VBoxUSBMon[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

VBoxUSBMon.sys
Size

196KB
MD5

7f50c460362b46ead26a558756345c6a
SHA1

7f5f5a78634ba87b5e36cac9cf871ca64967a345
SHA256

05c671c85c7d0e95fbae88e58822dc8e93ec21652680ad836cbbc2095c393f12
SHA512

ae165197ce8cdc47a9638a2fc7f81e909de5cc148858165c12b05ad336d65525c373abafbaec5fdbbfade0c4cfe177674a47f6a5b2bd7cce111b5f641279a190
SSDEEP

3072:Tbm3pmBAyUVis80Zvy1k0zaKYC7oNGgxi+hB/eZw5LXBG:TOrq0cy0z9kGg0KxpQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VBoxUSBMon.sys

Files

VBoxUSBMon.sys
.sys windows:6 windows x64 arch:x64

6bdb98562007e946831febf959c0ec1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExAllocatePoolWithTag
ExFreePool
ExFreePoolWithTag
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetDeviceObjectPointer
IoInitializeRemoveLockEx
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoReleaseRemoveLockAndWaitEx
IoWriteErrorLogEntry
IoGetDeviceInterfaces
ObfReferenceObject
ObfDereferenceObject
wcsncmp
RtlQueryRegistryValues
MmGetSystemRoutineAddress
IoGetDevicePropertyData
IoGetDeviceAttachmentBaseRef
IoAllocateIrp
IoBuildDeviceIoControlRequest
IoFreeIrp
KeInitializeTimer
KeSetTimer
IoCancelIrp
strncmp
KeRemoveQueueDpc
strchr
IoGetCurrentProcess
PsGetCurrentProcessId
DbgPrint
KeDelayExecutionThread
ZwYieldExecution
MmAllocateContiguousMemory
MmFreeContiguousMemory
MmGetPhysicalAddress
__C_specific_handler
ZwQuerySystemInformation
strcmp
MmSystemRangeStart
KeInitializeDpc
KeInsertQueueDpc
__chkstk

Exports

Exports

ASMAtomicBitClear
ASMAtomicCmpXchgU8
ASMAtomicXchgU8
ASMGetFlags
ASMNopPause
ASMSetFlags
RTAssertAreQuiet
RTAssertMayPanic
RTAssertMsg1
RTAssertMsg1Weak
RTAssertMsg2AddV
RTAssertMsg2V
RTAssertMsg2Weak
RTAssertMsg2WeakV
RTAssertSetMayPanic
RTAssertSetQuiet
RTAssertShouldPanic
RTCrc32
RTCrc32Finish
RTCrc32Process
RTCrc32Start
RTErrConvertFromNtStatus
RTErrInfoAdd
RTErrInfoAddF
RTErrInfoAddV
RTErrInfoSet
RTErrInfoSetF
RTErrInfoSetV
RTErrVarsAreEqual
RTErrVarsHaveChanged
RTErrVarsRestore
RTErrVarsSave
RTHandleTableAlloc
RTHandleTableCreate
RTHandleTableCreateEx
RTHandleTableDestroy
RTHandleTableFree
RTHandleTableLookup
RTLatin1CalcUtf8Len
RTLatin1CalcUtf8LenEx
RTLatin1ToUtf8ExTag
RTLatin1ToUtf8Tag
RTLogAssert
RTLogAssertV
RTLogBulkNestedWrite
RTLogBulkUpdate
RTLogBulkWrite
RTLogChangeDestinations
RTLogChangeFlags
RTLogCheckGroupFlags
RTLogClearFileDelayFlag
RTLogComPrintf
RTLogComPrintfV
RTLogCreate
RTLogCreateExV
RTLogDefaultInit
RTLogDefaultInstance
RTLogDefaultInstanceEx
RTLogDestinations
RTLogDestroy
RTLogDumpPrintfV
RTLogFlags
RTLogFlush
RTLogFormatV
RTLogGetDefaultInstance
RTLogGetDefaultInstanceEx
RTLogGetDestinations
RTLogGetFlags
RTLogGroupSettings
RTLogLogger
RTLogLoggerEx
RTLogLoggerExV
RTLogLoggerV
RTLogPrintf
RTLogPrintfV
RTLogQueryBulk
RTLogQueryDestinations
RTLogQueryFlags
RTLogQueryGroupSettings
RTLogRelGetDefaultInstance
RTLogRelGetDefaultInstanceEx
RTLogRelSetDefaultInstance
RTLogSetBuffering
RTLogSetCustomPrefixCallback
RTLogSetDefaultInstance
RTLogSetDefaultInstanceThread
RTLogSetFlushCallback
RTLogSetGroupLimit
RTLogSetR0ProgramStart
RTLogSetR0ThreadNameV
RTLogWriteCom
RTLogWriteDebugger
RTLogWriteStdErr
RTLogWriteStdOut
RTLogWriteUser
RTLogWriteVmm
RTMemAllocExTag
RTMemAllocTag
RTMemAllocVarTag
RTMemAllocZTag
RTMemAllocZVarTag
RTMemContAlloc
RTMemContFree
RTMemFree
RTMemFreeEx
RTMemFreeZ
RTMemReallocTag
RTMemTmpAllocTag
RTMemTmpAllocZTag
RTMemTmpFree
RTMemTmpFreeZ
RTMpCpuId
RTMpCpuIdFromSetIndex
RTMpCpuIdToSetIndex
RTMpCurSetIndex
RTMpCurSetIndexAndId
RTMpGetCount
RTMpGetCpuGroupCounts
RTMpGetMaxCpuGroupCount
RTMpGetMaxCpuId
RTMpGetOnlineCoreCount
RTMpGetOnlineCount
RTMpGetOnlineSet
RTMpGetPresentCoreCount
RTMpGetPresentCount
RTMpGetPresentSet
RTMpGetSet
RTMpIsCpuOnline
RTMpIsCpuPossible
RTMpIsCpuPresent
RTMpIsCpuWorkPending
RTMpNotificationDeregister
RTMpNotificationRegister
RTMpOnAll
RTMpOnAllIsConcurrentSafe
RTMpOnOthers
RTMpOnPair
RTMpOnPairIsConcurrentExecSupported
RTMpOnSpecific
RTMpPokeCpu
RTMpSetIndexFromCpuGroupMember
RTProcSelf
RTR0AssertPanicSystem
RTR0DbgKrnlInfoGetSymbol
RTR0DbgKrnlInfoOpen
RTR0DbgKrnlInfoQueryMember
RTR0DbgKrnlInfoQuerySize
RTR0DbgKrnlInfoQuerySymbol
RTR0DbgKrnlInfoRelease
RTR0DbgKrnlInfoRetain
RTR0ProcHandleSelf
RTSemEventCreate
RTSemEventCreateEx
RTSemEventDestroy
RTSemEventIsSignalSafe
RTSemEventSignal
RTSemEventWait
RTSemEventWaitEx
RTSemEventWaitExDebug
RTSemSpinMutexCreate
RTSemSpinMutexDestroy
RTSemSpinMutexRelease
RTSemSpinMutexRequest
RTSemSpinMutexTryRequest
RTSpinlockAcquire
RTSpinlockCreate
RTSpinlockDestroy
RTSpinlockRelease
RTStrAAppendNTag
RTStrAAppendTag
RTStrATruncateTag
RTStrAllocExTag
RTStrAllocTag
RTStrCalcLatin1Len
RTStrCalcLatin1LenEx
RTStrCalcUtf16Len
RTStrCalcUtf16LenEx
RTStrCat
RTStrCmp
RTStrConvertHexBytes
RTStrConvertHexBytesEx
RTStrCopy
RTStrCopyEx
RTStrCopyP
RTStrDupExTag
RTStrDupNExTag
RTStrDupNTag
RTStrDupTag
RTStrEnd
RTStrFormat
RTStrFormatNumber
RTStrFormatTypeDeregister
RTStrFormatTypeRegister
RTStrFormatTypeSetUser
RTStrFormatU128
RTStrFormatU16
RTStrFormatU256
RTStrFormatU32
RTStrFormatU512
RTStrFormatU64
RTStrFormatU8
RTStrFormatV
RTStrFree
RTStrGetCpExInternal
RTStrGetCpInternal
RTStrGetCpNExInternal
RTStrICmpAscii
RTStrIsValidEncoding
RTStrNLen
RTStrPrevCp
RTStrPrintf
RTStrPrintf2ExV
RTStrPrintf2V
RTStrPrintfEx
RTStrPrintfExV
RTStrPrintfV
RTStrPurgeComplementSet
RTStrPurgeEncoding
RTStrPutCpInternal
RTStrReallocTag
RTStrToInt16
RTStrToInt16Ex
RTStrToInt16Full
RTStrToInt32
RTStrToInt32Ex
RTStrToInt32Full
RTStrToInt64
RTStrToInt64Ex
RTStrToInt64Full
RTStrToInt8
RTStrToInt8Ex
RTStrToInt8Full
RTStrToLatin1ExTag
RTStrToLatin1Tag
RTStrToUInt16
RTStrToUInt16Ex
RTStrToUInt16Full
RTStrToUInt32
RTStrToUInt32Ex
RTStrToUInt32Full
RTStrToUInt64
RTStrToUInt64Ex
RTStrToUInt64Full
RTStrToUInt8
RTStrToUInt8Ex
RTStrToUInt8Full
RTStrToUni
RTStrToUniEx
RTStrToUtf16BigExTag
RTStrToUtf16BigTag
RTStrToUtf16ExTag
RTStrToUtf16Tag
RTStrUniLen
RTStrUniLenEx
RTStrValidateEncoding
RTStrValidateEncodingEx
RTThreadIsInInterrupt
RTThreadNativeSelf
RTThreadPreemptDisable
RTThreadPreemptIsEnabled
RTThreadPreemptIsPending
RTThreadPreemptIsPendingTrusty
RTThreadPreemptIsPossible
RTThreadPreemptRestore
RTThreadQueryTerminationStatus
RTThreadSleep
RTThreadYield
RTTimeCompare
RTTimeConvertToZulu
RTTimeExplode
RTTimeFromRfc2822
RTTimeFromString
RTTimeImplode
RTTimeIsLeapYear
RTTimeLocalNormalize
RTTimeMilliTS
RTTimeNanoTS
RTTimeNormalize
RTTimeNow
RTTimeSpecFromString
RTTimeSpecToString
RTTimeSystemMilliTS
RTTimeSystemNanoTS
RTTimeToRfc2822
RTTimeToString
RTTimeToStringEx
RTUtf16AllocTag
RTUtf16BigCalcUtf8Len
RTUtf16BigCalcUtf8LenEx
RTUtf16BigGetCpExInternal
RTUtf16BigToUtf8ExTag
RTUtf16BigToUtf8Tag
RTUtf16CalcUtf8Len
RTUtf16CalcUtf8LenEx
RTUtf16Cmp
RTUtf16CmpUtf8
RTUtf16DupExTag
RTUtf16DupTag
RTUtf16Free
RTUtf16GetCpExInternal
RTUtf16GetCpInternal
RTUtf16GetCpNExInternal
RTUtf16IsValidEncoding
RTUtf16Len
RTUtf16LittleCalcUtf8Len
RTUtf16LittleCalcUtf8LenEx
RTUtf16LittleToUtf8ExTag
RTUtf16LittleToUtf8Tag
RTUtf16PurgeComplementSet
RTUtf16PutCpInternal
RTUtf16ReallocTag
RTUtf16ToUtf8ExTag
RTUtf16ToUtf8Tag
RTUtf16ValidateEncoding
RTUtf16ValidateEncodingEx
g_pszRTAssertExpr
g_pszRTAssertFile
g_pszRTAssertFunction
g_szRTAssertMsg1
g_szRTAssertMsg2
g_u32RTAssertLine
memchr

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdb98562007e946831febf959c0ec1c

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 111KB - Virtual size: 111KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 51KB

.pdata Size: 7KB - Virtual size: 6KB

.edata Size: 9KB - Virtual size: 8KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 111KB - Virtual size: 111KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 51KB

.pdata
Size: 7KB - Virtual size: 6KB

.edata
Size: 9KB - Virtual size: 8KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 1KB - Virtual size: 1KB