General
-
Target
d503f96e640ea93b90becd873aea7db2
-
Size
288KB
-
MD5
d503f96e640ea93b90becd873aea7db2
-
SHA1
4afbf768f4906d3350d6ee9bbd904edd68955f21
-
SHA256
225b7f227d97d5d3ea6b93b4ccf8edb60f8b6921f2bcb57bd61ca7cbc002f788
-
SHA512
0b53c2b3274d3f41b66844d295de409674a56b30d3252e542385f75c77f447dfada1089a2cbbe812dd44c0d135222babf1a6ed6ccbdc7443b9427f100aafff18
-
SSDEEP
6144:TTL10NwZjZofAeDC4yHf+H3QCuplrIsypvSZLb1+RyPICb:TVwwpZGAwwcF+gX/c
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d503f96e640ea93b90becd873aea7db2
Files
-
d503f96e640ea93b90becd873aea7db2.sys windows:6 windows x86 arch:x86
9c7d4abdd7297c0e18e81915ceec568d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
ExAllocatePool
KeDelayExecutionThread
memcpy
memset
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
IoFreeIrp
IoFreeMdl
KeSetEvent
IoGetDeviceObjectPointer
_vsnwprintf
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
_allmul
KeGetCurrentThread
RtlAssert
ZwCreateFile
IoGetDeviceAttachmentBaseRef
PsCreateSystemThread
PsGetVersion
RtlQueryRegistryValues
KeTickCount
KeQueryTimeIncrement
_alldiv
IoBuildDeviceIoControlRequest
RtlUpperChar
RtlUpcaseUnicodeChar
_aulldiv
_aullrem
strchr
strncpy
RtlAnsiStringToUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
IoCancelIrp
ExAllocatePoolWithTag
MmIsAddressValid
KeBugCheckEx
ZwWriteFile
ZwClose
IofCompleteRequest
ExFreePoolWithTag
RtlUnwind
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
HalMakeBeep
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ