`hN=���<a=G��)���)������2v��7�hYq���U���Y\d�E�e�Nj'�|o+X/M���(�u7��s0b�)"$��-�������b��>�oL�b��lu�������/ ���B�����C ��<LE����q��]A+��cu�q�q�{�����{��]e��˽Ӕ) r8=WC�% <��0���[�|�w�u���7���N��4f"�I�i�g��O7SՉCЎ�����j�6���������?�↱)p�:+����ii��*��l��ݲ�8��d���Q��U��w���`�Z`��j��h'+���V�z�jR����r�I��=r�`����+0/�\7�C�.������FPm�O����ǿ��`=��2p@�E/�R"CH�V�����_�����`|��g0�U=}e�����yNV����r��+o�`�����Is���Gr9.YI��j,#��vHn����y� $�|*V���_|��Dx���n�0`��H�r<����p�Tq�t%iXVH��B���Yؔ��>��4"6R�Ldg3�$ce����$��uL��I��>��A���x���r�"�ޙ]�X%�r�ǣ��c��(V"_��U��~��@���A�ģ�X(���pO{�纛-d�d�t6vX�k����`���l��s-d�,���VԬP�zΓ�%"*<dxV[l� I�����R6�:L�-0!�˚��T��E;�L��R/�1�*����z9̱0<��5ryM�/_�Gm�ч&bCsx��inj���p'�/opZ�4O+`�����1p�~�ʬx�d��"�9�����4,E(�(H��� ҵ���^Q(PTp�����o~f�?�X%�~�3��t.I����z�"�2��@Bc8���oжM3�z ָ���E���ȣrl��ViF�Q���Ju$����b�� �!�|0��hj�:�<��G�](��J�X�ԭ����o���k�s���t�+���4�ͮQ�� �-ER��Q�r!��ۄ(�B��/}�UP�����ý��+��� �o�%����c%�%��/���8͊�m�)j*� ����||h"�������y耐 j�lh�������=�jHE<����$yqTvn��(q��K:>���Nь1_Il���'�r��)�q7\����ʠ~&�v� ��[ᯗ9+�D�aZ�A�w��%����G����/e[�!k?#��}ٗ�(�m^�����@3�sv������*>94�7�2�j2�?���l���k� ��cY�`��:��5_Z�}�C���H��N{:��І8�J�`���Yr��Pb��@%qR�;P��4�)0uKy4k�5��[* E���r� �2����������]ݩU���h���枏�3�d�骈���^蓕"M}!�ut������.���}�_/ȫ\5>���Ksj\�z�-��E��Oir5�O�����IV��vi����˳\ %�V�Dh�i�Ǝx>W&v:�R��N�<���Tfĥ(u�^��t2�gĝsm��6�����DB ��;j��.�>OW2����D �e�a��&i��H��令+���Q��R|��Yd��[�R8Z6[���c�S �wM:��Sܔ����p�����s ���T�<��%x-_�k��9����զ�\��Yp�$�Oj�fh{����ˢ�qp��?'O9�*�yM,rj��AcZŎb�Tg�Ag��K;t��� 8�J`Z��T�����u�QTNC;bl�$�����Ӻ�����ZF!/t*��6ڣ��%���������˩\���Sܹ$Y>�4�&�_�S�����%Ɉ����,DO^���_+C$6�MΔ`e�+�ظAR �"#���b:�v݀�� '���L{�5Z>�9�> �F7�m/k ��V�co]�F�;� ������yf��@�r���Q�b��oc#s~"����f�C�Z.�~���͝�K��i�LY��Tl��]oKJ����J23UІ�S���L~Ɋ>kC��G]��77�y��S��A�&z�;4�V=���� x�)D}R�� �#�W'��zwm=~hBqb&Y9�s��Fi��$њw7;U3q:Ǩ��b�*�nL��Z(�b�;�����nW�qNP�L��癵��֔��옎�E��V�������oE(Hr�lO5y�T��+�~����v8M��*���������.��9+n�Vm��N-g�ސ�t8"|cO�O�:��|Y�9�4�22 ����;�Xm����:�Z��K�e��� �f�-@X� �yvM5~��9u�?�q{�Bx�SͦT+�T�N�����>gqEWg��Fl����"����K��8�����y}�8�F��C�ض0za�4|�#�'@/�uhL��W}����$p��?!�n��3u;0�ȫײ�6�I�����+��z9�/��?e F������|���"š ���t\�k$a췬��6��mSۤ��[�A ���v��o*zNwu ���6�z�u�s^� ���!퉦Ϊcʭr�o�R�ת���8�$;L�����N��c�rV{�M�uK�5ķ���^Ij9Cc��]`�����\B#߁�i�ZH-������U-���{>�߫���c1>`ϰ�j�01i�|N�~�"}H&�����������z�:�^u,g^o�r�_
Behavioral task
behavioral1
Sample
cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9.dll
Resource
win10v2004-20241007-en
General
-
Target
cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9
-
Size
7.9MB
-
MD5
ed32b9aae9b1db484e0771c4e9ca2045
-
SHA1
8df3f87d142a14cfaea3099b05c0ea8eef49d7f0
-
SHA256
cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9
-
SHA512
5fd1e8f926eef8e40099d81cf1e84f80481a61dc9d5672f17afec5e44cf7a1008660583c9c09681cdb86c908972179957730d303faa956c38fd87737d5ea26af
-
SSDEEP
196608:Q3RV0iftUvhxwEr6o6FnniOR8AAOeXYlaFTWjLgsECI19BMC+vIG+:Q3RV0i24WJ8n/uAAOE8a8jcBCi9OCBG+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9
Files
-
cb76be9ec1d47bef55cd96d722c8b7d7c2ff5eaada7241cd565598c848c50eb9.dll windows:6 windows x86 arch:x86
a91fda98a730c01d158a046aa138aa1d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextA
shell32
SHFileOperationW
ole32
CoCreateGuid
ws2_32
ntohs
iphlpapi
GetAdaptersAddresses
psapi
GetProcessMemoryInfo
userenv
GetUserProfileDirectoryW
tencent.mm.pbc
?start_c2c_upload@cdn@pbc@@YAHABUC2CUploadRequest@12@QAVCdnCallback@12@@Z
crypt32
CertOpenStore
wldap32
ord217
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.msvcjmc Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ