45cc34449d06590fc96574871e0c2faa394fb606e2900dfc461a8f1f92e0728e

Sharing

Copy URL Twitter E-mail

General

Target

45cc34449d06590fc96574871e0c2faa394fb606e2900dfc461a8f1f92e0728e
Size

5.1MB
MD5

fb46c6a62e23a9d24997c64ff1e80a34
SHA1

7999987f7301ffe80f80b67014a915d9d8cf2a55
SHA256

45cc34449d06590fc96574871e0c2faa394fb606e2900dfc461a8f1f92e0728e
SHA512

77a7820df2e9b599fcf06d58e02e195c6978718b35e21b4f4be1a07aa61bccfaf9b0c0c47c35fe72c95ade06eb3d702a04cda971c7066619cd7a909c80a50a3e
SSDEEP

98304:OGntOTNzICgjIH6zvfzr/hTLyY2MXHUH0KWu8:OGt2bgkHEffEY2G0UKWu8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45cc34449d06590fc96574871e0c2faa394fb606e2900dfc461a8f1f92e0728e

Files

45cc34449d06590fc96574871e0c2faa394fb606e2900dfc461a8f1f92e0728e
.exe windows x64

91190aa88d9c7fe625aed3b7f920ae18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

cng.sys

BCryptGenRandom

ntoskrnl.exe

RtlInitUnicodeString
ZwClose
RtlInitAnsiString
RtlDeleteRegistryValue
RtlAppendUnicodeToString
DbgPrint
ExAllocatePool
ExFreePoolWithTag
MmGetSystemRoutineAddress
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwOpenKey
ZwDeleteKey
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlCompareString
MmIsAddressValid
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
RtlPcToFileHeader
RtlImageNtHeader
IoFileObjectType
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
__C_specific_handler
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePoolWithTag
MmFreeContiguousMemory
RtlImageDirectoryEntryToData
RtlUnicodeToMultiByteN
KeBugCheckEx
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91190aa88d9c7fe625aed3b7f920ae18

Headers

DLL Characteristics

File Characteristics

Imports

netio.sys

cng.sys

ntoskrnl.exe

hal

Sections

.text Size: 334KB - Virtual size: 334KB

.rdata Size: 214KB - Virtual size: 214KB

.data Size: 1KB - Virtual size: 15KB

.pdata Size: 13KB - Virtual size: 12KB

INIT Size: 2KB - Virtual size: 1KB

.Cc0 Size: 2.9MB - Virtual size: 2.9MB

.Cc1 Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 334KB - Virtual size: 334KB

.rdata
Size: 214KB - Virtual size: 214KB

.data
Size: 1KB - Virtual size: 15KB

.pdata
Size: 13KB - Virtual size: 12KB

INIT
Size: 2KB - Virtual size: 1KB

.Cc0
Size: 2.9MB - Virtual size: 2.9MB

.Cc1
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 3KB - Virtual size: 2KB