Acx01000.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Acx01000.sys
Resource
win10v2004-20240412-en
General
-
Target
Acx01000.sys
-
Size
716KB
-
MD5
9e5390292de4e07de4fd2f45df62ec5d
-
SHA1
764cce8d4501c25259f7c62e803c977167411a51
-
SHA256
c728bc5ad5272267348c65d491771bcc3fbc47e27ed1be9cfa20b0d3d6a410b4
-
SHA512
577c6d77ee5a5d865a50c7a7c21d121d52922bf82205e3ed0154b8f020946f3fc42780af02395c16d6be02fcd1d195959c0d79f0f04851595e27bdbcc1daa950
-
SSDEEP
6144:5N+C7bkGgXRleVeD1flv9NAlfjJtz5nEmMjkoyaHBVnBoo1ZDZ:fL7QGERSofLN2Jth2gBsN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Acx01000.sys
Files
-
Acx01000.sys.sys windows:10 windows x64 arch:x64
b0aec73173e90d4c47eb63e65fca9b28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
EtwUnregister
_vsnwprintf
RtlUnregisterFeatureConfigurationChangeNotification
DbgPrintEx
RtlCopyUnicodeString
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeInitializeEvent
ExAllocatePool2
ExAllocatePoolWithTag
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
wcsncmp
RtlEqualUnicodeString
EtwWriteTransfer
_purecall
KeGetCurrentIrql
IoGetDeviceInterfacePropertyData
IoSetDeviceInterfacePropertyData
KeWaitForSingleObject
KeReleaseMutex
EtwRegister
ObfReferenceObject
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
_vsnprintf
RtlAssert
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
IofCompleteRequest
_wcsnicmp
IoInvalidateDeviceRelations
ObfDereferenceObject
IoSetCompletionRoutineEx
KeSetEvent
RtlStringFromGUID
RtlFreeUnicodeString
ZwEnumerateKey
ZwQueryKey
RtlGUIDFromString
ExUuidCreate
KeDelayExecutionThread
RtlCompareMemory
__C_specific_handler
ProbeForRead
ProbeForWrite
ObReferenceObjectByHandle
ExEventObjectType
KeFlushQueuedDpcs
KeClearEvent
KeWaitForMultipleObjects
ZwCreateEvent
ObReferenceObjectByHandleWithTag
PsCreateSystemThread
ZwClose
KeExpandKernelStackAndCallout
ObfReferenceObjectWithTag
IoReportTargetDeviceChangeAsynchronous
wcsstr
EtwSetInformation
RtlQueryFeatureConfigurationChangeStamp
RtlRegisterFeatureConfigurationChangeNotification
RtlQueryFeatureConfiguration
IoWMIRegistrationControl
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeInitializeMutex
ZwCreateFile
IoFileObjectType
IoGetRelatedDeviceObject
IoGetCurrentProcess
KeStackAttachProcess
MmUnmapLockedPages
IoFreeMdl
KeUnstackDetachProcess
ObfDereferenceObjectWithTag
IoGetRequestorProcess
IoAllocateMdl
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoBuildPartialMdl
ExFreePoolWithTag
wdfldr.sys
WdfRegisterClassLibrary
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfLdrQueryInterface
WdfVersionUnbind
wpprecorder.sys
WppAutoLogStart
imp_WppRecorderReplay
imp_WppRecorderLogCreate
imp_WppRecorderLogDelete
WppAutoLogStop
imp_WppRecorderConfigure
WppAutoLogTrace
drmk.sys
DrmAddContentHandlers
DrmForwardContentToDeviceObject
DrmCreateContentMixed
DrmDestroyContent
DrmGetContentRights
hal
KeQueryPerformanceCounter
Sections
.text Size: 128KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 488KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ