157600a6a7692534af9c9310d1ac4e494e06f05a56503700a9269eeba734ee7d

General

Target

157600a6a7692534af9c9310d1ac4e494e06f05a56503700a9269eeba734ee7d
Size

23KB
MD5

68b29a3d46631be038c501e432d953a8
SHA1

5c7c01509e98fc9c8eb2d25a2904e44a9db192be
SHA256

157600a6a7692534af9c9310d1ac4e494e06f05a56503700a9269eeba734ee7d
SHA512

2e812c87c0d8fc9f042a94f89a9a90685b154698dd7c59d5aaba68c1b2cc267bc75bb5874c77f876d2e96cc86468c6c1db0614146fa00313a46bf9f4f1188077
SSDEEP

192:vETqLsKMVacRjLwxHg+61oSURo6uwcct1+QO+Yc2CPtit6Is6ZVY:sTqRcan7ccOQO+5H8t6RWVY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
157600a6a7692534af9c9310d1ac4e494e06f05a56503700a9269eeba734ee7d

Files

157600a6a7692534af9c9310d1ac4e494e06f05a56503700a9269eeba734ee7d
.exe windows x64

def22dcd6d4d616323b7391f1260b926

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ObfDereferenceObject
ExAcquireResourceExclusiveLite
ObCloseHandle
IoCreateFileEx
PsCreateSystemThread
ZwQueryInformationThread
RtlInitUnicodeString
RtlLookupElementGenericTableAvl
IoDeleteDevice
ObReferenceObjectByHandleWithTag
IoDeleteSymbolicLink
IoFileObjectType
RtlImageNtHeader
PsThreadType
RtlInitAnsiString
RtlDeleteElementGenericTableAvl
RtlGetVersion
ExReleaseResourceLite
KeCapturePersistentThreadState
wcsstr
RtlCompareString
ZwDeleteFile
IoCreateDevice
ExFreePoolWithTag
strstr
IofCompleteRequest
KeWaitForSingleObject
IoCreateSymbolicLink
MmFlushImageSection
PsTerminateSystemThread
RtlCaptureContext
RtlCopyUnicodeString
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
ObReferenceObjectByHandle
ExAllocatePool

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

def22dcd6d4d616323b7391f1260b926

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 648B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 36B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 648B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 36B