03f417b2a3d41fc0921c2a60d7967c0f

Sharing

Copy URL

Twitter E-mail

General

Target

03f417b2a3d41fc0921c2a60d7967c0f
Size

353KB
MD5

03f417b2a3d41fc0921c2a60d7967c0f
SHA1

aeb27dd06132e462fe21a5533a4f7ff29e361d90
SHA256

32f173fb345ab1384a2687996bfeb75958abaf1e665dcc2300c17e0415cd943c
SHA512

46783f614c1f1287b9c45e98eaeb5c20934c9b01615f1e7d9e7b333a229a6d217fbf63f90757b332cc7e3cd1c80f94c24da66f8701272cfcc509ac1ea3bd6a88
SSDEEP

6144:EJVxTJMCOHOcecOeaVrith/CC/LxGh5wCQCzKLQ/xaczH:EDxTl2OzryZCAQ4CQDQ/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03f417b2a3d41fc0921c2a60d7967c0f

Files

03f417b2a3d41fc0921c2a60d7967c0f
.sys windows:5 windows x86 arch:x86

be8f8048c4b29418508dc0c6096b5227

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KfLowerIrql
KeRaiseIrqlToDpcLevel
KfReleaseSpinLock
KfAcquireSpinLock
KfRaiseIrql
KeGetCurrentIrql
KeQueryPerformanceCounter
ExAcquireFastMutex
ExReleaseFastMutex

ndis.sys

NdisCloseAdapter
NdisCancelSendPackets
NdisFreePacket
NdisUnchainBufferAtFront
NdisCompletePnPEvent
NdisFreePacketPool
NdisRequest
NdisAllocatePacket
NdisFreeMemory
NdisQueryAdapterInstanceName
NdisGetDriverHandle
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisGetReceivedPacket
NdisRegisterProtocol
NdisAllocateBuffer
NdisSetPacketPoolProtocolId
NdisReturnPackets
NdisCopyBuffer
NdisAllocateBufferPool
NdisFreeBufferPool
NdisReEnumerateProtocolBindings
NdisCompleteBindAdapter

ntoskrnl.exe

IoCreateDevice
_wcsicmp
wcscpy
wcsncpy
wcschr
ZwSetInformationThread
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeQueryTimeIncrement
KeSetEvent
IoDeleteSymbolicLink
ExDeleteNPagedLookasideList
KeDelayExecutionThread
ZwOpenKey
KeSetTimerEx
KeInitializeTimer
KeInitializeDpc
ExInitializeNPagedLookasideList
MmLockPagableSectionByHandle
ZwQueryValueKey
ZwSetValueKey
InterlockedPopEntrySList
InterlockedPushEntrySList
ExIsProcessorFeaturePresent
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
RtlAddAce
RtlGetAce
IoCreateSymbolicLink
RtlInitializeSid
RtlLengthRequiredSid
ObSetSecurityObjectByPointer
RtlSelfRelativeToAbsoluteSD
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlVerifyVersionInfo
VerSetConditionMask
IoWMIRegistrationControl
IoGetCurrentProcess
KeInitializeTimerEx
RtlExtendedIntegerMultiply
KeQueryInterruptTime
_aulldiv
DbgBreakPoint
KeSetTargetProcessorDpc
RtlSetBit
SeUnlockSubjectContext
SeAccessCheck
SeLockSubjectContext
ObDereferenceSecurityDescriptor
PsGetCurrentProcessId
RtlWalkFrameChain
ExNotifyCallback
ExCreateCallback
ObReferenceObjectByHandle
MmUnlockPages
SeFreePrivileges
SeAppendPrivileges
ObLogSecurityDescriptor
SeAssignSecurity
IoFileObjectType
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
ProbeForWrite
ObfReferenceObject
PsGetCurrentProcess
RtlPrefetchMemoryNonTemporal
KeInitializeMutex
MmIsThisAnNtAsSystem
KeWaitForSingleObject
KeReleaseMutex
KeReadStateEvent
IoDeleteDevice
ZwEnumerateValueKey
RtlUnicodeStringToInteger
RtlIpv4StringToAddressW
RtlTimeToTimeFields
ExLocalTimeToSystemTime
RtlExtendedMagicDivide
RtlAppendUnicodeToString
ZwClose
_allmul
MmQuerySystemSize
RtlCompareUnicodeString
RtlInitializeBitMap
RtlClearAllBits
RtlSetBits
wcslen
RtlAreBitsSet
RtlClearBits
RtlFindClearBitsAndSet
RtlFindClearRuns
DbgPrint
memmove
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
ZwLoadDriver
KeResetEvent
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
IofCompleteRequest
ExfInterlockedAddUlong
MmMapLockedPagesSpecifyCache
IoFreeMdl
ExfInterlockedInsertTailList
RtlInitUnicodeString
MmMapLockedPages
KeNumberProcessors
RtlUnicodeStringToAnsiString
MmLockPagableDataSection
MmUnlockPagableImageSection
RtlCompareMemory
ExAllocatePoolWithTag
KeCancelTimer
KeClearEvent
RtlAnsiStringToUnicodeString
IoRaiseInformationalHardError
KeInitializeEvent
ExFreePoolWithTag
ExAllocatePoolWithTagPriority
KeInitializeSpinLock
_alldiv
KeQuerySystemTime
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeBugCheckEx
RtlSubAuthoritySid
KeTickCount
MmBuildMdlForNonPagedPool
ZwDeviceIoControlFile
ZwCreateFile

tdi.sys

CTESystemUpTime
CTEBlock
CTELogEvent
CTESignal
CTEBlockWithTracker
CTEStartTimer
CTEInitEvent
CTEScheduleDelayedEvent
CTEInitTimer
TdiProviderReady
CTEInitialize
TdiDeregisterNetAddress
TdiRegisterNetAddress
TdiDeregisterDeviceObject
TdiRegisterDeviceObject
TdiDeregisterProvider
TdiRegisterProvider
TdiPnPPowerRequest
TdiCopyMdlChainToMdlChain
TdiInitialize
TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers
CTEScheduleEvent
TdiCopyBufferToMdl
CTERemoveBlockTracker
CTEInsertBlockTracker
TdiMapUserRequest
TdiCopyBufferToMdlWithReservedMappingAtDpcLevel

Exports

Exports

ARPRcv
ARPRcvPacket
FreeIprBuff
GetIFAndLink
IPAddInterface
IPAllocBuff
IPDelInterface
IPDelayedNdisReEnumerateBindings
IPDeregisterARP
IPDisableSniffer
IPEnableSniffer
IPFreeBuff
IPGetAddrType
IPGetBestInterface
IPGetInfo
IPInjectPkt
IPProxyNdisRequest
IPRcvComplete
IPRcvPacket
IPRegisterARP
IPRegisterProtocol
IPSetIPSecStatus
IPTransmit
LookupRoute
LookupRouteInformation
LookupRouteInformationWithBuffer
SendICMPErr
SetIPSecPtr
UnSetIPSecPtr
UnSetIPSecSendPtr
tcpxsum

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEIPMc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 896B - Virtual size: 833B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be8f8048c4b29418508dc0c6096b5227

Headers

File Characteristics

Imports

hal

ndis.sys

ntoskrnl.exe

tdi.sys

Exports

Exports

Sections

.text Size: 252KB - Virtual size: 252KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 41KB - Virtual size: 41KB

PAGE Size: 8KB - Virtual size: 7KB

PAGELK Size: 1KB - Virtual size: 1KB

PAGEIPMc Size: 10KB - Virtual size: 9KB

.edata Size: 896B - Virtual size: 833B

INIT Size: 22KB - Virtual size: 22KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 252KB - Virtual size: 252KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 41KB - Virtual size: 41KB

PAGE
Size: 8KB - Virtual size: 7KB

PAGELK
Size: 1KB - Virtual size: 1KB

PAGEIPMc
Size: 10KB - Virtual size: 9KB

.edata
Size: 896B - Virtual size: 833B

INIT
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 13KB - Virtual size: 13KB