d:\code\vipm\appmanger\bin\i386\Yotect2.pdb
General
-
Target
d2ca1cea4748e6b9ccadb21e7f208fb0N.exe
-
Size
456KB
-
MD5
d2ca1cea4748e6b9ccadb21e7f208fb0
-
SHA1
55b530a8d6fd383abdc6a25aed29c694f38820b9
-
SHA256
fb28b6ce53349f97ce0482ed757422aa3bb438e5557a43916e2fa9e5158d4334
-
SHA512
d13ab82c65220ae348c73c4aa0eb90cc3e35a8157de845c009da8582041a698b4fca5023027a18e9ee2a7c7c23ec6582a1c3dfb75e6436fbbca7217969edec17
-
SSDEEP
12288:7sNt72Dz63xrM2y+OcS3PeQ0z8RxA2yxgaQl0cmYyNl:QNtEY+r0TkJSceP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2ca1cea4748e6b9ccadb21e7f208fb0N.exe
Files
-
d2ca1cea4748e6b9ccadb21e7f208fb0N.exe.sys windows:6 windows x86 arch:x86
44eaba3e2ad1a4d3a7bb96134726a91a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_stricmp
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEDATA Size: - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 454KB - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ