680e47ccc6ea78a2f8fc891d6b82bbcd818bb09af92efc9bfd7d2f0a8895188f

Sharing

Copy URL Twitter E-mail

General

Target

680e47ccc6ea78a2f8fc891d6b82bbcd818bb09af92efc9bfd7d2f0a8895188f
Size

4.2MB
MD5

7b4ba73cccd91196b0de3527733ebc98
SHA1

79cb729111b7449a53db0cff56c8a346a9c72b8b
SHA256

680e47ccc6ea78a2f8fc891d6b82bbcd818bb09af92efc9bfd7d2f0a8895188f
SHA512

dcc2ed284c7f6c0dd10bb3405362d898896f783d30aada6d20225cfdb4854a39c8cb787376641fcfcf4207b236d8e67a776e5332fa4e0dbd5f98bc64a6c2c2ba
SSDEEP

98304:KCkNh0/K38ePsP2eeRvlVWINhMU+UHn5uzAymSgyaTAss4:Kzq/KM9PFelVWInMskUy7gyaTds

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
680e47ccc6ea78a2f8fc891d6b82bbcd818bb09af92efc9bfd7d2f0a8895188f

Files

680e47ccc6ea78a2f8fc891d6b82bbcd818bb09af92efc9bfd7d2f0a8895188f
.exe windows x64

4a7f466315fcf339507f33ccf6925ac2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

ntoskrnl.exe

_stricmp
_strnicmp
RtlAppendUnicodeToString
KeReleaseSpinLock
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
PsTerminateSystemThread
MmIsAddressValid
ZwQuerySystemInformation
NtTraceControl
RtlImageNtHeader
wcsstr
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetRelatedDeviceObject
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenFile
ZwClose
ZwOpenKey
ZwQueryValueKey
KeStackAttachProcess
KeUnstackDetachProcess
ObGetObjectType
__C_specific_handler
IoFileObjectType
strncpy
strrchr
strtok_s
KeClearEvent
sprintf
atol
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
KeDelayExecutionThread
PsIsThreadTerminating
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
PsGetProcessWow64Process
RtlEqualUnicodeString
PsGetProcessPeb
_strlwr
strstr
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwFlushKey
ZwSetValueKey
PsIsSystemProcess
PsGetProcessImageFileName
RtlCompareUnicodeString
ObReferenceObjectByName
IoDriverObjectType
RtlInitString
KeAcquireSpinLockRaiseToDpc
MmAllocateMappingAddress
ObCloseHandle
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetProcessId
PsGetThreadProcess
IoThreadToProcess
PsGetProcessDebugPort
ObFindHandleForObject
PsProcessType
PsThreadType
MmUserProbeAddress
PsInitialSystemProcess
IoCreateFile
ZwQueryInformationFile
ZwReadFile
ZwWaitForSingleObject
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlTimeToTimeFields
RtlGetVersion
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
MmUnmapLockedPages
PsCreateSystemThread
PsWrapApcWow64Thread
IoCancelIrp
IoReleaseCancelSpinLock
ZwCreateFile
ZwWriteFile
PsGetCurrentThreadId
PsGetProcessExitStatus
PsReferencePrimaryToken
PsDereferencePrimaryToken
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PsReferenceProcessFilePointer
ExEnumHandleTable
ExfUnblockPushLock
KeInitializeApc
KeInsertQueueApc
PsGetCurrentProcessWow64Process
KeTestAlertThread
PsGetThreadTeb
strchr
KeBugCheckEx

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.LTQ0
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a7f466315fcf339507f33ccf6925ac2

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

netio.sys

ntoskrnl.exe

Sections

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 28KB - Virtual size: 31KB

.pdata Size: 3KB - Virtual size: 2KB

INIT Size: 4KB - Virtual size: 4KB

.LTQ0 Size: 4.0MB - Virtual size: 4.0MB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 28KB - Virtual size: 31KB

.pdata
Size: 3KB - Virtual size: 2KB

INIT
Size: 4KB - Virtual size: 4KB

.LTQ0
Size: 4.0MB - Virtual size: 4.0MB

.reloc
Size: 2KB - Virtual size: 1KB