0f7b5886e0f1111c17b2e8adff3ed68375d967785c30027a9b52c4d082b80cc5

General

Target

0f7b5886e0f1111c17b2e8adff3ed68375d967785c30027a9b52c4d082b80cc5
Size

16KB
MD5

cd2314c899ffaa4588bc59e6baf6dfb3
SHA1

b20a92201740a9cf40f4096a979d6fc9dc2017fa
SHA256

0f7b5886e0f1111c17b2e8adff3ed68375d967785c30027a9b52c4d082b80cc5
SHA512

7851f92494e960669fd3ab51a34e971e21d75caec205b85e3f16cdc1f92a14e3de3687ea35db45e974a28ddb0d20f016215926c4ed12a9f6de5580e34ba4b6f5
SSDEEP

192:ZBWUIbHMdSvUqT4YczisdlqwsRXEnDZJUPwfoqSffplGp99P00e/NcX1eX:ZBWTbHSSvUqT45ewjUPwf+3pli9M0Oc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f7b5886e0f1111c17b2e8adff3ed68375d967785c30027a9b52c4d082b80cc5

Files

0f7b5886e0f1111c17b2e8adff3ed68375d967785c30027a9b52c4d082b80cc5
.exe windows x64

bfc360bfd5fe692101d39ff221fd2856

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlCopyUnicodeString
RtlInitUnicodeString
IoWMIRegistrationControl
MmGetSystemRoutineAddress
DbgPrintEx

wpprecorder.sys

WppAutoLogStop
imp_WppRecorderReplay
WppAutoLogStart
WppAutoLogTrace

wdfldr.sys

WdfVersionUnbindClass
WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfc360bfd5fe692101d39ff221fd2856

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

wpprecorder.sys

wdfldr.sys

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 912B

.pdata Size: 512B - Virtual size: 312B

PAGE Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.vmp0 Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 44B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 912B

.pdata
Size: 512B - Virtual size: 312B

PAGE
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.vmp0
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 44B