da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7

Sharing

Copy URL Twitter E-mail

General

Target
da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7
Size 93KB
Sample221204-bs5dtaaa7s
SHA256 da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7
MD5 fe71796aa789138700cd4de1cc3603cb
SHA1 1e665076f316cbb77a992137688907b10d86776c
SHA512 b76e63a40b2c88e6f573b543f4dd4f7e559db6938175b5ad1ab028e3a2503f39d3959f5dc4f91cd44417b6dac0fea58c9c15a5dbdb5d6fcd9574b5a23d721343
SSDEEP 1536:wVzXEOXUOyD8HT6OhAVJqNoQrPs2W7IDdXBoDZYkvR5TJWBwEsjG0cXFIQ0bbZPG:wVL/Eiz6OhrNoQzsnwBoDjR51hljrckG
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7

.exe 93KB

da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7

IMPHASH aa15a5bbe11db238a2aeb5dae8703cc6
SHA256 da2301a74547fc4258dab22a3a92d6b471539a9e3b2af6fd67405d218e91fcd7
MD5 fe71796aa789138700cd4de1cc3603cb
SHA1 1e665076f316cbb77a992137688907b10d86776c
SHA512 b76e63a40b2c88e6f573b543f4dd4f7e559db6938175b5ad1ab028e3a2503f39d3959f5dc4f91cd44417b6dac0fea58c9c15a5dbdb5d6fcd9574b5a23d721343
SSDEEP 1536:wVzXEOXUOyD8HT6OhAVJqNoQrPs2W7IDdXBoDZYkvR5TJWBwEsjG0cXFIQ0bbZPG:wVL/Eiz6OhrNoQzsnwBoDjR51hljrckG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

91044

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ntoskrnl.exe

RtlInitUnicodeString swprintf KeSetEvent IoCreateSymbolicLink IoGetConfigurationInformation IoDeleteSymbolicLink MmFreeMappingAddress IoFreeErrorLogEntry IoDisconnectInterrupt MmUnmapIoSpace ObReferenceObjectByPointer IofCompleteRequest RtlCompareUnicodeString IofCallDriver MmAllocateMappingAddress IoAllocateErrorLogEntry IoConnectInterrupt IoDetachDevice KeWaitForSingleObject KeInitializeEvent RtlAnsiStringToUnicodeString RtlInitAnsiString IoBuildDeviceIoControlRequest IoQueueWorkItem MmMapIoSpace IoInvalidateDeviceRelations IoReportDetectedDevice IoReportResourceForDetection RtlxAnsiStringToUnicodeSize NlsMbCodePageTag PoRequestPowerIrp KeInsertByKeyDeviceQueue PoRegisterDeviceForIdleDetection sprintf MmMapLockedPagesSpecifyCache ObfDereferenceObject IoGetAttachedDeviceReference IoInvalidateDeviceState ZwClose ObReferenceObjectByHandle ZwCreateDirectoryObject IoBuildSynchronousFsdRequest PoStartNextPowerIrp PoCallDriver IoCreateDevice IoAllocateDriverObjectExtension RtlQueryRegistryValues ZwOpenKey RtlFreeUnicodeString IoStartTimer KeInitializeTimer IoInitializeTimer KeInitializeDpc KeInitializeSpinLock IoInitializeIrp ZwCreateKey RtlAppendUnicodeStringToString RtlIntegerToUnicodeString ZwSetValueKey KeInsertQueueDpc KefAcquireSpinLockAtDpcLevel IoStartPacket KefReleaseSpinLockFromDpcLevel IoBuildAsynchronousFsdRequest IoFreeMdl MmUnlockPages IoWriteErrorLogEntry KeRemoveByKeyDeviceQueue MmMapLockedPagesWithReservedMapping MmUnmapReservedMapping KeSynchronizeExecution IoStartNextPacket KeBugCheckEx KeRemoveDeviceQueue KeSetTimer KeCancelTimer _allmul MmProbeAndLockPages _except_handler3 PoSetPowerState IoOpenDeviceRegistryKey RtlWriteRegistryValue _aulldiv strstr _strupr KeQuerySystemTime IoWMIRegistrationControl KeTickCount IoAttachDeviceToDeviceStack IoDeleteDevice ExAllocatePoolWithTag IoAllocateWorkItem IoAllocateIrp IoAllocateMdl MmBuildMdlForNonPagedPool MmLockPagableDataSection IoGetDriverObjectExtension MmUnlockPagableImageSection ExFreePoolWithTag IoFreeIrp IoFreeWorkItem InitSafeBootMode RtlCompareMemory RtlCopyUnicodeString memmove MmHighestUserAddress

hal

KfAcquireSpinLock READ_PORT_UCHAR KeGetCurrentIrql KfRaiseIrql KfLowerIrql HalGetInterruptVector HalTranslateBusAddress KeStallExecutionProcessor KfReleaseSpinLock READ_PORT_BUFFER_USHORT READ_PORT_USHORT WRITE_PORT_BUFFER_USHORT WRITE_PORT_UCHAR

wmilib.sys

WmiSystemControl WmiCompleteRequest

Name

.text

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGE

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGESCAN

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGE

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ