1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e

General

Target
1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e
Size 135KB
Sample260827-trclhsbl3x
SHA256 1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e
MD5 8d637cd595c5d8835461b10354ef3612
SHA1 481296a8789925c2348fe453a60dafd7907a56c4
SHA512 dd8e5399abe0a5ee280a81adb57e16089ae8ce5353775d6064761b244f1a0693c10dcce474de4b9b5887c1bf2c80fba48e4486064c595ee6ee750e08db310290
SSDEEP 3072:KNmbBR01PLFa+KJ46s9v7YHZf76VCLHUSZUEF:qy/01PLaJ3GYHFVL07
TLSH
T11FD39D22E2A34872D09B04FF8A4732B1C7AFA930161B97670264DA5E7D597B0FF35613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e

File Explorer

1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e

.dll 135KB

1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e

IMPHASH 104544ec7b8fd5109f561119852cd215
SHA256 1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e
MD5 8d637cd595c5d8835461b10354ef3612
SHA1 481296a8789925c2348fe453a60dafd7907a56c4
SHA512 dd8e5399abe0a5ee280a81adb57e16089ae8ce5353775d6064761b244f1a0693c10dcce474de4b9b5887c1bf2c80fba48e4486064c595ee6ee750e08db310290
SSDEEP 3072:KNmbBR01PLFa+KJ46s9v7YHZf76VCLHUSZUEF:qy/01PLaJ3GYHFVL07
TLSH
T11FD39D22E2A34872D09B04FF8A4732B1C7AFA930161B97670264DA5E7D597B0FF35613
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

22119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

U:\NPscawztxV\lGGEFFr\vpgqylo\tpRBAROjdzznk.pdb

ntoskrnl.exe

MmHighestUserAddress MmForceSectionClosed MmUnmapIoSpace ZwOpenProcess IoReleaseRemoveLockAndWaitEx ObMakeTemporaryObject ObfReferenceObject CcRemapBcb IoQueryFileDosDeviceName SeDeleteObjectAuditAlarm IoGetCurrentProcess IoGetStackLimits ExDeletePagedLookasideList IoRegisterDeviceInterface SeAccessCheck ObInsertObject RtlAreBitsClear SePrivilegeCheck SeQueryAuthenticationIdToken IoMakeAssociatedIrp RtlFreeAnsiString RtlCopySid PsGetProcessExitTime ObGetObjectSecurity IoAllocateController KeRundownQueue KeSynchronizeExecution ZwDeviceIoControlFile SeAssignSecurity ZwMapViewOfSection IoInitializeTimer CcFastMdlReadWait ZwEnumerateValueKey IoGetDeviceToVerify IoAcquireCancelSpinLock RtlUpcaseUnicodeString ZwCreateFile ProbeForWrite IoWriteErrorLogEntry ObCreateObject MmIsVerifierEnabled SeSetSecurityDescriptorInfo MmAdvanceMdl PoRegisterSystemState SeCaptureSubjectContext RtlFillMemoryUlong IoFreeIrp PsGetCurrentProcessId IoEnumerateDeviceObjectList PsChargeProcessPoolQuota ExRaiseAccessViolation RtlInitString KeInitializeMutex SeValidSecurityDescriptor DbgBreakPoint RtlCopyString KeQueryTimeIncrement KeSaveFloatingPointState IoSetDeviceToVerify PsGetCurrentProcess IoGetRequestorProcess RtlDeleteElementGenericTable ObReferenceObjectByPointer IoUnregisterFileSystem IoGetDriverObjectExtension CcFastCopyRead WmiQueryTraceInformation ZwQueryKey MmFreeMappingAddress MmUnlockPages IofCompleteRequest IoFreeController MmUnsecureVirtualMemory PoUnregisterSystemState ExGetSharedWaiterCount MmLockPagableDataSection ExNotifyCallback RtlCreateSecurityDescriptor IoSetDeviceInterfaceState RtlFindNextForwardRunClear ZwQueryVolumeInformationFile RtlFindSetBits IoGetLowerDeviceObject IoCreateDevice IoDisconnectInterrupt KeGetCurrentThread IoQueryFileInformation SeTokenIsRestricted KeReadStateSemaphore KeSetTimerEx CcUninitializeCacheMap FsRtlIsDbcsInExpression FsRtlLookupLastLargeMcbEntry CcMdlWriteAbort MmQuerySystemSize CcPreparePinWrite RtlDowncaseUnicodeString MmAllocateMappingAddress DbgBreakPointWithStatus RtlGenerate8dot3Name SeFilterToken RtlSetBits ExAllocatePoolWithQuota KeEnterCriticalRegion ExUuidCreate ObReleaseObjectSecurity RtlFindClearBitsAndSet ExReinitializeResourceLite RtlFreeUnicodeString RtlTimeToSecondsSince1980 KefAcquireSpinLockAtDpcLevel MmPageEntireDriver KeInitializeSemaphore RtlCreateRegistryKey CcGetFileObjectFromBcb SeOpenObjectAuditAlarm IoRegisterFileSystem ZwQuerySymbolicLinkObject KeUnstackDetachProcess IoReadDiskSignature RtlInitAnsiString PsGetCurrentThread RtlGetNextRange FsRtlCheckOplock ZwDeleteValueKey IoSetThreadHardErrorMode IoGetAttachedDevice IoVerifyVolume MmGetPhysicalAddress MmResetDriverPaging IoIsWdmVersionAvailable ZwFreeVirtualMemory ExIsProcessorFeaturePresent IoReadPartitionTableEx MmUnmapLockedPages IoIsOperationSynchronous IoAllocateMdl KeCancelTimer KeResetEvent CcMdlReadComplete IoQueueWorkItem RtlLengthRequiredSid PsIsThreadTerminating MmLockPagableSectionByHandle MmGetSystemRoutineAddress RtlxOemStringToUnicodeSize IoBuildSynchronousFsdRequest IoCheckQuotaBufferValidity FsRtlFreeFileLock KeSetPriorityThread PoCallDriver ExAcquireResourceSharedLite ExCreateCallback KeQuerySystemTime RtlEqualSid RtlUnicodeStringToInteger RtlTimeToTimeFields PsRevertToSelf SeLockSubjectContext RtlInitializeBitMap CcDeferWrite IoUpdateShareAccess MmMapIoSpace RtlUpcaseUnicodeChar IoVerifyPartitionTable RtlCompareString ExQueueWorkItem KeWaitForSingleObject RtlGetCallersAddress KeInitializeTimer KeSetEvent KeSetKernelStackSwapEnable RtlWriteRegistryValue KeClearEvent RtlHashUnicodeString MmAllocatePagesForMdl RtlVerifyVersionInfo MmIsDriverVerifying KeRegisterBugCheckCallback IoGetDeviceInterfaces RtlSplay ZwMakeTemporaryObject RtlUpperString IoThreadToProcess MmSetAddressRangeModified ExGetPreviousMode IoRaiseHardError SeFreePrivileges IoReadPartitionTable MmMapLockedPages IoAllocateAdapterChannel RtlMultiByteToUnicodeN ZwOpenSection IoQueryDeviceDescription ExDeleteResourceLite ZwOpenKey IoSetStartIoAttributes IoCsqRemoveIrp ZwCreateKey ZwQueryObject KeInitializeSpinLock FsRtlSplitLargeMcb IoSetTopLevelIrp VerSetConditionMask ExDeleteNPagedLookasideList ZwEnumerateKey IoDeleteSymbolicLink RtlFindLastBackwardRunClear CcFlushCache IoInitializeIrp FsRtlIsHpfsDbcsLegal KeRestoreFloatingPointState IoAllocateErrorLogEntry RtlGetVersion ZwUnloadDriver ProbeForRead IoGetDeviceProperty ZwDeleteKey IoCreateNotificationEvent KeInitializeDeviceQueue SeTokenIsAdmin KeReadStateTimer RtlFindLongestRunClear ZwReadFile RtlCharToInteger ZwFsControlFile KeInsertByKeyDeviceQueue MmAllocateNonCachedMemory HalExamineMBR IoReleaseCancelSpinLock KeRemoveQueueDpc MmFreeNonCachedMemory MmUnlockPagableImageSection IoAllocateIrp PsGetVersion RtlInsertUnicodePrefix KeQueryActiveProcessors RtlTimeFieldsToTime KeBugCheckEx FsRtlFastCheckLockForRead KeInsertHeadQueue ZwCreateEvent ZwSetVolumeInformationFile RtlLengthSecurityDescriptor PsCreateSystemThread RtlxUnicodeStringToAnsiSize ExFreePool MmMapLockedPagesSpecifyCache RtlEqualUnicodeString IoGetBootDiskInformation IoSetSystemPartition RtlSetDaclSecurityDescriptor FsRtlNotifyInitializeSync RtlDeleteNoSplay MmCanFileBeTruncated CcMdlWriteComplete SeSinglePrivilegeCheck MmSizeOfMdl FsRtlDeregisterUncProvider IoGetDiskDeviceObject IoGetTopLevelIrp

Sharing

General

Malware Config

Signatures

File Explorer

1efe37254c101b001a16dc1bff203e7a127cb0b743933bb478c1f059c8bbab9e

ntoskrnl.exe

generic