964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70

General

Target
964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70
Size 110KB
Sample261009-rxvm6sbe36
SHA256 964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70
MD5 7fc0cb461f3acbbd78641495124fc6a9
SHA1 de59ea54a61ce459f175c56e06c19b3f4647fd9f
SHA512 16134c1f2df9b1f4eaf4ef277d5ade82c210c8081636502b4b8b6000b6dad5cdbf53c29f292fef464b36b6bcf681e4d26aa6c8013b17a36a575a625198a42154
SSDEEP 1536:faU5kGdeTphvq4UMTdrsyLXmsYE3Rc78bKtzRn6QK7u74mt7SpE8JJDp9Ao99F/E:SXLdDmG3R2LzR07Yw7Dpyi/kH
TLSH
T1FBB38442E76ED099D461E931B4921A17E7A57C08873A9BF79B114F250E733E0F83EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70

File Explorer

964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70

.sys 110KB

964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70

IMPHASH 053789910f9f5716f7e25fa29bda1c3f
SHA256 964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70
MD5 7fc0cb461f3acbbd78641495124fc6a9
SHA1 de59ea54a61ce459f175c56e06c19b3f4647fd9f
SHA512 16134c1f2df9b1f4eaf4ef277d5ade82c210c8081636502b4b8b6000b6dad5cdbf53c29f292fef464b36b6bcf681e4d26aa6c8013b17a36a575a625198a42154
SSDEEP 1536:faU5kGdeTphvq4UMTdrsyLXmsYE3Rc78bKtzRn6QK7u74mt7SpE8JJDp9Ao99F/E:SXLdDmG3R2LzR07Yw7Dpyi/kH
TLSH
T1FBB38442E76ED099D461E931B4921A17E7A57C08873A9BF79B114F250E733E0F83EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

120712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\test\acx01\objchk_win7_amd64\amd64\Acx.pdb

ntoskrnl.exe

RtlAppendUnicodeToString RtlGetVersion KeReleaseSpinLock RtlEqualUnicodeString MmBuildMdlForNonPagedPool IoFreeMdl IoVolumeDeviceToDosName ObQueryNameString IoFileObjectType ZwCreateFile MmMapLockedPagesSpecifyCache IoGetCurrentProcess PsSetCreateProcessNotifyRoutineEx rand ObReferenceObjectByHandleWithTag ZwClose srand RtlAppendUnicodeStringToString ObCloseHandle ZwDeleteFile MmUnlockPages PsGetCurrentProcessId RtlCopyUnicodeString ObfDereferenceObject RtlAssert CmUnRegisterCallback MmGetSystemRoutineAddress ZwWriteFile ObOpenObjectByPointer PsGetProcessId DbgPrint PsLookupThreadByThreadId ZwEnumerateKey IoAllocateMdl KeAcquireSpinLockRaiseToDpc wcschr ExReleaseFastMutex ExAcquireFastMutex strstr KeInitializeEvent ZwQuerySystemInformation IoDriverObjectType ZwQueryValueKey ExAllocatePool PsTerminateSystemThread PsReferenceProcessFilePointer PsGetProcessInheritedFromUniqueProcessId ObReferenceObjectByName IoQueryFileDosDeviceName ZwOpenKey KeBugCheckEx ObGetFilterVersion MmFlushImageSection RtlInitUnicodeString ZwReadFile KdEnteredDebugger PsIsSystemThread PsLookupProcessByProcessId PsGetProcessImageFileName ObUnRegisterCallbacks ExFreePoolWithTag IoCreateFileEx PsProcessType ExAllocatePoolWithTag ZwQueryInformationFile MmUnmapLockedPages __C_specific_handler __chkstk

fltmgr.sys

FltParseFileNameInformation FltReleaseFileNameInformation FltRegisterFilter FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltUnregisterFilter FltGetFileNameInformation FltIsDirectory FltFreeSecurityDescriptor FltCreateCommunicationPort FltSetCallbackDataDirty FltCloseClientPort FltCancelFileOpen FltStartFiltering

Name

.text

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

964717f4d014345b1dfe4b48f45c37e30b0ccbc3355e2504197044edaae76e70

ntoskrnl.exe

fltmgr.sys

generic