Behavioral task
behavioral1
Sample
sysdrv32.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sysdrv32.exe
Resource
win10v2004-20231222-en
General
-
Target
sysdrv32.exe
-
Size
26.9MB
-
MD5
6be8d038816803c4c94a278c94b22802
-
SHA1
8f8b52fab9f819801afc954c4cebeb35893118b6
-
SHA256
991bf23a341c526a72591370e84abfcb2da1f1690a609df43d9907834bfcb16a
-
SHA512
953bc632cfc59d7d184e93d24cba43ca015f5a6d57a6734f90d560079e20bdecadf9dbbd44f65218eaa0654e64a8fcb2d4114278bc60d5385be6c68af09fe59a
-
SSDEEP
393216:n5FsW4LBCltjvO7CLOXmSghHSMuTVWMI9oCyrYn9PqBF8wngn1/to:noBCf7O2LLthyMGIMYerSPq/Fnglu
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sysdrv32.exe
Files
-
sysdrv32.exe.exe windows:6 windows x64 arch:x64
d1c1dbbd3f23a12ffe26914c72391cde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextA
CharUpperBuffW
advapi32
CryptReleaseContext
Sections
.text Size: 825KB - Virtual size: 825KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 179KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 18.3MB - Virtual size: 18.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ