d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576

General

Target
d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576
Size 24KB
Sample261102-tyf8aaxw9j
SHA256 d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576
MD5 d7cc8ae17e914f89ae6662874f70d297
SHA1 06a1b3729e0a0881d2f3af571e507fa5ec5b6c4f
SHA512 ecc232e015c8d7896812447247fcc28af9c5146068e2c99a12095a63353d044fbcdecf118a9d9d248229678711ee813a4c1718da107c066e3bacf936f3684cd7
SSDEEP 384:uySq7S0HxFrfxyn2yU5qYk+BYEtTOu73MK8as59JthMbzYthY39h:uwS0RRfxy2u5+BDOuQK85BYNh
TLSH
T166B22A03A39A71E5E6BAC1BEC6935827EAF4B50613119FFF0260C8690B17BE0653E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576

File Explorer

d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576

.sys 24KB

d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576

IMPHASH f1bb343de8db03bcf3039efd113ecd5f
SHA256 d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576
MD5 d7cc8ae17e914f89ae6662874f70d297
SHA1 06a1b3729e0a0881d2f3af571e507fa5ec5b6c4f
SHA512 ecc232e015c8d7896812447247fcc28af9c5146068e2c99a12095a63353d044fbcdecf118a9d9d248229678711ee813a4c1718da107c066e3bacf936f3684cd7
SSDEEP 384:uySq7S0HxFrfxyn2yU5qYk+BYEtTOu73MK8as59JthMbzYthY39h:uwS0RRfxy2u5+BDOuQK85BYNh
TLSH
T166B22A03A39A71E5E6BAC1BEC6935827EAF4B50613119FFF0260C8690B17BE0653E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\魔改\x64\Release\ACE-BASE.pdb

ntoskrnl.exe

strstr RtlInitAnsiString RtlInitUnicodeString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlEqualUnicodeString RtlFreeUnicodeString RtlGetVersion KeInitializeEvent KeWaitForSingleObject KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExAllocatePoolWithTag ExAllocatePoolWithTagPriority ExFreePoolWithTag ProbeForRead MmProbeAndLockPages MmUnlockPages MmMapLockedPagesSpecifyCache MmUnmapLockedPages IoAllocateMdl IoBuildDeviceIoControlRequest IofCallDriver IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoGetCurrentProcess IoGetDeviceObjectPointer ObfDereferenceObject MmIsAddressValid ZwTerminateProcess KeStackAttachProcess KeUnstackDetachProcess PsLookupProcessByProcessId ZwAllocateVirtualMemory ZwFreeVirtualMemory PsGetProcessPeb PsGetProcessWow64Process PsGetProcessSectionBaseAddress ZwQuerySystemInformation RtlImageDirectoryEntryToData PsGetProcessImageFileName MmCopyVirtualMemory RtlFindExportedRoutineByName __C_specific_handler __chkstk strcmp PsLoadedModuleList ObReferenceObjectByHandleWithTag ObCloseHandle IoCreateFileEx MmFlushImageSection ZwDeleteFile IoFileObjectType KeSetEvent ExAllocatePool IoAllocateIrp IoCreateFile IoFreeIrp ObReferenceObjectByHandle ZwClose IoGetFileObjectGenericMapping SeCreateAccessState ObCreateObject

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

780B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d5347a27910cf95f9d2774c5a06e16ed1e7331f0b51c58c8e3dad18d66217576

ntoskrnl.exe

generic