General
-
Target
582260512d4668bd93e690ab0e40bb01
-
Size
176KB
-
MD5
582260512d4668bd93e690ab0e40bb01
-
SHA1
971837139fd6e5098ab6f806c0ca5d7495f29cc5
-
SHA256
d2fe7eafceb1829eb67c8a90b554540e948a6f9f41c3757ce594ab6da4ebc57a
-
SHA512
8d10f06b99ca4fc8d03e7db2773fa50d16c362d7fbad8db3ea807b44f217fb4ef35bc3fc9fcb31bcd11615b4c5dd15eac0d4bd8649d46c6cf58b1539a4c72e0c
-
SSDEEP
3072:6Gt885d8gc2YBubpb1rbTPK/JvSmeoLYXcPgtCFnYXzaUk+vBMtup7Gwwf1l5t6Q:6GtB8gc2VplbTPK/FYMPgtCtyzaUk+v7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 582260512d4668bd93e690ab0e40bb01
Files
-
582260512d4668bd93e690ab0e40bb01.sys windows:5 windows x86 arch:x86
2815a26316831738d3675416954567f9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
memcpy
memset
_except_handler3
Sections
.text Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 722B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ