ACE-DYNGAME.pdb
Static task
static1
1 signatures
General
-
Target
5ed2e0f88233d310fea0e7759b1534aa0943da4bf073f5392d8a50f079466c07
-
Size
781KB
-
MD5
88c805055afd164c4c7d3a7bb92c6f31
-
SHA1
52ea2d44d3a0baf61d5504442c789c4350f96818
-
SHA256
5ed2e0f88233d310fea0e7759b1534aa0943da4bf073f5392d8a50f079466c07
-
SHA512
b10bc2ef7ab1eeb69da260753508f87ebe0c6606f1eeb3daa770bf6706a08c6eaaf751af5de973ba3f7c41d9f5211c4ee12fdfe4b9fd28c0fbf3192d953ae1b0
-
SSDEEP
6144:UdRW6wOd04mb8QSFvWt9f2hmUwbRb/C4czeax9Vi/gEFDAGquHXNjyWOMDqiYBxj:Ud06w20wJRLj73MiNTi6v
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ed2e0f88233d310fea0e7759b1534aa0943da4bf073f5392d8a50f079466c07
Files
-
5ed2e0f88233d310fea0e7759b1534aa0943da4bf073f5392d8a50f079466c07.sys windows:10 windows x64 arch:x64
7ad3066fef269b0369736567b92ca4b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
fltmgr.sys
FltGetFileNameInformationUnsafe
FltReleaseFileNameInformation
ntoskrnl.exe
MmIsAddressValid
PsGetCurrentProcessId
RtlInitUnicodeString
DbgPrint
KeInitializeEvent
KeSetEvent
KeSetSystemGroupAffinityThread
KeRevertToUserGroupAffinityThread
KeWaitForSingleObject
KeGetCurrentProcessorNumberEx
ExAllocatePool
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenFile
KeDeregisterBugCheckReasonCallback
KeRegisterBugCheckReasonCallback
ExAllocatePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
ZwUnloadDriver
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
PsGetCurrentThreadId
__C_specific_handler
IofCompleteRequest
IoCreateDevice
IoDeleteDevice
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
RtlEqualUnicodeString
KeClearEvent
KeReadStateEvent
CmRegisterCallback
CmUnRegisterCallback
PsSetCreateProcessNotifyRoutineEx
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
KeQueryTimeIncrement
MmGetSystemRoutineAddress
PsGetProcessId
PsGetThreadProcessId
PsGetProcessPeb
PsInitialSystemProcess
MmMapIoSpace
MmUnmapIoSpace
RtlInt64ToUnicodeString
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlAppendUnicodeToString
IoCreateFile
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
IoCreateFileSpecifyDeviceObjectHint
IoGetBaseFileSystemDeviceObject
IoFileObjectType
RtlUnicodeStringToAnsiString
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
MmGetPhysicalAddress
KeNumberProcessors
ZwOpenKey
ZwDeleteKey
ZwQueryValueKey
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
PsGetThreadProcess
IoGetCurrentProcess
KeBugCheck
ZwEnumerateKey
RtlCompareUnicodeString
PsGetProcessWow64Process
RtlInsertElementGenericTableFullAvl
MmGetVirtualForPhysical
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlCompareString
MmBuildMdlForNonPagedPool
PsThreadType
ZwQueryObject
RtlAnsiCharToUnicodeChar
ZwCreateSection
ZwQuerySystemInformation
KeBugCheckEx
RtlCopyUnicodeString
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
RtlGetVersion
RtlxAnsiStringToUnicodeSize
NlsMbOemCodePageTag
wcsrchr
tolower
RtlCharToInteger
ZwClose
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeSetPriorityThread
RtlImageNtHeader
ZwProtectVirtualMemory
PsGetThreadTeb
PsLookupThreadByThreadId
PsIsProtectedProcess
PsIsThreadTerminating
KeInitializeApc
PsWrapApcWow64Thread
PsGetCurrentProcessWow64Process
KeInsertQueueApc
KeTestAlertThread
hal
HalGetBusDataByOffset
KeStallExecutionProcessor
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.tvm0 Size: 648KB - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ