c:\users\administrator\desktop\Bin\i386\Winpwxy.pdb
Static task
static1
General
-
Target
f1e54a6f3b0f806a89727229519af9d407084af0ea6ab08bba6f0e4c668c62bc
-
Size
1.5MB
-
MD5
21d530f175f10d52528781dcf563199a
-
SHA1
5ac716c001d6a9da80a86d897a8fed6b3c750a4b
-
SHA256
f1e54a6f3b0f806a89727229519af9d407084af0ea6ab08bba6f0e4c668c62bc
-
SHA512
69fef0ae9643123fb76030736124ae92d3c35fd57ffce22e8c83263eb10293bc76d529cd68cdbbb6102770780c895b3fb65f2086223b8a3c11d5d176edabff79
-
SSDEEP
24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8a2wpoYeefvJNqAVOzjtfHQpxc:pTvC/MTQYxsWR7a2wecHJNqAM9fHQpx
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1e54a6f3b0f806a89727229519af9d407084af0ea6ab08bba6f0e4c668c62bc
Files
-
f1e54a6f3b0f806a89727229519af9d407084af0ea6ab08bba6f0e4c668c62bc.sys windows:6 windows x86 arch:x86
1b9c7d892af4f56d61d6eaa050af72fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memcpy
memset
ZwWriteFile
ZwSetInformationFile
ZwQueryInformationFile
_strnicmp
PsGetProcessImageFileName
IoCreateFile
ZwClose
ExFreePoolWithTag
ZwReadFile
ZwFlushKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
ZwCreateFile
KeQuerySystemTime
ZwDeleteFile
MmIsAddressValid
RtlCopyUnicodeString
ObQueryNameString
ZwDeleteKey
ZwOpenKey
ZwQueryDirectoryFile
DbgPrint
RtlInitUnicodeString
RtlAppendUnicodeStringToString
ZwEnumerateKey
ZwQueryKey
KeUnstackDetachProcess
KeStackAttachProcess
RtlEqualUnicodeString
_wcsicmp
KeGetCurrentThread
IoFreeIrp
IoFreeMdl
KeSetEvent
ExAllocatePool
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoGetDeviceAttachmentBaseRef
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
_wcsnicmp
CmRegisterCallback
CmUnRegisterCallback
PsTerminateSystemThread
NtShutdownSystem
_stricmp
ZwTerminateProcess
ObOpenObjectByPointer
PsProcessType
PsGetProcessSectionBaseAddress
PsLookupProcessByProcessId
PsGetProcessId
PsInitialSystemProcess
PsCreateSystemThread
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
IoRegisterShutdownNotification
IoCreateDevice
RtlGetVersion
KeTickCount
KeBugCheckEx
_vsnwprintf
_vsnprintf
KeDelayExecutionThread
KeInsertQueueApc
KeInitializeApc
ZwQuerySystemInformation
PsLookupThreadByThreadId
_allmul
PsGetProcessPeb
ZwAllocateVirtualMemory
ZwOpenFile
RtlUnwind
hal
KeRaiseIrqlToDpcLevel
KfLowerIrql
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 768B - Virtual size: 764B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ