09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b

General

Target
09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b
Size 2.0MB
Sample261027-ycc1ysed46
SHA256 09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b
MD5 e1ce7745e4e94ed090b316aae1792e4b
SHA1 d7eb9cf34862d893716754aa256e5d8c5afc856d
SHA512 9694c97d4676b5e1fcd8bad21bb1586b55df6e716a59ad59b589f46f73eca9a84d26590bb0903224c4f6663b05c1fd77c1b38487013eef0f85de2feb59614415
SSDEEP 49152:TJvePzNEq+VVqCBaRXi807XtoDJJv8KaAvIJa/NH2z2hNRVHl5b6dwl:uRXi8nv8zAga/Zi27R
TLSH
T17FA55C03D7E8BA7DCA37DA385483231EF1496028039087F387DD3AB149775A51EA9DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b

File Explorer

09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b

.sys 2.0MB

09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b

IMPHASH 23dab7c5862fe1ce27f42bff12f21506
SHA256 09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b
MD5 e1ce7745e4e94ed090b316aae1792e4b
SHA1 d7eb9cf34862d893716754aa256e5d8c5afc856d
SHA512 9694c97d4676b5e1fcd8bad21bb1586b55df6e716a59ad59b589f46f73eca9a84d26590bb0903224c4f6663b05c1fd77c1b38487013eef0f85de2feb59614415
SSDEEP 49152:TJvePzNEq+VVqCBaRXi807XtoDJJv8KaAvIJa/NH2z2hNRVHl5b6dwl:uRXi8nv8zAga/Zi27R
TLSH
T17FA55C03D7E8BA7DCA37DA385483231EF1496028039087F387DD3AB149775A51EA9DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

15212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntoskrnl.exe

RtlCompareUnicodeString RtlAnsiStringToUnicodeString RtlRandomEx PsLoadedModuleList RtlFreeUnicodeString RtlInitAnsiString KeBugCheck __C_specific_handler RtlDeleteRegistryValue RtlDeleteElementGenericTableAvl RtlAppendUnicodeToString IoFreeIrp IoGetRelatedDeviceObject ObfDereferenceObject RtlInitUnicodeString RtlLookupElementGenericTableAvl IoFileObjectType KeSetEvent ExAllocatePool2 ObReferenceObjectByHandle RtlGetVersion ZwDeleteKey IoCreateFile MmGetSystemRoutineAddress IoAllocateIrp IofCallDriver ExFreePoolWithTag KeInitializeEvent KeWaitForSingleObject ZwClose ZwOpenKey ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList MmMapViewInSystemSpace MmUnmapViewInSystemSpace ExAllocatePoolWithTag ExIsProcessorFeaturePresent ZwOpenSection ZwQuerySection MmSectionObjectType ExInitializeResourceLite ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion ExDeleteResourceLite RtlUnwindEx KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList RtlInitializeGenericTableAvl RtlInsertElementGenericTableAvl RtlGetElementGenericTableAvl PsGetCurrentThreadId PsGetThreadId PsGetThreadProcessId RtlRaiseException strcpy_s IoGetStackLimits RtlPcToFileHeader RtlUnwind

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

09cadcef36183f086d37aa9d775484fb2f5b11e77836ae2681e688178ed6ec8b

ntoskrnl.exe

generic