General
-
Target
2ca28b8fe89d4c1343b62dc86b97bbd9
-
Size
28KB
-
MD5
2ca28b8fe89d4c1343b62dc86b97bbd9
-
SHA1
37dc52d0cf3628a64d8d5f9904db60e5a0d6b543
-
SHA256
f91c3b87afca71dee9b64266e75348f7c27d94bc829fa2b6ea25b629879de919
-
SHA512
6b33f466ba7daab8bc4f3bc4c1e8fb4b0189bb49ba55521273b9d5dd02bc0b04d794f5d137de7cf8f121e89d27f73d8bd77390aaa5f401a0522c9938558856de
-
SSDEEP
768:TTqph6gN38VCbjosdlw+2ddwmea/nMD8WGh:48VGVe7ws/Y8WG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ca28b8fe89d4c1343b62dc86b97bbd9
Files
-
2ca28b8fe89d4c1343b62dc86b97bbd9.sys windows:6 windows x86 arch:x86
5eb10a88821836e45f98778bdb40680b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
memcpy
IofCompleteRequest
RtlInitUnicodeString
memset
memmove
MmMapLockedPagesSpecifyCache
IoFreeMdl
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisIMDeInitializeDeviceInstance
NdisOpenProtocolConfiguration
NdisReadConfiguration
NdisAllocateMemoryWithTag
NdisIMCancelInitializeDeviceInstance
NdisAllocatePacketPoolEx
NdisOpenAdapter
NdisIMInitializeDeviceInstanceEx
NdisCloseConfiguration
NdisGetReceivedPacket
NdisInitializeEvent
NdisFreePacketPool
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisCancelSendPackets
NdisDprFreePacket
NdisUnchainBufferAtFront
NdisAllocateBuffer
NdisFreeMemory
NdisAllocateMemory
NdisMDeregisterDevice
NdisIMDeregisterLayeredMiniport
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisDeregisterProtocol
NdisDprAllocatePacket
NdisIMNotifyPnPEvent
NdisReEnumerateProtocolBindings
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 375B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1024B - Virtual size: 710B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ