0548eb5a1be1c80778e08dc8365f5e70

Sharing

Copy URL Twitter E-mail

General

Target

0548eb5a1be1c80778e08dc8365f5e70
Size

149KB
MD5

0548eb5a1be1c80778e08dc8365f5e70
SHA1

3e203f4e2179e67978cc55b80666e2a3de2c0bac
SHA256

71f93c3e0a694efcb908ba9424ccf8e0de82ced2ac4c2bf21de2ca65f96b9602
SHA512

0d868bf5f2207951ee2a383fde2bbc843039a4bcb323a473cac1bb83ea0bffaab55fd61fd31016f38a53a0f3dd98c3b96c19a092ab0ccdd29c1741d4d0ef4c84
SSDEEP

3072:HzAVJCwpNRvoCaGB0mN31AhortTci/3TRpHOGGDy+exmHr:TAVJCwlQCFXN308cC/O3O5+r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0548eb5a1be1c80778e08dc8365f5e70

Files

0548eb5a1be1c80778e08dc8365f5e70
.sys windows:5 windows x86 arch:x86

614b4deedb9efd409ab8ca9054c28155

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteDevice
MmGetSystemRoutineAddress
RtlInitUnicodeString
wcscpy
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwClose
ZwQueryInformationFile
ZwOpenFile
ZwQueryValueKey
ZwOpenKey
strncmp
IoGetCurrentProcess
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
_stricmp
ZwUnmapViewOfSection
IofCompleteRequest
KeSetEvent
_except_handler3
KeClearEvent
IoCreateNotificationEvent
ObfDereferenceObject
PsLookupProcessByProcessId
ZwWriteFile
wcscat
PsGetVersion
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
KeWaitForSingleObject
MmUnlockPages
KeInsertQueueApc
KeInitializeApc
KeInitializeEvent
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
ZwAllocateVirtualMemory
ZwOpenProcess
PsCreateSystemThread
IoCreateDevice

Exports

Exports

?CloseDriverA2@@YGHXZ
?CloseDriverA3@@YGHXZ
?CloseDriverA4@@YGHXZ
?CloseDriverA@@YGHXZ
?CloseDriverW2@@YGHXZ
?CloseDriverW3@@YGHXZ
?CloseDriverW4@@YGHXZ
?CloseDriverW@@YGHXZ
?OpenDriverA2@@YGHXZ
?OpenDriverA3@@YGHXZ
?OpenDriverA4@@YGHXZ
?OpenDriverA@@YGHXZ
?OpenDriverW2@@YGHXZ
?OpenDriverW3@@YGHXZ
?OpenDriverW4@@YGHXZ
?OpenDriverW@@YGHXZ

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mdata
Size: 128B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 640B - Virtual size: 553B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

614b4deedb9efd409ab8ca9054c28155

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 640B - Virtual size: 520B

.data Size: 2KB - Virtual size: 2KB

.mdata Size: 128B - Virtual size: 4B

.edata Size: 640B - Virtual size: 553B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 606B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 640B - Virtual size: 520B

.data
Size: 2KB - Virtual size: 2KB

.mdata
Size: 128B - Virtual size: 4B

.edata
Size: 640B - Virtual size: 553B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 606B