cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a

Sharing

Copy URL Twitter E-mail

General

Target
cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a
Size 367KB
Sample260928-s24x3sysbt
SHA256 cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a
MD5 04d212e2ad6794c7e365147722685733
SHA1 f737047b0a577a7a84074be265b19c242dc8fbbe
SHA512 652f1e968a41cf3e864e115bfc812d049af4d873416003d84cbe425ebdf34d947c84201241ac9c7160b3d7f543a9c8fe01b89ab0af5683fb40f5214bec2f8101
SSDEEP 6144:Oluvz8oD//3qQmZ4Wc3fLZQLVgxpKHavMCh/ix5fY6iy2CHxFMLVByir:PzmZ4WcvLZpAwhNi7fY6HDML
TLSH
T115848C69E35926EBD8A69135C6174A17EBF0FC050391C3CB06E405AA6F273E06E3DBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a

File Explorer

cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a

.sys 367KB

cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a

IMPHASH 60071ed5355a180893ebfdacb29f5cd5
SHA256 cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a
MD5 04d212e2ad6794c7e365147722685733
SHA1 f737047b0a577a7a84074be265b19c242dc8fbbe
SHA512 652f1e968a41cf3e864e115bfc812d049af4d873416003d84cbe425ebdf34d947c84201241ac9c7160b3d7f543a9c8fe01b89ab0af5683fb40f5214bec2f8101
SSDEEP 6144:Oluvz8oD//3qQmZ4Wc3fLZQLVgxpKHavMCh/ix5fY6iy2CHxFMLVByir:PzmZ4WcvLZpAwhNi7fY6HDML
TLSH
T115848C69E35926EBD8A69135C6174A17EBF0FC050391C3CB06E405AA6F273E06E3DBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

393632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-22915930\bora-vmsoft\build\release-x64\svga\wddm\src\miniport\Win8Stats\x64\bin\vm3dmp-stats.pdb

ntoskrnl.exe

ExFreePoolWithTag MmUnlockPages IoFreeMdl RtlCopyMemoryNonTemporal KeLowerIrql KfRaiseIrql KeSetEvent KeWaitForSingleObject ProbeForRead ProbeForWrite MmProbeAndLockPages MmMapLockedPagesSpecifyCache MmAllocatePagesForMdlEx MmFreePagesFromMdl MmMapIoSpace MmUnmapIoSpace IoAllocateMdl ObReferenceObjectByHandle ObfDereferenceObject PsGetCurrentProcessId ExEventObjectType wcsncmp RtlGetVersion RtlCmDecodeMemIoResource KeGetCurrentIrql MmAllocateContiguousMemory MmFreeContiguousMemory IoGetDeviceProperty MmGetPhysicalAddress PsSetCreateProcessNotifyRoutine KeInitializeDpc KeInsertQueueDpc KeRemoveQueueDpc KeFlushQueuedDpcs KeInitializeEvent KeInitializeTimer KeCancelTimer KeSetTimer KeSetTimerEx KeIpiGenericCall KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock KeQueryActiveProcessorCountEx KeGetCurrentProcessorNumberEx ExAcquireFastMutex __C_specific_handler MmBuildMdlForNonPagedPool MmUnmapLockedPages IoGetCurrentProcess IoOpenDeviceRegistryKey ZwClose ZwSetValueKey RtlEqualSid SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken SeExports RtlInitUnicodeString MmGetSystemRoutineAddress VerSetConditionMask RtlVerifyVersionInfo IofCompleteRequest IoCreateDevice IoDeleteDevice PsCreateSystemThread PsTerminateSystemThread isspace RtlIntegerToUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlAppendUnicodeToString ZwQueryValueKey _vsnprintf atoi KeBugCheckEx IofCallDriver IoGetDeviceObjectPointer IoBuildDeviceIoControlRequest ZwLoadDriver ZwUnloadDriver KeDelayExecutionThread strncmp ExReleaseFastMutex ExAllocatePoolWithTag DbgPrintEx _stricmp strchr RtlRaiseException

hal

KeQueryPerformanceCounter

Name

.text

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mstv

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msts

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msti

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cdd349b80634bf818b6bd02b0f69983006eb32f8c4009403843207e3d823df3a

ntoskrnl.exe

hal

generic