General
-
Target
d6dfc559c5a7e418e92e9335b20bdff6
-
Size
288KB
-
MD5
d6dfc559c5a7e418e92e9335b20bdff6
-
SHA1
7b18d6992b375d784ac3c34dddf310a80403eae9
-
SHA256
95528e7d8c2af87f15ffec8befdaa7f91023d02117b17cc7be68468235ec5f49
-
SHA512
3007dd9d08c2f801b18acbcdb9ee260469fd6aeb8ea283f5e2e85e56d94d2702b67cc2da2d968dfb7f80902dc82faf5a5bf23c2a0d00c17402fe09c46db9b42c
-
SSDEEP
6144:50Zvah7AU3Uxb2VCQBx+petpIBj06gWiw0VDa6c:50ZvMADlMmetp4xtcDa6c
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6dfc559c5a7e418e92e9335b20bdff6
Files
-
d6dfc559c5a7e418e92e9335b20bdff6.sys windows:6 windows x86 arch:x86
9c7d4abdd7297c0e18e81915ceec568d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
ExAllocatePool
KeDelayExecutionThread
memcpy
memset
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
IoFreeIrp
IoFreeMdl
KeSetEvent
IoGetDeviceObjectPointer
_vsnwprintf
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
_allmul
KeGetCurrentThread
RtlAssert
ZwCreateFile
IoGetDeviceAttachmentBaseRef
PsCreateSystemThread
PsGetVersion
RtlQueryRegistryValues
KeTickCount
KeQueryTimeIncrement
_alldiv
IoBuildDeviceIoControlRequest
RtlUpperChar
RtlUpcaseUnicodeChar
_aulldiv
_aullrem
strchr
strncpy
RtlAnsiStringToUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
IoCancelIrp
ExAllocatePoolWithTag
MmIsAddressValid
KeBugCheckEx
ZwWriteFile
ZwClose
IofCompleteRequest
ExFreePoolWithTag
RtlUnwind
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
HalMakeBeep
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ