8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e

General

Target
8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e
Size 159KB
Sample261015-xt19fab14k
SHA256 8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e
MD5 b4fc1f392ec134b7454c7668548fa8db
SHA1 079683e5e06e5dfb427189516618b8a2302a0bf8
SHA512 eb1dd81149ec36fce6864a5d8ed1e653554f1064e43202dde9370d7e8151db19e6da8142d8954f20c88020bf6d54323b0de9aa7157ca1613cb6ad9882e7c216f
SSDEEP 3072:98aMGj1Zidjgs7baH+LfNhHNs2uMPuxJF7bJBTZd:9NMgiJg8BhfuMPu7BTZ
TLSH
T174F3F84262E829E9F6B7D678C9698402D6F3B8222712CACF42714556CF237C1BD357F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e

File Explorer

8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e

.sys 159KB

8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e

IMPHASH 3de3abb2c99fc932b00107c535f17132
SHA256 8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e
MD5 b4fc1f392ec134b7454c7668548fa8db
SHA1 079683e5e06e5dfb427189516618b8a2302a0bf8
SHA512 eb1dd81149ec36fce6864a5d8ed1e653554f1064e43202dde9370d7e8151db19e6da8142d8954f20c88020bf6d54323b0de9aa7157ca1613cb6ad9882e7c216f
SSDEEP 3072:98aMGj1Zidjgs7baH+LfNhHNs2uMPuxJF7bJBTZd:9NMgiJg8BhfuMPu7BTZ
TLSH
T174F3F84262E829E9F6B7D678C9698402D6F3B8222712CACF42714556CF237C1BD357F2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

196608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\yngwfp-build\out_rival\x64\Release\yngdrv.pdb

fwpkclnt.sys

FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsAcquireClassifyHandle0 FwpsQueryConnectionRedirectState0 FwpsStreamContinue0 FwpsCopyStreamDataToBuffer0 FwpsCalloutUnregisterByKey0 FwpsRedirectHandleDestroy0 FwpsReleaseClassifyHandle0 FwpsRedirectHandleCreate0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsStreamInjectAsync0 FwpsCalloutUnregisterById0 FwpsCalloutRegister1 FwpmFilterGetById0 FwpmFilterDeleteById0 FwpmFilterAdd0 FwpmCalloutGetByKey0 FwpmCalloutDeleteByKey0 FwpmCalloutAdd0 FwpmEngineClose0 FwpmEngineOpen0 FwpsFreeNetBufferList0 FwpmFreeMemory0

ndis.sys

NdisFreeNetBufferListPool NdisAllocateNetBufferListPool NdisFreeGenericObject NdisGetDataBuffer NdisAllocateGenericObject

fltmgr.sys

FltObjectDereference FltEnumerateVolumes FltReadFile FltCreateFile FltAttachVolume FltParseFileNameInformation FltReleaseFileNameInformation FltGetFileNameInformation FltStartFiltering FltUnregisterFilter FltRegisterFilter FltGetRequestorProcessId

ntoskrnl.exe

RtlInitUnicodeString IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink PsGetCurrentProcessId RtlCompareUnicodeString RtlCompareMemory KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExAllocatePoolWithTag ExFreePoolWithTag ObfDereferenceObject ZwCreateFile ZwQueryInformationFile ZwReadFile ZwClose PsLookupProcessByProcessId _strnicmp DbgPrint IoGetCurrentProcess PsGetProcessImageFileName RtlInitAnsiString RtlAnsiStringToUnicodeString MmMapLockedPagesSpecifyCache __chkstk MmBuildMdlForNonPagedPool IoAllocateMdl IoFreeMdl _vsnprintf RtlEqualUnicodeString KeGetCurrentIrql IoRegisterShutdownNotification IoUnregisterShutdownNotification ZwSetInformationFile ZwWriteFile ZwCreateKey ZwOpenKey ZwDeleteKey ZwDeleteValueKey ZwEnumerateKey ZwQueryValueKey ZwSetValueKey __C_specific_handler wcslen wcschr _vsnwprintf MmGetSystemRoutineAddress KeFlushQueuedDpcs KeInitializeEvent KeSetEvent KeDelayExecutionThread KeWaitForSingleObject MmProbeAndLockPages MmUnlockPages MmProtectMdlSystemAddress SeRegisterImageVerificationCallback SeUnregisterImageVerificationCallback PsCreateSystemThread PsTerminateSystemThread ObRegisterCallbacks ObUnRegisterCallbacks MmIsAddressValid PsSetCreateProcessNotifyRoutineEx PsSetLoadImageNotifyRoutine PsRemoveLoadImageNotifyRoutine PsGetProcessId IoRegisterDriverReinitialization IoCreateFileEx SeLocateProcessImageName IoThreadToProcess strlen PsProcessType PsThreadType ExGetPreviousMode CmRegisterCallback CmUnRegisterCallback CmRegisterCallbackEx CmCallbackGetKeyObjectIDEx CmCallbackReleaseKeyObjectIDEx RtlPrefixUnicodeString

Name

.text

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e76abbf9c26d2515a187ee026d7e0d0df365ffd2c5da90649423248f63cec5e

fwpkclnt.sys

ndis.sys

fltmgr.sys

ntoskrnl.exe

generic