411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976

General

Target
411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976
Size 64KB
Sample260922-ln16psshrc
SHA256 411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976
MD5 514f7c2b19f2a3474cd0abf1a8bed755
SHA1 2d5d8b9926149f28c0e5e3c6216e356c0f9b19fc
SHA512 a27330864bb964ce98951aef217070b3e74a2e9f16c3053aa663f832e4c0d50195770f0331f2cab6f7fd2d0e0e20e9d411c81600955d610eb94a6b3759f1a2a2
SSDEEP 768:2R810MmtZXXJYqCkWPCBWfN1nsYvBlljBFLv7ExydH5HkgTA6A3GF9SgeQEeqxX:p1eXaq0A2D7lPFEig69SgAFX
TLSH
T17E534B23F989AC35E3D05DF14BBB3A6A4A6AA9335B1596EB01D00FD628241F3F431717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976

File Explorer

411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976

.sys 64KB

411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976

IMPHASH c41c0d731e8204095a0fd1881db98e36
SHA256 411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976
MD5 514f7c2b19f2a3474cd0abf1a8bed755
SHA1 2d5d8b9926149f28c0e5e3c6216e356c0f9b19fc
SHA512 a27330864bb964ce98951aef217070b3e74a2e9f16c3053aa663f832e4c0d50195770f0331f2cab6f7fd2d0e0e20e9d411c81600955d610eb94a6b3759f1a2a2
SSDEEP 768:2R810MmtZXXJYqCkWPCBWfN1nsYvBlljBFLv7ExydH5HkgTA6A3GF9SgeQEeqxX:p1eXaq0A2D7lPFEig69SgAFX
TLSH
T17E534B23F989AC35E3D05DF14BBB3A6A4A6AA9335B1596EB01D00FD628241F3F431717
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\OpenArk\src\OpenArk\res\driver\OpenArkDrv32.pdb

hal

KeGetCurrentIrql KfLowerIrql KeRaiseIrqlToDpcLevel

ntoskrnl.exe

ZwQuerySystemInformation MmProbeAndLockPages KeEnterCriticalRegion IoAllocateMdl ExAcquireResourceExclusiveLite RtlInitUnicodeString MmMapIoSpace MmUnmapIoSpace MmGetPhysicalAddress ExReleaseResourceLite IoFreeMdl MmGetSystemRoutineAddress ExFreePoolWithTag MmUnmapLockedPages MmMapLockedPagesSpecifyCache KeLeaveCriticalRegion ObQueryNameString ZwQueryDirectoryObject ZwOpenDirectoryObject ZwClose RtlGetVersion wcsncpy RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize KeInitializeEvent KeWaitForSingleObject ExAllocatePoolWithTag ZwQueryObject IoDeleteDevice IoDeleteSymbolicLink IofCompleteRequest IoCreateSymbolicLink MmIsAddressValid PsRemoveLoadImageNotifyRoutine RtlAppendUnicodeStringToString PsSetLoadImageNotifyRoutine ZwReadFile RtlAppendUnicodeToString ZwCreateFile ObfDereferenceObject PsCreateSystemThread RtlCopyUnicodeString ZwWriteFile PsThreadType ObReferenceObjectByHandle MmHighestUserAddress _wcsnicmp PsTerminateSystemThread RtlEnumerateGenericTableAvl ObReferenceObjectByName IoDriverObjectType strstr KeNumberProcessors KeSetSystemAffinityThread KeRevertToUserAffinityThread KeCancelTimer KeStackAttachProcess PsLookupProcessByProcessId PsGetCurrentProcessId KeUnstackDetachProcess KeDeregisterBugCheckCallback SeUnregisterLogonSessionTerminatedRoutine CmUnRegisterCallback ExAllocatePool PsRemoveCreateThreadNotifyRoutine KeDeregisterBugCheckReasonCallback IoUnregisterFsRegistrationChange IoUnregisterShutdownNotification PsSetCreateProcessNotifyRoutine ZwOpenProcess memmove KeInitializeApc PsGetProcessId IoThreadToProcess RtlWalkFrameChain KeSetEvent KeInsertQueueApc PsGetThreadId KeClearEvent ZwOpenThread PsLookupThreadByThreadId SeCreateAccessState KeGetCurrentThread IoFreeIrp IoGetRelatedDeviceObject IoGetFileObjectGenericMapping ObCreateObject IoFileObjectType NtClose PsGetVersion IoCreateFile IoAllocateIrp IofCallDriver ObSetHandleAttributes ZwDuplicateObject PsInitialSystemProcess _wcslwr IoGetCurrentProcess wcsstr MmSystemRangeStart strncpy PsGetProcessImageFileName _strlwr _stricmp KeBugCheckEx ZwSetSecurityObject ObOpenObjectByPointer IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAddAccessAllowedAce RtlLengthSid memcpy memset wcschr RtlAbsoluteToSelfRelativeSD RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor ZwOpenKey ZwCreateKey ZwQueryValueKey ZwSetValueKey RtlFreeUnicodeString RtlCompareUnicodeString PsProcessType RtlUnwind

fltmgr.sys

FltEnumerateFilters

Name

.text

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

411b48a0603069e190c9fd97c3041aa38d9fc3c47a09980af41b8ef9c3b9d976

hal

ntoskrnl.exe

fltmgr.sys

generic