f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130

General

Target
f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130
Size 79KB
Sample261102-ar6pta1x4m
SHA256 f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130
MD5 8af703d07cc0720a1ec895abb1ef53f1
SHA1 c2e9faf2ea7331a239f757d178ffbfedac4d4631
SHA512 7a3a83a7af615aadf84f09f3829208a9bc256928986b68841106bb888566a15597c35d7768acef6a7260d811f5f3a43644cf23336de8df532d9d08e4da3cfe34
SSDEEP 1536:8Hp07eb2BOTVvzHx0wZONW6OlaJzxsVs24YvgPuEwujx9CD:8J0ab9xK9O4V2EwMC
TLSH
T19C8329C663A8E0F8E6A1D2B8E7975523E7B0B0601B119BCF4560C79A6F53AF5EC35301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130

File Explorer

f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130

.sys 79KB

f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130

IMPHASH e518f50e2a0ef2c305a0691deb8d98c9
SHA256 f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130
MD5 8af703d07cc0720a1ec895abb1ef53f1
SHA1 c2e9faf2ea7331a239f757d178ffbfedac4d4631
SHA512 7a3a83a7af615aadf84f09f3829208a9bc256928986b68841106bb888566a15597c35d7768acef6a7260d811f5f3a43644cf23336de8df532d9d08e4da3cfe34
SSDEEP 1536:8Hp07eb2BOTVvzHx0wZONW6OlaJzxsVs24YvgPuEwujx9CD:8J0ab9xK9O4V2EwMC
TLSH
T19C8329C663A8E0F8E6A1D2B8E7975523E7B0B0601B119BCF4560C79A6F53AF5EC35301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

10176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Code\OpenArk\src\OpenArk\res\driver\OpenArkDrv64.pdb

ntoskrnl.exe

IoAllocateMdl ExAcquireResourceExclusiveLite RtlInitUnicodeString MmMapIoSpace MmUnmapIoSpace MmGetPhysicalAddress ExReleaseResourceLite IoFreeMdl MmGetSystemRoutineAddress ExFreePoolWithTag MmUnmapLockedPages MmMapLockedPagesSpecifyCache KeLeaveCriticalRegion ObQueryNameString ZwQueryDirectoryObject ZwOpenDirectoryObject ZwClose RtlGetVersion wcsncpy RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize KeInitializeEvent KeWaitForSingleObject ExAllocatePoolWithTag ZwQueryObject IoDeleteDevice IoDeleteSymbolicLink IoCreateDevice IofCompleteRequest IoCreateSymbolicLink DbgSetDebugPrintCallback MmIsAddressValid PsRemoveLoadImageNotifyRoutine RtlAppendUnicodeStringToString PsSetLoadImageNotifyRoutine ZwReadFile RtlAppendUnicodeToString ZwCreateFile ObfDereferenceObject PsCreateSystemThread RtlCopyUnicodeString ZwWriteFile PsThreadType ObReferenceObjectByHandle MmHighestUserAddress _wcsnicmp PsTerminateSystemThread ObReferenceObjectByName IoDriverObjectType strstr KeEnterCriticalRegion KeSetSystemAffinityThread KeRevertToUserAffinityThread KeCancelTimer KeStackAttachProcess PsLookupProcessByProcessId PsGetCurrentProcessId KeUnstackDetachProcess KeDeregisterBugCheckCallback SeUnregisterLogonSessionTerminatedRoutine CmUnRegisterCallback PsProcessType PsRemoveCreateThreadNotifyRoutine KeDeregisterBugCheckReasonCallback IoUnregisterFsRegistrationChange IoUnregisterShutdownNotification ObUnRegisterCallbacks PsSetCreateProcessNotifyRoutine ZwOpenProcess KeInitializeApc PsGetProcessId IoThreadToProcess RtlWalkFrameChain KeSetEvent KeInsertQueueApc PsGetThreadId KeClearEvent ZwOpenThread PsLookupThreadByThreadId SeCreateAccessState IoFreeIrp IoGetRelatedDeviceObject IoGetFileObjectGenericMapping ObCreateObject IoFileObjectType NtClose PsGetVersion IoCreateFile IoAllocateIrp IofCallDriver ExReleaseRundownProtection ObSetHandleAttributes ZwDuplicateObject PsInitialSystemProcess _wcslwr IoGetCurrentProcess wcsstr MmSystemRangeStart strncpy PsGetProcessImageFileName _strlwr _stricmp KeBugCheckEx ZwQuerySystemInformation MmProbeAndLockPages ExAllocatePool KeNumberProcessors RtlCompareUnicodeString RtlUnwindEx

fwpkclnt.sys

FwpsCalloutUnregisterById0

fltmgr.sys

FltUnregisterFilter FltEnumerateFilters

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

848B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f8013a1cd4166ca52f4fee6371fdb8128c1bda6500ac6c6b5a8723db368ec130

ntoskrnl.exe

fwpkclnt.sys

fltmgr.sys

generic