c95aae36f4b6925fc9795c9b7faaf108d5465bcee8caed310874d4a4210f9d62

General

Target

c95aae36f4b6925fc9795c9b7faaf108d5465bcee8caed310874d4a4210f9d62
Size

27KB
MD5

a9b3d68ac453ccd89e5f240212928fcb
SHA1

2c251539e6eb71dc2e18f8200d1ce7a19a8e0591
SHA256

c95aae36f4b6925fc9795c9b7faaf108d5465bcee8caed310874d4a4210f9d62
SHA512

0fbf14d13e6fa28787fcf99385ed965afb92c748a6d5331bc59d2fb692bc35beb1a80bd61f3964228d4090ea0fd1bee551db495fc594879705869f34dd44dac3
SSDEEP

384:IGWs9VLt8arJfpE6F3BWsKdP0pBkZQq8X1kY0HVxuECqvjp+8/De26xaNJ:IjsrrLP3AJdP8mZQeYCWqrQCGE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c95aae36f4b6925fc9795c9b7faaf108d5465bcee8caed310874d4a4210f9d62

Files

c95aae36f4b6925fc9795c9b7faaf108d5465bcee8caed310874d4a4210f9d62
.exe windows x64

56c7c3b10b76304095eee730fce74203

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlCompareMemory
IoWMIRegistrationControl
swprintf
IoGetDeviceProperty
ObfDereferenceObject
MmUnmapIoSpace
MmMapIoSpace
MmGetSystemRoutineAddress
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeSetEvent
ObReferenceObjectByHandle
KeBugCheckEx
RtlCopyUnicodeString
ExFreePoolWithTag
IoWMIWriteEvent
ExAllocatePoolWithTag
IoGetDmaAdapter
RtlInitUnicodeString

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56c7c3b10b76304095eee730fce74203

Headers

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 636B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 512B - Virtual size: 96B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 636B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 512B - Virtual size: 96B