26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

General

Target
26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
Size 55KB
Sample260428-q71fqsat7x
SHA256 26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
MD5 74de13b5ea68b3da24addc009f84baee
SHA1 26e787997a338d8111d96c9a4c103cf8ff0201ce
SHA512 370c9e89fd9a031a1e654aca710be97c590d1e6b9e7126f0f6dc4c17c75c8b0d2da117b17264155c1443a81cea5baabd7dcb41d727015cbcfcd3ba6cd756c572
SSDEEP 768:ZhKIHl+sT4u0igKAsjdTBJcSROgzLayozgU3ppiD+FPHcLHXkW9FELwUqQ/o:LhJsu0itszld5mBU1q
TLSH
T12A438C12B2C04072D6E70174DE553B6A937FEB1055A3AEE267241E4E2E2FC43B536B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

File Explorer

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

.sys 55KB

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

IMPHASH 9ab142abb692f6df617e0254f1c41663
SHA256 26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
MD5 74de13b5ea68b3da24addc009f84baee
SHA1 26e787997a338d8111d96c9a4c103cf8ff0201ce
SHA512 370c9e89fd9a031a1e654aca710be97c590d1e6b9e7126f0f6dc4c17c75c8b0d2da117b17264155c1443a81cea5baabd7dcb41d727015cbcfcd3ba6cd756c572
SSDEEP 768:ZhKIHl+sT4u0igKAsjdTBJcSROgzLayozgU3ppiD+FPHcLHXkW9FELwUqQ/o:LhJsu0itszld5mBU1q
TLSH
T12A438C12B2C04072D6E70174DE553B6A937FEB1055A3AEE267241E4E2E2FC43B536B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntoskrnl.exe

ExfInterlockedInsertTailList ExfInterlockedInsertHeadList ExfInterlockedRemoveHeadList PsGetVersion ZwQueryValueKey ZwOpenKey KeWaitForSingleObject InterlockedExchange InterlockedCompareExchange ExQueueWorkItem IoFreeMdl IoBuildPartialMdl MmBuildMdlForNonPagedPool IoAllocateMdl PsCreateSystemThread KeWaitForMultipleObjects PsTerminateSystemThread RtlAppendUnicodeStringToString RtlCopyUnicodeString memmove ZwCreateKey ZwDeleteKey ZwEnumerateKey ZwQueryKey ZwSetValueKey RtlUnwind MmMapLockedPagesSpecifyCache InterlockedDecrement InterlockedIncrement swprintf ObReferenceObjectByHandle ObfDereferenceObject IoDeleteSymbolicLink IofCompleteRequest IoCreateDevice IoDeleteDevice ZwClose ExAllocatePool wcslen RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlUnicodeStringToAnsiString RtlFreeAnsiString strncpy KeInitializeSpinLock RtlDeleteRegistryValue _strnicmp ZwQuerySystemInformation NtBuildNumber PsInitialSystemProcess ZwQueryInformationProcess ZwOpenProcess PsLookupProcessByProcessId strchr strrchr MmIsAddressValid KeDetachProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory KeAttachProcess KeDelayExecutionThread KeInsertQueueApc KeInitializeApc ZwCreateFile _snwprintf ZwFsControlFile ZwQueryInformationFile ZwWriteFile RtlConvertUlongToLargeInteger KeTickCount ZwQueryVolumeInformationFile RtlRandom ZwSetInformationFile KeReleaseSemaphore MmUnlockPages MmUnmapLockedPages KeInitializeEvent KeInitializeSemaphore MmProbeAndLockPages KeQuerySystemTime ExAllocatePoolWithTag RtlInitUnicodeString ExFreePool

hal

KeQueryPerformanceCounter ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock

ndis.sys

NdisFreePacket NdisAllocateBufferPool NdisAllocatePacketPool NdisFreeBufferPool NdisCloseAdapter NdisAllocatePacket NdisOpenAdapter NdisWaitEvent NdisDeregisterProtocol NdisInitializeEvent NdisResetEvent NdisSetEvent NdisRegisterProtocol NdisAllocateBuffer NdisUnchainBufferAtFront NdisFreePacketPool

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

ntoskrnl.exe

hal

ndis.sys

generic