1b4dcfa7f410e9e4462f34ad9ad205fe0310438836e6fd6fa2bb8f24b125a922

Sharing

Copy URL Twitter E-mail

General

Target

1b4dcfa7f410e9e4462f34ad9ad205fe0310438836e6fd6fa2bb8f24b125a922
Size

5.2MB
MD5

93e9c51d70359b14dfe991151d186da2
SHA1

8a31ab717f6527f49093b53c86e87bb4c3e3eb44
SHA256

1b4dcfa7f410e9e4462f34ad9ad205fe0310438836e6fd6fa2bb8f24b125a922
SHA512

f75cedfe4ff4ea7db89a203bff07d95ec713132fafdda9daf8dfb3080e3cba3182dc714134d05659c42cd931ba14c22be7aee095f95c4ee36fe55d068d8fd55b
SSDEEP

98304:CXjW3HgisF2wMpiesS3ygvX3PHD0FmbKuhufNvvH:CXC3Ais4ZipWPHD0YbYfp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b4dcfa7f410e9e4462f34ad9ad205fe0310438836e6fd6fa2bb8f24b125a922

Files

1b4dcfa7f410e9e4462f34ad9ad205fe0310438836e6fd6fa2bb8f24b125a922
.exe windows x64

91190aa88d9c7fe625aed3b7f920ae18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

cng.sys

BCryptGenRandom

ntoskrnl.exe

RtlInitUnicodeString
ZwClose
RtlInitAnsiString
RtlDeleteRegistryValue
RtlAppendUnicodeToString
DbgPrint
ExAllocatePool
ExFreePoolWithTag
MmGetSystemRoutineAddress
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwOpenKey
ZwDeleteKey
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCompareString
MmIsAddressValid
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
RtlPcToFileHeader
RtlImageNtHeader
IoFileObjectType
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
__C_specific_handler
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
MmFreeContiguousMemory
RtlImageDirectoryEntryToData
RtlUnicodeToMultiByteN
KeBugCheckEx
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91190aa88d9c7fe625aed3b7f920ae18

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: 334KB - Virtual size: 334KB

.rdata Size: 214KB - Virtual size: 214KB

.data Size: 1KB - Virtual size: 15KB

.pdata Size: 13KB - Virtual size: 12KB

INIT Size: 2KB - Virtual size: 1KB

.Cc0 Size: 2.9MB - Virtual size: 2.9MB

.Cc1 Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 334KB - Virtual size: 334KB

.rdata
Size: 214KB - Virtual size: 214KB

.data
Size: 1KB - Virtual size: 15KB

.pdata
Size: 13KB - Virtual size: 12KB

INIT
Size: 2KB - Virtual size: 1KB

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 3KB - Virtual size: 2KB