General
-
Target
9666754ca40b1b6b72730774bcba6312
-
Size
22KB
-
MD5
9666754ca40b1b6b72730774bcba6312
-
SHA1
8b720bafe424928fc2ab8bf66e1926b71da59527
-
SHA256
dd2057ba6dc5866cf91a11bb547999ee12d49eb7525ca2f37eaa94151e28c2d3
-
SHA512
03769278dc6bad697c8b18dfef4db186e43a8ba2ed6470276d9f6edb96e93c8a2aa95428c77aa57e45f65fe9dade5b3823470a0ba78dfdb70df17a13241271fc
-
SSDEEP
384:Pj9V637WE4eMCMoNO6fu9PoMBHsoH6EoBK0ch:PhVy7WRiMoO6fgPJyoalBK3h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9666754ca40b1b6b72730774bcba6312
Files
-
9666754ca40b1b6b72730774bcba6312.sys windows:6 windows x86 arch:x86
398a30f7d528467e28bfb0fa068e0ee3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
ObfDereferenceObject
ExAllocatePoolWithTag
IoDriverObjectType
RtlInitUnicodeString
KeTickCount
IoGetDeviceProperty
RtlCompareMemory
IofCompleteRequest
ObReferenceObjectByName
ExFreePoolWithTag
DbgPrint
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql
HalMakeBeep
Sections
.text Size: 1024B - Virtual size: 940B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 193B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 654B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 512B - Virtual size: 210B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ