open VM devices

[williballenthin]

5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB

# generated using capa explorer for IDA Pro
rule:
  meta:
    name: access VM device
    namespace: anti-analysis/anti-vm/vm-detection
    authors:
      - wballenthin@hex-rays.com
    scopes:
      static: basic block
      dynamic: call
    examples:
      - 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a:0x1400016FB
  features:
    - and:
      - api: CreateFile
      - or:
        - string: "\\\\.\\VBoxGuest"
        - string: "\\\\.\\VBoxTrayIPC"
        - string: "\\\\.\\vmci"
        - string: "\\\\.\\HGFS"