5e8668a38e8152fe9f5ebf1e6c621a0e4b311caa17d9de289d02148e5cee9852

Sharing

Copy URL Twitter E-mail

General

Target

5e8668a38e8152fe9f5ebf1e6c621a0e4b311caa17d9de289d02148e5cee9852
Size

4.3MB
MD5

7307f39a548258dbf1e3bd0745510b04
SHA1

b1e959feb9b65a7bf1a9a32dfef810695a7dfe99
SHA256

5e8668a38e8152fe9f5ebf1e6c621a0e4b311caa17d9de289d02148e5cee9852
SHA512

8e43712a085e2043cebc7f38ddaeaf32dbf44e4b76af1f1bc13b1bcb34c43ee09c6dc328f6523f1c53992daab4b11a133721ec76076ef8966d343e2d2b170378
SSDEEP

49152:PLfj7y8jeu//RRofP7XArlNGuMzvA0zGv2avsO03Wi9G+NVmTQjT+hDfftRjDx0J:PTj7yOesforQlNGjvejPUTsnjIwUD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e8668a38e8152fe9f5ebf1e6c621a0e4b311caa17d9de289d02148e5cee9852

Files

5e8668a38e8152fe9f5ebf1e6c621a0e4b311caa17d9de289d02148e5cee9852
.exe windows x64

18af39708c0a54c75ef59097a64cdf89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltUnregisterFilter
FltStartFiltering
FltRegisterFilter

ntoskrnl.exe

ExAllocatePool
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
ZwCreateFile
ZwReadFile
ZwClose
PsGetCurrentProcessId
ZwTerminateProcess
ZwOpenProcess
__C_specific_handler
IoGetCurrentProcess
ObReferenceObjectByHandle
ObfDereferenceObject
NtBuildNumber
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwWriteFile
_snprintf
_vsnprintf
ZwQueryInformationFile
RtlCompareUnicodeStrings
strncmp
RtlCompareMemory
RtlImageNtHeader
RtlCompareUnicodeString
ExAllocatePoolWithTag
isupper
isdigit
tolower
_stricmp
strstr
wcscat
wcslen
_wcsicmp
RtlInitAnsiString
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
RtlFreeUnicodeString
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutineEx
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessPeb
PsGetProcessSessionId
RtlCreateRegistryKey
_vsnwprintf
RtlRandomEx
KeBugCheckEx
strlen
RtlInitUnicodeString
strcmp
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gg0
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gg1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gg2
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18af39708c0a54c75ef59097a64cdf89

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

hal

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 512KB

.pdata Size: 1024B - Virtual size: 924B

PAGE Size: 512B - Virtual size: 140B

INIT Size: 2KB - Virtual size: 1KB

.gg0 Size: 2.7MB - Virtual size: 2.7MB

.gg1 Size: 1KB - Virtual size: 1KB

.gg2 Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 512B - Virtual size: 480B

.rsrc Size: 1024B - Virtual size: 608B

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 512KB

.pdata
Size: 1024B - Virtual size: 924B

PAGE
Size: 512B - Virtual size: 140B

INIT
Size: 2KB - Virtual size: 1KB

.gg0
Size: 2.7MB - Virtual size: 2.7MB

.gg1
Size: 1KB - Virtual size: 1KB

.gg2
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 480B

.rsrc
Size: 1024B - Virtual size: 608B