ea9757f88ea8363c8005f5b7486ac88d823c9725c24eb55aa2f78c31e15bd71c

General

Target

ea9757f88ea8363c8005f5b7486ac88d823c9725c24eb55aa2f78c31e15bd71c
Size

11KB
MD5

f66eb3a5585facb3b756636c0b75ecf7
SHA1

b63b8b235e7926c081db2bce6c573b6812cf55cc
SHA256

ea9757f88ea8363c8005f5b7486ac88d823c9725c24eb55aa2f78c31e15bd71c
SHA512

f701fbad783e32184dc254140e3a6aed3eb8a9cc44e6a74013b875776c7fa09476f82e87fd9421a645179fe177164865a69f6a0f52d706eb4ca8c96a265a59be
SSDEEP

192:g2jOPM7GkD3c9l0HqDi8kvgz2A2G8cO+4C:vCPM7K0HAkvgz2Jc8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea9757f88ea8363c8005f5b7486ac88d823c9725c24eb55aa2f78c31e15bd71c

Files

ea9757f88ea8363c8005f5b7486ac88d823c9725c24eb55aa2f78c31e15bd71c
.exe windows x64

abe0c4337aa967f120ff31e7f1747930

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoGetCurrentProcess
ExAllocatePool
ObfDereferenceObject
PsGetProcessWow64Process
PsLookupProcessByProcessId
MmHighestUserAddress
PsGetCurrentThreadId
PsGetCurrentProcessId
ZwAllocateVirtualMemory
RtlEqualUnicodeString
MmUserProbeAddress
ExRaiseDatatypeMisalignment
KeStackAttachProcess
RtlAssert
PsGetProcessPeb
RtlInitUnicodeString
wcscpy
wcslen
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoIsWdmVersionAvailable
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
KeUnstackDetachProcess
ExFreePoolWithTag
ProbeForRead
__C_specific_handler

vmprotectddk64.sys

VMProtectBegin
VMProtectEnd
VMProtectBeginMutation

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

abe0c4337aa967f120ff31e7f1747930

Headers

File Characteristics

Imports

ntoskrnl.exe

vmprotectddk64.sys

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 1024B - Virtual size: 732B

.data Size: 1024B - Virtual size: 608B

.pdata Size: 512B - Virtual size: 312B

PAGE Size: 1KB - Virtual size: 1KB

INIT Size: 1KB - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 1024B - Virtual size: 732B

.data
Size: 1024B - Virtual size: 608B

.pdata
Size: 512B - Virtual size: 312B

PAGE
Size: 1KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB