b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba

General

Target
b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba
Size 33KB
Sample261102-tyf8aadw7j
SHA256 b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba
MD5 51be2957f78b3677e1828ce902e97c2d
SHA1 9c094694b0eb66d89e39ad41c9176b6974251474
SHA512 d5a96b8f8341fdd32ab57e24377bd537298bd5bf4cad7f287a8e24ade66913b096be7faedd21ed6052ae09111975a45ca7c235ca77b06d50a4a6a5273097687e
SSDEEP 768:GDpR+tSij4W5Gq+juuK+L+gSKcmggAEF1ziP9:SpcAijp5GVhLxSLmggHF1z
TLSH
T177F2076BE283AABCC5B9D0B097D7653679B0B4061321EEFF01D18F312962EE1143EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba

File Explorer

b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba

.sys 33KB

b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba

IMPHASH aba6ede9fd41cefa10f1d5c6b230c4f4
SHA256 b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba
MD5 51be2957f78b3677e1828ce902e97c2d
SHA1 9c094694b0eb66d89e39ad41c9176b6974251474
SHA512 d5a96b8f8341fdd32ab57e24377bd537298bd5bf4cad7f287a8e24ade66913b096be7faedd21ed6052ae09111975a45ca7c235ca77b06d50a4a6a5273097687e
SSDEEP 768:GDpR+tSij4W5Gq+juuK+L+gSKcmggAEF1ziP9:SpcAijp5GVhLxSLmggHF1z
TLSH
T177F2076BE283AABCC5B9D0B097D7653679B0B4061321EEFF01D18F312962EE1143EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ACE-BASE.pdb

ntoskrnl.exe

ExAllocatePool ExAllocatePoolWithTag ExAllocatePoolWithTagPriority ExFreePoolWithTag IoAllocateIrp IoAllocateMdl IoBuildDeviceIoControlRequest IoCreateDevice IoCreateFile IoCreateFileEx IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoDriverObjectType IoFileObjectType IoFreeIrp IoFreeMdl IoGetCurrentProcess IoGetDeviceObjectPointer IoGetFileObjectGenericMapping IofCallDriver IofCompleteRequest KeAcquireSpinLockRaiseToDpc KeInitializeEvent KeReleaseSpinLock KeSetEvent KeStackAttachProcess KeUnstackDetachProcess KeWaitForSingleObject MmBuildMdlForNonPagedPool MmCopyVirtualMemory MmCreateMdl MmFlushImageSection MmGetSystemRoutineAddress MmIsAddressValid MmMapLockedPagesSpecifyCache MmProbeAndLockPages MmUnlockPages MmUnmapLockedPages ObCloseHandle ObCreateObject ObReferenceObjectByHandle ObReferenceObjectByHandleWithTag ObReferenceObjectByName ObfDereferenceObject ProbeForRead PsGetProcessImageFileName PsGetProcessPeb PsGetProcessSectionBaseAddress PsGetProcessWow64Process PsLoadedModuleList PsLookupProcessByProcessId RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlEqualUnicodeString RtlFindExportedRoutineByName RtlFreeUnicodeString RtlGetVersion RtlImageDirectoryEntryToData RtlInitAnsiString RtlInitUnicodeString SeCreateAccessState ZwAllocateVirtualMemory ZwClose ZwDeleteFile ZwFreeVirtualMemory ZwQuerySystemInformation ZwTerminateProcess __C_specific_handler __chkstk strcmp strlen strstr wcscpy

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

llvmmsvc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b0365ae461c868c81f239ed526eeaea17752c33c7c8f4189e4983ce2b0d5ccba

ntoskrnl.exe

generic