General
-
Target
732b8ca076c872e4a0bdf389a58dc6335c604e414ed543f2235112c950918759
-
Size
817KB
-
MD5
359d26d1f6f4749c14874c6ac83d9e72
-
SHA1
600221a4a3455d2b188113a23f3bb3283431e36c
-
SHA256
732b8ca076c872e4a0bdf389a58dc6335c604e414ed543f2235112c950918759
-
SHA512
9ef4e189640bde275eface16b8137917461c9a758365f59a8b5864a1e702548ad66a71ee198d44714fabf6c94d251b93c2dd00ecc1b3737cc24bff067b0d2d38
-
SSDEEP
24576:rSTiKMFRAT1rRsIhJBLRgAh8DM+XyeAJ7on:WmKMFOaIhJxRgAhzGyeT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 732b8ca076c872e4a0bdf389a58dc6335c604e414ed543f2235112c950918759
Files
-
732b8ca076c872e4a0bdf389a58dc6335c604e414ed543f2235112c950918759.sys windows x64
f9b88718e0841f825f43890182918ec9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
HalReturnToFirmware
HalMakeBeep
tdi.sys
TdiRegisterPnPHandlers
netio.sys
WskRegister
Sections
.text Size: - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 815KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ