85e2669e6394b207fd8d2dbb50766109996dede2c279b2ea2a3e34a0f7f00b9a

Sharing

Copy URL Twitter E-mail

General

Target

85e2669e6394b207fd8d2dbb50766109996dede2c279b2ea2a3e34a0f7f00b9a
Size

4.4MB
MD5

bda46708f4867d08fc654eac40835f47
SHA1

8c95055d8ff27b3fd0c45563494c9813071392bb
SHA256

85e2669e6394b207fd8d2dbb50766109996dede2c279b2ea2a3e34a0f7f00b9a
SHA512

f60e6cf72b00fdaf0a96fd974e60b120ffd3311eb465a3349e4d7ea558547dee25192646736dcd0b16c44a3099a96f1a603ad37ee36bf9a7b46cb927796bdae6
SSDEEP

98304:BNSZ8Z77z0ZSpdvNHKSJ/AO/m+5oWfoGzid2bT:mZqPekdvNHvfo9d6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85e2669e6394b207fd8d2dbb50766109996dede2c279b2ea2a3e34a0f7f00b9a

Files

85e2669e6394b207fd8d2dbb50766109996dede2c279b2ea2a3e34a0f7f00b9a
.exe windows x64

44e6eaaa7849c253502db2659e758756

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI

cng.sys

BCryptGenRandom

ntoskrnl.exe

RtlInitUnicodeString
_stricmp
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mfast0
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mfast1
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mfast2
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44e6eaaa7849c253502db2659e758756

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 334KB

.rdata Size: - Virtual size: 214KB

.data Size: - Virtual size: 15KB

.pdata Size: - Virtual size: 12KB

INIT Size: - Virtual size: 1KB

.mfast0 Size: - Virtual size: 3.0MB

.mfast1 Size: 512B - Virtual size: 8B

.mfast2 Size: 4.4MB - Virtual size: 4.4MB

.reloc Size: 512B - Virtual size: 160B

.text
Size: - Virtual size: 334KB

.rdata
Size: - Virtual size: 214KB

.data
Size: - Virtual size: 15KB

.pdata
Size: - Virtual size: 12KB

INIT
Size: - Virtual size: 1KB

.mfast0
Size: - Virtual size: 3.0MB

.mfast1
Size: 512B - Virtual size: 8B

.mfast2
Size: 4.4MB - Virtual size: 4.4MB

.reloc
Size: 512B - Virtual size: 160B