7d503fd81c1a733aca57969361304419ebc457736916c9286a4e8e87c0d2a9ee

Sharing

Copy URL

Twitter E-mail

General

Target

7d503fd81c1a733aca57969361304419ebc457736916c9286a4e8e87c0d2a9ee
Size

142KB
MD5

8abb4c08bcfa1c09bff0696908de4244
SHA1

fbb137664b55aa033b54339cd17513c8eb2ded92
SHA256

7d503fd81c1a733aca57969361304419ebc457736916c9286a4e8e87c0d2a9ee
SHA512

a78d8b46e82e271b84060240e4379c2175c36ca1f7eebc6a30abeda7bfcfc52613e7447976afe70ca67faab95b64c0cfdff018e7df924c58f8e5e9cfa52ba62c
SSDEEP

1536:i3BbkqDjq6Zrmdl4XUwdcH5UKdaplbpcjdMgFAzNsW12vQOUUrSabqK4zxCaoQlE:AiqDjDrmn4eHJd6WjSgKNCmQ1KU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d503fd81c1a733aca57969361304419ebc457736916c9286a4e8e87c0d2a9ee

Files

7d503fd81c1a733aca57969361304419ebc457736916c9286a4e8e87c0d2a9ee
.exe windows x64

4a7f466315fcf339507f33ccf6925ac2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

ntoskrnl.exe

_stricmp
_strnicmp
RtlAppendUnicodeToString
KeReleaseSpinLock
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
PsTerminateSystemThread
MmIsAddressValid
ZwQuerySystemInformation
NtTraceControl
RtlImageNtHeader
wcsstr
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetRelatedDeviceObject
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenFile
ZwClose
ZwOpenKey
ZwQueryValueKey
KeStackAttachProcess
KeUnstackDetachProcess
ObGetObjectType
__C_specific_handler
IoFileObjectType
strncpy
strrchr
strtok_s
KeClearEvent
sprintf
atol
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
KeDelayExecutionThread
PsIsThreadTerminating
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
PsGetProcessWow64Process
RtlEqualUnicodeString
PsGetProcessPeb
_strlwr
strstr
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwFlushKey
ZwSetValueKey
PsIsSystemProcess
PsGetProcessImageFileName
RtlCompareUnicodeString
ObReferenceObjectByName
IoDriverObjectType
RtlInitString
KeAcquireSpinLockRaiseToDpc
MmAllocateMappingAddress
ObCloseHandle
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetProcessId
PsGetThreadProcess
IoThreadToProcess
PsGetProcessDebugPort
ObFindHandleForObject
PsProcessType
PsThreadType
MmUserProbeAddress
PsInitialSystemProcess
IoCreateFile
ZwQueryInformationFile
ZwReadFile
ZwWaitForSingleObject
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlTimeToTimeFields
RtlGetVersion
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
MmUnmapLockedPages
PsCreateSystemThread
PsWrapApcWow64Thread
IoCancelIrp
IoReleaseCancelSpinLock
ZwCreateFile
ZwWriteFile
PsGetCurrentThreadId
PsGetProcessExitStatus
PsReferencePrimaryToken
PsDereferencePrimaryToken
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PsReferenceProcessFilePointer
ExEnumHandleTable
ExfUnblockPushLock
KeInitializeApc
KeInsertQueueApc
PsGetCurrentProcessWow64Process
KeTestAlertThread
PsGetThreadTeb
strchr
KeBugCheckEx

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a7f466315fcf339507f33ccf6925ac2

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

netio.sys

ntoskrnl.exe

Sections

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 28KB - Virtual size: 31KB

.pdata Size: 3KB - Virtual size: 2KB

INIT Size: 4KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 28KB - Virtual size: 31KB

.pdata
Size: 3KB - Virtual size: 2KB

INIT
Size: 4KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB