80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7

Sharing

Copy URL Twitter E-mail

General

Target
80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7
Size 238KB
Sample260922-kpcdassdkb
SHA256 80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7
MD5 4f698b9d3443136c82e740bef494320f
SHA1 234cdac03a0d990e707575604468dd0f4715e188
SHA512 8e712b44e8d2e4463c1ac52fe709d9af912c02393566067d7d1af6ecc9b570ce7bd6db5b2cb457f8474ca5c54e574c0760aa511f579963dae7a9b3108e6d1473
SSDEEP 6144:NjOyqw/QQV9u6Zpmhx7KLTDDlvsmcJkJqqDL6JIWt7I:UZQrjiqTDDBnkqn6J/
TLSH
T17D34AF26B780E572D08B20B7971CB67225B5BB305794D4CBF3A22FCD2635AD1763A243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7

File Explorer

80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7

.sys 238KB

80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7

IMPHASH 675d83a8d2a162d9e5e5e3e48e296bbb
SHA256 80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7
MD5 4f698b9d3443136c82e740bef494320f
SHA1 234cdac03a0d990e707575604468dd0f4715e188
SHA512 8e712b44e8d2e4463c1ac52fe709d9af912c02393566067d7d1af6ecc9b570ce7bd6db5b2cb457f8474ca5c54e574c0760aa511f579963dae7a9b3108e6d1473
SSDEEP 6144:NjOyqw/QQV9u6Zpmhx7KLTDDlvsmcJkJqqDL6JIWt7I:UZQrjiqTDDBnkqn6J/
TLSH
T17D34AF26B780E572D08B20B7971CB67225B5BB305794D4CBF3A22FCD2635AD1763A243
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

226366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntoskrnl.exe

ExRaiseStatus IoFreeMdl MmBuildMdlForNonPagedPool IoAllocateMdl CcFlushCache ExIsResourceAcquiredSharedLite ExIsResourceAcquiredExclusiveLite IoIsFileOriginRemote RtlMultiByteToUnicodeN RtlCompareMemory FsRtlIsNtstatusExpected CcZeroData FsRtlIsPagingFile ExfInterlockedRemoveHeadList _alldvrm _vsnwprintf KeDelayExecutionThread KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject _stricmp SeQueryInformationToken IoVolumeDeviceToDosName RtlEqualUnicodeString CcUninitializeCacheMap CcPurgeCacheSection PsGetCurrentThreadId ExGetExclusiveWaiterCount MmFlushImageSection MmMapLockedPagesSpecifyCache ExFreePool FsRtlDoesNameContainWildCards IoGetCurrentProcess KeRestoreFloatingPointState KeSaveFloatingPointState ExAcquireResourceSharedLite ObOpenObjectByPointer ZwSetValueKey ZwCreateKey ExSystemTimeToLocalTime wcsstr wcschr RtlTimeToTimeFields KeTickCount KeBugCheckEx _allrem RtlGetVersion PsGetCurrentProcessId FsRtlIsNameInExpression ProbeForRead RtlAppendUnicodeStringToString ZwCreateFile RtlCompareUnicodeString RtlInsertElementGenericTable RtlAppendUnicodeToString IoFileObjectType RtlAssert MmGetSystemRoutineAddress ExInitializeNPagedLookasideList RtlInitializeGenericTable PsCreateSystemThread ObReferenceObjectByHandle ZwOpenKey ZwQueryValueKey PsSetCreateProcessNotifyRoutine RtlIsGenericTableEmpty memcpy ExfInterlockedInsertTailList KeSetEvent ExFreePoolWithTag ExDeleteResourceLite DbgPrint ExInitializeResourceLite RtlCopyUnicodeString ObfDereferenceObject _alldiv memset ExAllocatePoolWithTag RtlInitUnicodeString IoCreateNotificationEvent KeQuerySystemTime KeWaitForMultipleObjects RtlNumberGenericTableElements RtlGetElementGenericTable RtlDeleteElementGenericTable RtlEnumerateGenericTableWithoutSplaying RtlLookupElementGenericTable ZwClose ZwTerminateProcess KeWaitForSingleObject PsLookupProcessByProcessId KeStackAttachProcess KeUnstackDetachProcess KeClearEvent PsTerminateSystemThread ExInterlockedPushEntrySList ExInterlockedPopEntrySList wcsrchr KeInitializeEvent RtlUnwind

hal

ExAcquireFastMutex ExReleaseFastMutex KeGetCurrentIrql

fltmgr.sys

FltGetStreamHandleContext FltSetStreamHandleContext FltSetStreamContext FltCloseClientPort FltDeleteStreamHandleContext FltSendMessage FltWriteFile FltReadFile FltGetDiskDeviceObject FltGetStreamContext FltAllocateCallbackData FltPerformSynchronousIo FltFreeCallbackData FltDoCompletionProcessingWhenSafe FltIsOperationSynchronous FltLockUserBuffer FltIsDirectory FltGetInstanceContext FltSetCallbackDataDirty FltClearCallbackDataDirty FltCancelFileOpen FltAcquireResourceShared FltObjectDereference FltGetVolumeFromFileObject FltGetVolumeInstanceFromName FltGetFileNameInformation FltGetFileNameInformationUnsafe FltParseFileNameInformation FltReleaseFileNameInformation FltQueryInformationFile FltCreateFile FltSetInformationFile FltClose FltFlushBuffers FltRegisterFilter FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltStartFiltering FltCloseCommunicationPort FltUnregisterFilter FltAcquireResourceExclusive FltReleaseResource FltAllocateContext FltGetVolumeProperties FltQueryVolumeInformation FltSetInstanceContext FltReferenceContext FltReleaseContext

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

331B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dse0

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

892B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

80c72e77c3034941c1b120d92bf15f4f6cb7079a00d876ee9c9f90d9430239e7

ntoskrnl.exe

hal

fltmgr.sys

generic