4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb

Sharing

Copy URL Twitter E-mail

General

Target
4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb
Size 185KB
Sample260930-lqck5axcmd
SHA256 4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb
MD5 2987ea894499d5766dc9b93a7e4a632f
SHA1 d9e1a8f7c19f2b66b0146cddaab940b4af5db05a
SHA512 5a169b7746d8d0903b986782d67fda6ae07462a6863e85bb44dd79f60f9d1b55ad167a4b2054ad76479fbf03562aae1c0554245683fd213babe4616b5e215cc0
SSDEEP 3072:F/38U8zEgQE2q348+ogEgErveTRe82d8XwmOO5O5O5O5O5O5O5Oe:F/38U8zEg08+qfG1e/WXw8
TLSH
T1FB04AED2B5684082ED27A43093A8DB93BD75328317116EFF12E5E6681D233C5EF3829D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb

File Explorer

4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb

.sys 185KB

4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb

IMPHASH 87ab0f0775f8df6bd0d20f12c1b0b786
SHA256 4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb
MD5 2987ea894499d5766dc9b93a7e4a632f
SHA1 d9e1a8f7c19f2b66b0146cddaab940b4af5db05a
SHA512 5a169b7746d8d0903b986782d67fda6ae07462a6863e85bb44dd79f60f9d1b55ad167a4b2054ad76479fbf03562aae1c0554245683fd213babe4616b5e215cc0
SSDEEP 3072:F/38U8zEgQE2q348+ogEgErveTRe82d8XwmOO5O5O5O5O5O5O5Oe:F/38U8zEg08+qfG1e/WXw8
TLSH
T1FB04AED2B5684082ED27A43093A8DB93BD75328317116EFF12E5E6681D233C5EF3829D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntoskrnl.exe

ExAllocatePool2 ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex IoAttachDeviceToDeviceStack IofCallDriver IofCompleteRequest IoCreateDevice IoDeleteDevice IoDetachDevice IoInitializeRemoveLockEx IoAcquireRemoveLockEx IoReleaseRemoveLockEx IoReleaseRemoveLockAndWaitEx IoAllocateWorkItem IoFreeWorkItem IoQueueWorkItem PoSetPowerState PoCallDriver PoStartNextPowerIrp MmGetSystemRoutineAddress KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock KeQueryActiveProcessorCountEx KeWaitForSingleObject MmFreeMappingAddress MmMapLockedPagesWithReservedMapping MmUnmapReservedMapping MmAllocatePagesForMdlEx MmFreePagesFromMdl PsGetVersion MmGetPhysicalAddress __C_specific_handler RtlInitUnicodeString KeClearEvent KeInitializeMutex KeReleaseMutex IoAllocateIrp IoCancelIrp IoFreeIrp ObReferenceObjectByHandle ObfDereferenceObject ZwClose ExEventObjectType KeWaitForMultipleObjects PsCreateSystemThread PsTerminateSystemThread ZwWaitForSingleObject __chkstk RtlCompareMemory KeDelayExecutionThread KeSetEvent KeInitializeEvent KeBugCheckEx MmAllocateMappingAddress KeGetCurrentIrql

hal

KeQueryPerformanceCounter

usbd.sys

USBD_CreateConfigurationRequestEx USBD_ParseConfigurationDescriptorEx

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4c63a2e003259b5a1acb0b714a7c764ea04ec36d3fb4b8ddc4260ea54a81ebfb

ntoskrnl.exe

hal

usbd.sys

generic