f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43

Sharing

Copy URL Twitter E-mail

General

Target
f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43
Size 1.8MB
Sample261014-3krarsae57
SHA256 f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43
MD5 2a0fae9cc4ce8580148eb541c307b03e
SHA1 9559696e80c4162efa6c4fb366976a97bf83b18e
SHA512 7341bb8fa4fd321c2e5d2abeee32958822309d252582bd5dc00734f015a4ff3919b19ef3c038ce7cd3f29b05a8b572f78b7b18cd3d576e4fef50289dda9109e7
SSDEEP 24576:mLBT7q+BjZuS3OcFb2QnqPu9zOYvin6/v/fNTeDoNynk5Oz4SUly0zuDsAhW88ZI:Y7qEDEoZcntRPD3
TLSH
T1A1956B269EB61276CDB7F4BE4B9F110E9712BA02CF6E1BE72219550509703C937B878C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43

File Explorer

f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43

.sys 1.8MB

f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43

IMPHASH 01928d9a7f1dafb3f9504d2d1927d346
SHA256 f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43
MD5 2a0fae9cc4ce8580148eb541c307b03e
SHA1 9559696e80c4162efa6c4fb366976a97bf83b18e
SHA512 7341bb8fa4fd321c2e5d2abeee32958822309d252582bd5dc00734f015a4ff3919b19ef3c038ce7cd3f29b05a8b572f78b7b18cd3d576e4fef50289dda9109e7
SSDEEP 24576:mLBT7q+BjZuS3OcFb2QnqPu9zOYvin6/v/fNTeDoNynk5Oz4SUly0zuDsAhW88ZI:Y7qEDEoZcntRPD3
TLSH
T1A1956B269EB61276CDB7F4BE4B9F110E9712BA02CF6E1BE72219550509703C937B878C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntoskrnl.exe

KeSetTargetProcessorDpc KeInitializeTimerEx KeSetTimerEx KeSetEvent wcsnlen KeDelayExecutionThread KeBugCheck PsSetCreateProcessNotifyRoutineEx wcsncat_s wcsncpy_s wcsstr swprintf_s RtlCopyUnicodeString IoCreateDevice IoCreateSymbolicLink wcsrchr RtlAppendUnicodeStringToString PsCreateSystemThread ZwUnloadDriver ZwClose wcsncmp RtlInt64ToUnicodeString IoCreateFile ObReferenceObjectByHandle ZwCreateFile ZwOpenFile ZwQueryInformationFile ZwSetInformationFile ZwReadFile IoCreateFileSpecifyDeviceObjectHint IoGetBaseFileSystemDeviceObject ZwDeleteFile IoFileObjectType _wcsnicmp ExAllocatePool ZwOpenKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject _strnicmp _wcslwr MmGetSystemRoutineAddress PsGetProcessId PsLookupProcessByProcessId PsLookupThreadByThreadId IoThreadToProcess PsProcessType PsThreadType PsGetVersion ZwQueryObject DbgPrintEx RtlTimeToTimeFields KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLockAtDpcLevel KeReleaseInStackQueuedSpinLockFromDpcLevel KeGetCurrentProcessorNumberEx KeAreAllApcsDisabled ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion ExSystemTimeToLocalTime PsTerminateSystemThread ZwWriteFile PsGetCurrentThreadId ZwFlushBuffersFile _vsnprintf PsGetProcessImageFileName KdDebuggerNotPresent KeQueryTimeIncrement MmProbeAndLockPages MmUnlockPages MmMapLockedPagesSpecifyCache MmUnmapLockedPages IoAllocateMdl IoFreeMdl ZwOpenSection ZwMapViewOfSection ZwUnmapViewOfSection _vsnwprintf RtlCompareMemory SeQueryInformationToken PsReferencePrimaryToken KeInitializeMutex KeReleaseMutex KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsGetProcessExitStatus KeStackAttachProcess KeUnstackDetachProcess ZwQueryVirtualMemory KeInitializeDpc ZwCreateKey ZwFlushKey ZwSetValueKey ZwCreateSection vswprintf_s ObRegisterCallbacks ObUnRegisterCallbacks PsSetCreateThreadNotifyRoutine PsRemoveCreateThreadNotifyRoutine PsSetLoadImageNotifyRoutine PsRemoveLoadImageNotifyRoutine strstr _strlwr IoBuildDeviceIoControlRequest IoDriverObjectType IoGetLowerDeviceObject KeNumberProcessors ProbeForRead ProbeForWrite MmBuildMdlForNonPagedPool RtlInitAnsiString strncmp RtlFreeUnicodeString PsGetProcessPeb wcsncpy RtlUnicodeStringToInteger _wcsupr _strupr RtlInsertElementGenericTableFullAvl MmGetVirtualForPhysical KeQueryActiveProcessors MmMapIoSpace MmUnmapIoSpace MmGetPhysicalAddress ZwOpenDirectoryObject towupper toupper RtlAnsiStringToUnicodeString ZwSetSecurityObject IoDeviceObjectType RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeExports RtlCreateSecurityDescriptor wcschr RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlLengthSid IoIsWdmVersionAvailable RtlSetDaclSecurityDescriptor IoDeleteSymbolicLink IoDeleteDevice IofCompleteRequest __C_specific_handler ObOpenObjectByPointer PsGetProcessCreateTimeQuadPart MmIsAddressValid ExFreePoolWithTag ExAllocatePoolWithTag KeRegisterBugCheckReasonCallback KeDeregisterBugCheckReasonCallback ObfDereferenceObject IoGetAttachedDeviceReference IofCallDriver IoBuildSynchronousFsdRequest KeWaitForSingleObject KeInitializeEvent RtlFreeAnsiString RtlCompareUnicodeString RtlUnicodeStringToAnsiString RtlInitUnicodeString strncpy PsGetCurrentProcessId IoGetCurrentProcess PsInitialSystemProcess KeBugCheckEx

fltmgr.sys

FltReleaseFileNameInformation FltGetFileNameInformationUnsafe

hal

KeQueryPerformanceCounter HalGetBusDataByOffset KeStallExecutionProcessor

hidparse.sys

HidP_GetCollectionDescription

wdfldr.sys

WdfVersionBind WdfVersionBindClass WdfVersionUnbind WdfVersionUnbindClass

Name

.text

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f3afd0fd6121c17b63b9285a7f4a9fdefce3462cade822b6141a1d952e943c43

ntoskrnl.exe

fltmgr.sys

hal

hidparse.sys

wdfldr.sys

generic