1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec

General

Target
1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec
Size 45KB
Sample261014-c4c95svs4l
SHA256 1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec
MD5 f3081d8e6beec45476f2d7165fdc6bde
SHA1 4168e64f5856d1cf2cff2ed565238f3c2c2c9ff5
SHA512 c46920387d7ccc6113c3b293e5ea92b90d782e99e0fdbd16a02506ac5bf854c18e2b822a6d70cf05fa5a89f4e6fb90ceeac6080706e5dfd8cd25d217f3ff9ca7
SSDEEP 768:0cFosSX4F4A04p1UyzFNQCF0eTAK+HoqdwlV++SVLM+OUHGXlIpOF9:XQo71UyhvFfioqwv8M+OQAIpOF
TLSH
T174236C12B2A414F8D5ABC17DC6624617E57274161336EADF4760CA6B0F2A7F1B83FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec

File Explorer

1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec

.sys 45KB

1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec

IMPHASH dcfab1a736843ecde6401a6c4a123aab
SHA256 1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec
MD5 f3081d8e6beec45476f2d7165fdc6bde
SHA1 4168e64f5856d1cf2cff2ed565238f3c2c2c9ff5
SHA512 c46920387d7ccc6113c3b293e5ea92b90d782e99e0fdbd16a02506ac5bf854c18e2b822a6d70cf05fa5a89f4e6fb90ceeac6080706e5dfd8cd25d217f3ff9ca7
SSDEEP 768:0cFosSX4F4A04p1UyzFNQCF0eTAK+HoqdwlV++SVLM+OUHGXlIpOF9:XQo71UyhvFfioqwv8M+OQAIpOF
TLSH
T174236C12B2A414F8D5ABC17DC6624617E57274161336EADF4760CA6B0F2A7F1B83FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\hap\88388 8125驱动\8838 8125驱动\Release\x64\rtl8125.pdb

ndis.sys

NdisReadConfiguration NdisCloseConfiguration NdisFreeMemory NdisInitializeString NdisOpenConfigurationEx NdisAllocateMemoryWithTagPriority NdisAllocateTimerObject NdisCancelTimerObject NdisFreeTimerObject NdisAllocateNetBufferListPool NdisFreeNetBufferListPool NdisMRegisterInterruptEx NdisMDeregisterInterruptEx NdisMSetMiniportAttributes NdisMDeregisterMiniportDriver NdisMUnmapIoSpace NdisMSleep NdisMAllocateSharedMemory NdisMFreeSharedMemory NdisMRegisterScatterGatherDma NdisMDeregisterScatterGatherDma NdisMSendNetBufferListsComplete NdisMGetBusData NdisSetTimerObject NdisMIndicateStatusEx NdisAllocateNetBufferAndNetBufferList NdisFreeNetBufferList NdisAllocateMdl NdisFreeMdl NdisMIndicateReceiveNetBufferLists NdisMMapIoSpace NdisMRegisterMiniportDriver

usbd.sys

USBD_CreateConfigurationRequestEx USBD_ParseConfigurationDescriptorEx

ntoskrnl.exe

KeReleaseSpinLock MmGetSystemRoutineAddress KeInitializeSpinLock KfRaiseIrql KeInitializeEvent KeSetEvent KeDelayExecutionThread KeSetPriorityThread KeWaitForSingleObject KeQueryActiveProcessorCountEx ExAllocatePoolWithTag ExFreePoolWithTag PsCreateSystemThread PsTerminateSystemThread ObReferenceObjectByHandle ObfDereferenceObject ZwClose MmGetPhysicalMemoryRanges KeAcquireSpinLockRaiseToDpc ZwQuerySystemInformation __C_specific_handler KeClearEvent KeAcquireSpinLockAtDpcLevel KeReleaseSpinLockFromDpcLevel RtlInitUnicodeString RtlGUIDFromString IoAllocateIrp IofCallDriver IoCancelIrp IoFreeIrp IoGetDeviceObjectPointer IoGetDeviceInterfaces ZwOpenKey ZwEnumerateKey ZwQueryValueKey IoGetLowerDeviceObject wcslen KeGetCurrentIrql MmMapLockedPagesSpecifyCache MmGetVirtualForPhysical KeLowerIrql

hal

KeStallExecutionProcessor

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1ca07d7535de2e963e9bd06509d793a043d14c102c6543b7d8edc7a6ca6b2eec

ndis.sys

usbd.sys

ntoskrnl.exe

hal

generic