General
-
Target
7fb3bf47e56c9836e0edfeddfe8359ce
-
Size
62KB
-
MD5
7fb3bf47e56c9836e0edfeddfe8359ce
-
SHA1
4ada8d8aa4006b8dd98d174ca8d469c5810a169b
-
SHA256
d48242196bb02d73674392ca398fad4714c34ce9852e53ce138f1297d003ba97
-
SHA512
63529a6cbb7558e2987bfd52cd5c01bd83e6d4bdf2491e3f769e1fe6de1683a8a00529e5e5754e9a214b67e13babdfc7b18839ab157f842177d1610fb4f79c5c
-
SSDEEP
1536:HiBvcUtfcX5fS25VmOZG6V0d3oqaQpFOaC:CFtEX5XZG6mlxfpg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7fb3bf47e56c9836e0edfeddfe8359ce
Files
-
7fb3bf47e56c9836e0edfeddfe8359ce.sys windows:5 windows x86 arch:x86
4d61433b1363177baf5ae6962c463e46
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ZwReadFile
ExGetPreviousMode
DbgBreakPointWithStatus
RtlUnicodeStringToAnsiString
ZwSetValueKey
ZwSaveKey
KeDelayExecutionThread
ZwCreateFile
PsCreateSystemThread
DbgBreakPoint
ZwQueryValueKey
ZwQueryDirectoryFile
ZwDeleteFile
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwDeleteKey
DbgPrint
ZwEnumerateKey
ZwWriteFile
_wcsnicmp
wcslen
KeDetachProcess
IoGetCurrentProcess
MmMapViewOfSection
ObReferenceObjectByHandle
KeAttachProcess
ZwOpenProcess
KeServiceDescriptorTable
PsGetCurrentProcessId
MmIsAddressValid
ObfDereferenceObject
MmSectionObjectType
ZwOpenKey
MmUnmapViewOfSection
ObQueryNameString
RtlCompareUnicodeString
ZwClose
IoCreateFile
ExFreePoolWithTag
RtlInitUnicodeString
_except_handler3
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1024B - Virtual size: 772B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ