af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d

General

Target
af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d
Size 56KB
Sample261014-mx69rabz2p
SHA256 af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d
MD5 8b5272a3bc68d00c7bd76ae90b35e149
SHA1 16de2b7a3b769bb67a1caee18df22b78b79639c9
SHA512 aff614a5cd78aa3a831f918cdfb98eed0a0cb2eb5284fa4e32728c95860c434497f67282c9c1f98fe36f6add77503a2692e28fc862cefcfafee0451129a4736e
SSDEEP 1536:VZ7MYlZv2UMOmEv6Qa8pg95n7K+Jadv7EGzmvg5UIKf9o:OROsQa8pgz7SEOUIKFo
TLSH
T17B434CC3D2D154FEC05BD239964F9A31FA7BB89113306BEF03D08A36BEA16D05934698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d

File Explorer

af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d

.sys 56KB

af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d

IMPHASH af5bd7549a21bfccb6a2161e3e5dac3a
SHA256 af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d
MD5 8b5272a3bc68d00c7bd76ae90b35e149
SHA1 16de2b7a3b769bb67a1caee18df22b78b79639c9
SHA512 aff614a5cd78aa3a831f918cdfb98eed0a0cb2eb5284fa4e32728c95860c434497f67282c9c1f98fe36f6add77503a2692e28fc862cefcfafee0451129a4736e
SSDEEP 1536:VZ7MYlZv2UMOmEv6Qa8pg95n7K+Jadv7EGzmvg5UIKf9o:OROsQa8pgz7SEOUIKFo
TLSH
T17B434CC3D2D154FEC05BD239964F9A31FA7BB89113306BEF03D08A36BEA16D05934698
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

69680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nvme.pdb

ntoskrnl.exe

ExAcquireFastMutex ExAcquireRundownProtection ExAllocatePool2 ExAllocatePoolWithTag ExFreePoolWithTag ExInitializeRundownProtection ExReInitializeRundownProtection ExReleaseFastMutex ExReleaseRundownProtection ExWaitForRundownProtectionRelease IoAllocateIrp IoConnectInterrupt IoConnectInterruptEx IoDisconnectInterrupt IoDisconnectInterruptEx IoFreeIrp IoGetDmaAdapter IoInitializeRemoveLockEx IofCallDriver KeAcquireSpinLockAtDpcLevel KeAcquireSpinLockRaiseToDpc KeClearEvent KeDelayExecutionThread KeFlushQueuedDpcs KeGetCurrentIrql KeInitializeDpc KeInitializeEvent KeInitializeMutex KeInitializeSpinLock KeInsertQueueDpc KeQuerySystemTimePrecise KeReadStateEvent KeReleaseMutex KeReleaseSpinLock KeReleaseSpinLockFromDpcLevel KeSetEvent KeWaitForMultipleObjects KeWaitForSingleObject MmGetSystemRoutineAddress ObfDereferenceObject RtlAppendUnicodeToString RtlCopyUnicodeString RtlGetVersion RtlInitUnicodeString RtlQueryRegistryValues __C_specific_handler __chkstk

storport.sys

StorPortExtendedFunction StorPortInitialize StorPortNotification

hal

KeQueryPerformanceCounter KeStallExecutionProcessor

cng.sys

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenRandom BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptVerifySignature

Name

.text

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

af52a0093de13835a265c986e76e0f6933b4f08495fd3a8da7c1b69e647e655d

ntoskrnl.exe

storport.sys

hal

cng.sys

generic