6b031371fdf1b748bd1ae4681dc85246

Sharing

Copy URL

Twitter E-mail

General

Target

6b031371fdf1b748bd1ae4681dc85246
Size

264KB
MD5

6b031371fdf1b748bd1ae4681dc85246
SHA1

96790a693201f6f23c298e01d9b6b13a2ba7459e
SHA256

42e6fe1b14703389edf376c94c479531a16c936f6bab8205fd1796547708a723
SHA512

6be9df7463f08611aa0239da6dcdc21ae53ba81459ef2b720eaae1cd40f38ff09d194b783ce5706aa13f5d03d66046b4298137a19bfbf2cf5a33c377e1e33ccd
SSDEEP

6144:HajQKnVM4Anf24dbqwJewka6w+/KVRauyXGe:6jzVMN24dbqwJeOtnyXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b031371fdf1b748bd1ae4681dc85246

Files

6b031371fdf1b748bd1ae4681dc85246
.dll windows:5 windows x86 arch:x86

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeSaveStateForHibernate
KeUpdateSystemTime
KeUpdateRunTime
Kei386EoiHelper
KdEnteredDebugger
KiIpiServiceRoutine
KeProfileInterrupt
KeSetEventBoostPriority
KeWaitForSingleObject
KiDeliverApc
KiDispatchInterrupt
DbgPrint
KeFindConfigurationNextEntry
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
RtlIntegerToUnicodeString
ZwClose
RtlEqualUnicodeString
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlUpperString
RtlInitAnsiString
sprintf
ZwCreateKey
ZwSetValueKey
IoAssignDriveLetters
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
strncpy
_stricmp
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
KiBugCheckData
RtlMoveMemory
KeInitializeSpinLock
MmAllocateMappingAddress
MmUnmapReservedMapping
MmMapLockedPagesWithReservedMapping
MmMapLockedPagesSpecifyCache
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
MmFreeContiguousMemory
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
ObfDereferenceObject
IoFreeMdl
IoAllocateMdl
_allshr
MmUnmapLockedPages
KeSetEvent
RtlSetBits
IoRegisterPlugPlayNotification
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ExQueueWorkItem
KeBugCheckEx
KeInitializeDpc
KeInsertQueueDpc
KeQuerySystemTime
RtlQueryRegistryValues
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeEnterKernelDebugger
KdDebuggerEnabled
KdDebuggerNotPresent
InbvSetScrollRegion
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvSetTextColor
InbvSolidColorFill
InbvResetDisplay
InbvIsBootDriverInstalled
ZwEnumerateValueKey
ZwQueryKey
KiAcquireSpinLock
KiReleaseSpinLock
IoAssignResources
IoAllocateAdapterChannel
ObCreateObject
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
RtlInitializeBitMap
KeInitializeDeviceQueue
ObInsertObject
ObReferenceObjectByPointer
IoAdapterObjectType
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCompleteRequest
PoStartNextPowerIrp
ObfReferenceObject
IoReportDetectedDevice
IoCreateDriver
WRITE_REGISTER_UCHAR
PoSetHiberRange
KeSetTargetProcessorDpc
KeSetImportanceDpc
HalPrivateDispatchTable
IoReportHalResourceUsage
KeSetTimeIncrement
MmUnmapIoSpace
MmAllocateContiguousMemory
_except_handler3
RtlTimeFieldsToTime
ZwPowerInformation
ExRegisterCallback
ExCreateCallback
HalDispatchTable
InbvDisplayString
atoi
strstr
KiEnableTimerWatchdog
KeRegisterBugCheckCallback
KeSetProfileIrql
PsGetCurrentProcessId
_aulldiv
_allmul
KeInsertDeviceQueue
DbgBreakPoint

kdcom

KdRestore

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalSystemVectorDispatchEntry
HalTranslateBusAddress
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockRaiseToSynch
KeAcquireQueuedSpinLock
KeAcquireQueuedSpinLockRaiseToSynch
KeAcquireSpinLock
KeAcquireSpinLockRaiseToSynch
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeRaiseIrqlToDpcLevel
KeRaiseIrqlToSynchLevel
KeReleaseInStackQueuedSpinLock
KeReleaseQueuedSpinLock
KeReleaseSpinLock
KeStallExecutionProcessor
KeTryToAcquireQueuedSpinLock
KeTryToAcquireQueuedSpinLockRaiseToSynch
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INITCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK16
Size: 256B - Virtual size: 134B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

Imports

ntoskrnl.exe

kdcom

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 41KB - Virtual size: 41KB

INITCONS Size: 512B - Virtual size: 512B

PAGELK Size: 12KB - Virtual size: 12KB

PAGELK16 Size: 256B - Virtual size: 134B

PAGE Size: 11KB - Virtual size: 11KB

PAGEKD Size: 4KB - Virtual size: 4KB

.edata Size: 3KB - Virtual size: 2KB

INIT Size: 14KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 140KB - Virtual size: 140KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 41KB - Virtual size: 41KB

INITCONS
Size: 512B - Virtual size: 512B

PAGELK
Size: 12KB - Virtual size: 12KB

PAGELK16
Size: 256B - Virtual size: 134B

PAGE
Size: 11KB - Virtual size: 11KB

PAGEKD
Size: 4KB - Virtual size: 4KB

.edata
Size: 3KB - Virtual size: 2KB

INIT
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 140KB - Virtual size: 140KB