514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439

General

Target
514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439
Size 745KB
Sample260930-v5fe1ast8j
SHA256 514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439
MD5 0efc524fd1478489ea89a60cb4e7304f
SHA1 e3a73da5d0d0105f5daf66ec2efd2044970f3e5a
SHA512 f0df289071338a11c8f19cbf878cd605376f385576a64e7352ce3189b8a43b21e39674968ccbe345b7b651210c65e9519ffd120238b0cb4793d3bbb3d5d966d5
SSDEEP 12288:B1Nff6hnwK/FZtYOkdD+6gqLuM+U64AYlk:TNff6hwAZtpkdD+DO9tt9l
TLSH
T191F42907D5B5C2C5F106C8B45229F7579960387C4008B3F7EFA18A92B3B5E8CAD9BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439

File Explorer

514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439

.sys 745KB

514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439

IMPHASH 40a75126a18f29ae3a7f10b7ff1d40c4
SHA256 514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439
MD5 0efc524fd1478489ea89a60cb4e7304f
SHA1 e3a73da5d0d0105f5daf66ec2efd2044970f3e5a
SHA512 f0df289071338a11c8f19cbf878cd605376f385576a64e7352ce3189b8a43b21e39674968ccbe345b7b651210c65e9519ffd120238b0cb4793d3bbb3d5d966d5
SSDEEP 12288:B1Nff6hnwK/FZtYOkdD+6gqLuM+U64AYlk:TNff6hwAZtpkdD+DO9tt9l
TLSH
T191F42907D5B5C2C5F106C8B45229F7579960387C4008B3F7EFA18A92B3B5E8CAD9BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

366582

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

KK_HookDriver.pdb

ntoskrnl.exe

CmRegisterCallbackEx CmUnRegisterCallback DbgPrint DbgPrintEx ExAllocatePool ExAllocatePoolWithTag ExAllocatePoolWithTagPriority ExFreePoolWithTag ExGetPreviousMode IoAllocateMdl IoCreateFileEx IoCreateFileSpecifyDeviceObjectHint IoDriverObjectType IoFileObjectType IoFreeMdl IoGetCurrentProcess KeDelayExecutionThread KeGetCurrentIrql KeQueryTimeIncrement KeStackAttachProcess KeUnstackDetachProcess KeWaitForSingleObject MmAllocateContiguousMemory MmAllocateMappingAddress MmBuildMdlForNonPagedPool MmCopyMemory MmCopyVirtualMemory MmFlushImageSection MmGetPhysicalMemoryRangesEx MmGetSystemRoutineAddress MmGetVirtualForPhysical MmIsAddressValid MmMapIoSpace MmMapIoSpaceEx MmMapLockedPagesSpecifyCache MmProbeAndLockPages MmUnlockPages MmUnmapIoSpace MmUnmapLockedPages NtTraceControl ObCloseHandle ObReferenceObjectByHandle ObReferenceObjectByHandleWithTag ObReferenceObjectByName ObRegisterCallbacks ObUnRegisterCallbacks ObfDereferenceObject PsCreateSystemThread PsGetCurrentProcessId PsGetProcessExitStatus PsGetProcessId PsGetProcessImageFileName PsGetProcessPeb PsGetProcessSectionBaseAddress PsGetProcessWow64Process PsLoadedModuleList PsLookupProcessByProcessId PsProcessType PsReferencePrimaryToken PsReferenceProcessFilePointer PsTerminateSystemThread RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlCreateUserThread RtlEqualUnicodeString RtlFreeAnsiString RtlFreeUnicodeString RtlGetVersion RtlInitAnsiString RtlInitUnicodeString RtlRandomEx RtlUnicodeStringToAnsiString SeLocateProcessImageName ZwAllocateVirtualMemory ZwClose ZwDeleteFile ZwFreeVirtualMemory ZwProtectVirtualMemory ZwQuerySystemInformation ZwQueryVirtualMemory ZwTerminateProcess ZwWaitForSingleObject __C_specific_handler __chkstk _stricmp _vsnwprintf strcmp strlen strstr wcsrchr

hal

KeQueryPerformanceCounter

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

llvmmsvc

Size

716KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

514de664cab724fac95d44cfd9d7a3e12b38a3af9bfdecbd546ae1d044dce439

ntoskrnl.exe

hal

generic