4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8dMalwareBaazar.zip
- SHA256 b2e33fb1ea8ae59d68a146e1f29710a3625576b5478d6c7599216711ad231cef
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
General
- Target 4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8dMalwareBaazar.zip
- Size 84KB
- Sample261029-1n4ddsgv4l
- SHA256 b2e33fb1ea8ae59d68a146e1f29710a3625576b5478d6c7599216711ad231cef
- MD5 19f25f400efc8099d3eff52523f3f5c7
- SHA1 c37639296e6a670dc3059914c3ee64e4b4612dd6
- SHA512 1303c268b081e06f99f3d1bc60e8ab46514ab7e453a725a479ccbd6e8a551bfcc1af34e7011202fd89fedc49936a9208ff391c80550fb3cd3195d8b3dbede470
- SSDEEP 1536:52mmNrz4R6wVBDPiGYhanFGv6AdlM+xFxAFb8DIdybk2vAOw2GWoS7jKJ8TUF:kHZ4ZnDPi58cvPxxDPDIdyg2oOEHsAF
- TLSH T17B83021379216D619C4AB6D6EE48EDB2320FD5615A0CC91E0816723C9F72293C96FBB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d.exe
File Explorer
-
4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8dMalwareBaazar.zip.zip 84KB
-
4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d.exe.sys 163KB
4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d.exe
- IMPHASH 7ea52ebb4ba76fa741e5256af8757f91
- SHA256 4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d
- MD5 b5f122f3f07f618c0a7678fa40801faa
- SHA1 7440358c5041eba34e8673100989df756a6426da
- SHA512 5a17d3cc3a45e2a71de2916bf68d071e0bb572e3b981843fac3c7e9301ee9ce4363c0543236a846d6af44fafd045c334db4d48b5903b778e5305afa6d4c195fb
- SSDEEP 3072:ez/App7eWoqDigbz8LFbt3qmIONEffrCGtVrYZcrCGgTgdGxOKd0Nz0dChQVNY:ez/83o/hbt3qmIZfMgQV6
- TLSH T1CEF37B22A29421E8E56BD5BCC1429727FAF3F4811720C6CF47A089A92F637F1F579391
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
35424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\tools\oldfilelaoda\x64\Release\CrackerDrv.pdb
netio.sys
WskReleaseProviderNPI
WskCaptureProviderNPI
WskQueryProviderCharacteristics
WskDeregister
WskRegister
fltmgr.sys
FltReleaseFileNameInformation
FltGetFileNameInformation
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
fwpkclnt.sys
FwpmEngineClose0
FwpmFilterDeleteById0
FwpmFilterCreateEnumHandle0
FwpmFilterEnum0
FwpmFilterDestroyEnumHandle0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmCalloutAdd0
FwpmCalloutDeleteById0
FwpmFilterAdd0
FwpsCalloutRegister3
FwpsCalloutUnregisterById0
FwpmEngineOpen0
FwpmFreeMemory0
ntoskrnl.exe
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlEqualUnicodeString
PsLoadedModuleList
strstr
RtlInitUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeQueryTimeIncrement
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
MmMapIoSpace
MmUnmapIoSpace
IoGetDeviceObjectPointer
ObfDereferenceObject
MmCopyMemory
MmIsAddressValid
RtlRandomEx
_vsnwprintf
ZwQuerySystemInformation
ObReferenceObjectByName
strlen
IoDriverObjectType
DbgPrintEx
RtlGetVersion
KeDelayExecutionThread
KeWaitForSingleObject
ExGetPreviousMode
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IoFreeMdl
ObReferenceObjectByHandle
NtTraceControl
ProbeForRead
ProbeForWrite
IoCreateDevice
IoDeleteDevice
__C_specific_handler
__chkstk
_stricmp
_vsnprintf
RtlIpv4StringToAddressA
ObRegisterCallbacks
ObUnRegisterCallbacks
PsGetProcessId
PsGetThreadProcess
PsProcessType
PsThreadType
PsGetProcessExitStatus
RtlInitAnsiString
KeUnstackDetachProcess
SeLocateProcessImageName
PsReferencePrimaryToken
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
MmGetSystemRoutineAddress
PsGetProcessWow64Process
PsGetProcessImageFileName
PsGetProcessPeb
PsReferenceProcessFilePointer
wcsrchr
_wcsicmp
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlFreeAnsiString
DbgPrint
CmUnRegisterCallback
CmRegisterCallbackEx
IoGetCurrentProcess
ObReferenceObjectByHandleWithTag
ObCloseHandle
ZwCreateFile
ZwOpenFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwClose
ZwCreateKey
ZwOpenKey
ZwEnumerateKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
PsGetCurrentProcessId
PsGetCurrentThreadId
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
IoFileObjectType
ExAllocatePoolWithTagPriority
MmProbeAndLockPages
MmUnlockPages
MmUnmapLockedPages
MmAllocateMappingAddress
MmMapIoSpaceEx
MmAllocateContiguousMemory
MmGetPhysicalMemoryRangesEx
MmGetVirtualForPhysical
IoCreateFileSpecifyDeviceObjectHint
ZwTerminateProcess
ZwFreeVirtualMemory
ZwQueryVirtualMemory
ZwWaitForSingleObject
ZwProtectVirtualMemory
RtlCreateUserThread
PsGetProcessSectionBaseAddress
strcmp
strchr
KeInitializeEvent
KeClearEvent
KeSetEvent
wcslen
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
IoAllocateIrp
IoCancelIrp
IoFreeIrp
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlGetElementGenericTableAvl
MmCopyVirtualMemory
KeStackAttachProcess
hal
KeQueryPerformanceCounter
Name
.text
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=33145,
count=7, id=260, version=33145,
count=8, id=257, version=33145,
count=168, id=1, productName=Unmarked objects,
count=3, id=257, version=33140,
count=3, id=261, version=34436,
count=22, id=261, version=35222,
count=4, id=260, version=35222,
count=1, id=258, version=35222,