General
-
Target
c06cbcefdeadf73d4ebb63e53a1c3e0a
-
Size
62KB
-
MD5
c06cbcefdeadf73d4ebb63e53a1c3e0a
-
SHA1
36aa8eaf00391652a90fb20cade75941f3b3b5f3
-
SHA256
79ef9972e2a00e55ca879908bfc2b6f6ef62085a1868590ce2ea4528c93d5759
-
SHA512
d6d7445a5e70cececa9dfca10c65f0bec200bf8a51e571dcec9af5decfb82d9a02dffda65f0f1a0b6ece31f030217158e5629c5752ed72c40e0464bcb1a048ac
-
SSDEEP
1536:tiBvcUtfcX5fS25VmOEG6V0d3oqaQpFOaC:4FtEX5XEG6mlxfpg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c06cbcefdeadf73d4ebb63e53a1c3e0a
Files
-
c06cbcefdeadf73d4ebb63e53a1c3e0a.sys windows:5 windows x86 arch:x86
4d61433b1363177baf5ae6962c463e46
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ZwReadFile
ExGetPreviousMode
DbgBreakPointWithStatus
RtlUnicodeStringToAnsiString
ZwSetValueKey
ZwSaveKey
KeDelayExecutionThread
ZwCreateFile
PsCreateSystemThread
DbgBreakPoint
ZwQueryValueKey
ZwQueryDirectoryFile
ZwDeleteFile
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwDeleteKey
DbgPrint
ZwEnumerateKey
ZwWriteFile
_wcsnicmp
wcslen
KeDetachProcess
IoGetCurrentProcess
MmMapViewOfSection
ObReferenceObjectByHandle
KeAttachProcess
ZwOpenProcess
KeServiceDescriptorTable
PsGetCurrentProcessId
MmIsAddressValid
ObfDereferenceObject
MmSectionObjectType
ZwOpenKey
MmUnmapViewOfSection
ObQueryNameString
RtlCompareUnicodeString
ZwClose
IoCreateFile
ExFreePoolWithTag
RtlInitUnicodeString
_except_handler3
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1024B - Virtual size: 772B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ