C:\Users\Death\Desktop\autismhook.cc\x64\Release\kernelmode.pdb
Behavioral task
behavioral1
Sample
source/CBV Source/injector/DriverIN.sys
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
source/CBV Source/injector/injector.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
source/CBV Source/src/imgui/stb_rect_pack.vbs
Resource
win11-20240802-en
General
-
Target
source.zip
-
Size
4.9MB
-
MD5
6aa6c2a2f25b3697f19cadd272ed4267
-
SHA1
d5463281a9cf245305ea692aa01a1e175f4b2883
-
SHA256
56c3abf7da51405556c9ab7f0d41ce00bfc09fba86f6e4daa3ea6bfaa1703b1a
-
SHA512
c18c8325d263ad653fcfafa679845c16f08de6a951fb096b54f5e857a4523f879ad3ff7b012ea69b7c53ba6ca57c60046f5d97bf7f0042a1ba4ec3a7ba686ba3
-
SSDEEP
98304:xqev/n6hvOfpQ1pdn3NieLTU/qSBqIQ8hYVcYjXPpdf865H2X0:xJ/AmfpQ1pdnTTUZqIVhY9fpdfJ2X0
Malware Config
Signatures
-
resource yara_rule static1/unpack001/source/CBV Source/injector/injector.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/source/CBV Source/injector/DriverIN.sys unpack001/source/CBV Source/injector/injector.exe
Files
-
source.zip.zip
-
source/CBV Source/injector/DriverIN.sys.sys windows:10 windows x64 arch:x64
7ea60585cbdcab90bf2000c9685f3bed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
_stricmp
RtlInitAnsiString
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfDereferenceObject
MmIsAddressValid
PsGetProcessId
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQueryVirtualMemory
ZwProtectVirtualMemory
RtlFindExportedRoutineByName
MmCopyVirtualMemory
RtlImageNtHeader
IoCreateDriver
PsGetProcessSectionBaseAddress
ZwLockVirtualMemory
ZwQuerySystemInformation
ZwOpenThread
__C_specific_handler
__chkstk
strcmp
PsProcessType
PsThreadType
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
source/CBV Source/injector/README.txt
-
source/CBV Source/injector/injector.exe.exe windows:6 windows x64 arch:x64
68c681daabe14035f9fee507ba14565c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
ntdll
RtlAdjustPrivilege
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
_stricmp
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
source/CBV Source/src/core.cpp
-
source/CBV Source/src/core.h
-
source/CBV Source/src/dllmain.cpp
-
source/CBV Source/src/imgui/imconfig.h
-
source/CBV Source/src/imgui/imgui_impl_dx11.cpp
-
source/CBV Source/src/imgui/imgui_impl_dx11.h
-
source/CBV Source/src/imgui/stb_rect_pack.h.vbs
-
source/CBV Source/src/imgui/stb_textedit.h
-
source/CBV Source/src/minhook/MinHook.h
-
source/CBV Source/src/minhook/minhook.lib
-
source/CBV Source/src/offsets.cpp
-
source/CBV Source/src/offsets.h
-
source/CBV Source/src/render.cpp
-
source/CBV Source/src/render.h
-
source/CBV Source/src/retspoof.asm
-
source/CBV Source/src/settings.cpp
-
source/CBV Source/src/settings.h
-
source/CBV Source/src/stdafx.h
-
source/CBV Source/src/structs.h
-
source/CBV Source/src/util.cpp
-
source/CBV Source/src/util.h
-
source/CBV Source/src/x64/Release/Fortnite.lib
-
source/CBV Source/src/xorstr.h