c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502

Sharing

Copy URL Twitter E-mail

General

Target
c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502
Size 3.9MB
Sample261104-w361lsed57
SHA256 c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502
MD5 285b09ee1afd25ca1802754cee6b0e60
SHA1 fe6186a0d6dce508f7e45b411af60ad90dde5dc0
SHA512 1855e8c6b5ca93821cd1db7340fe2da2b87c6818e4d537c2a5ee14a4a2382bc98ba95509b6736704457f0693eb2b7737066d676df62336a8e1d7a109e421d63d
SSDEEP 49152:6CX5WF7qT9Ps0xCTl+F5CCP1IMi4d2w8u7gAvqRStBbYi:6j7qT9Urm5CCdhjLYSTB
TLSH
T149166B16DEE212EBCDF7E47D4B8B210EA513BA06CF3E6BD72209540619706D937B8748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502

File Explorer

c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502

.sys 3.9MB

c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502

IMPHASH 89b275c47eb318bee6df6081a90b7644
SHA256 c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502
MD5 285b09ee1afd25ca1802754cee6b0e60
SHA1 fe6186a0d6dce508f7e45b411af60ad90dde5dc0
SHA512 1855e8c6b5ca93821cd1db7340fe2da2b87c6818e4d537c2a5ee14a4a2382bc98ba95509b6736704457f0693eb2b7737066d676df62336a8e1d7a109e421d63d
SSDEEP 49152:6CX5WF7qT9Ps0xCTl+F5CCP1IMi4d2w8u7gAvqRStBbYi:6j7qT9Urm5CCdhjLYSTB
TLSH
T149166B16DEE212EBCDF7E47D4B8B210EA513BA06CF3E6BD72209540619706D937B8748
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3747840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ACE-BASE.pdb

ntoskrnl.exe

PsAcquireProcessExitSynchronization PsReleaseProcessExitSynchronization KeSetEvent ExEventObjectType KeInitializeMutex KeReleaseMutex KeDelayExecutionThread MmGetSystemRoutineAddress PsGetProcessCreateTimeQuadPart wcscat_s ZwClose ZwCreateKey ZwOpenKey ZwDeleteKey ZwSetValueKey ZwDeleteFile KeAreAllApcsDisabled KeDeregisterBugCheckReasonCallback KeRegisterBugCheckReasonCallback IoCreateNotificationEvent KeInitializeGuardedMutex strcpy_s KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsGetCurrentThreadId ObOpenObjectByPointer PsGetProcessSessionId PsGetProcessInheritedFromUniqueProcessId ZwFreeVirtualMemory PsReferenceProcessFilePointer ZwCreateFile RtlNtStatusToDosError PsGetThreadId IoFileObjectType ExSemaphoreObjectType PsProcessType PsThreadType PsJobType SeTokenObjectType ObReferenceObjectByHandle IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink KeIpiGenericCall ProbeForWrite PsGetProcessPeb PsCreateSystemThread ZwOpenSection ZwMapViewOfSection ZwUnmapViewOfSection RtlRandomEx KeClearEvent IoCreateSymbolicLink IoRegisterShutdownNotification IoUnregisterShutdownNotification MmProbeAndLockPages MmUnlockPages MmMapLockedPagesSpecifyCache MmUnmapLockedPages IoAllocateMdl IoFreeMdl KeEnterCriticalRegion KeLeaveCriticalRegion ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite RtlInitializeGenericTableAvl RtlInsertElementGenericTableAvl RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl RtlGetElementGenericTableAvl RtlNumberGenericTableElementsAvl RtlIsGenericTableEmptyAvl RtlUpcaseUnicodeString RtlTimeToTimeFields ExSystemTimeToLocalTime RtlEqualUnicodeString RtlCopyUnicodeString RtlWalkFrameChain KeWaitForMultipleObjects PsGetProcessId KeTryToAcquireGuardedMutex ObfReferenceObject ObDereferenceObjectDeferDelete PsGetThreadProcess KeGetCurrentProcessorNumberEx RtlIntegerToUnicodeString RtlAppendUnicodeToString SeQuerySessionIdToken PsReferencePrimaryToken PsDereferencePrimaryToken ObQueryNameString KeInitializeDpc KeSetTargetProcessorDpc KeInitializeTimerEx KeCancelTimer KeSetTimerEx KeUnstackDetachProcess KeQueryTimeIncrement KeQueryActiveProcessors MmBuildMdlForNonPagedPool PsGetVersion MmUserProbeAddress ZwFlushKey KeQueryActiveProcessorCountEx RtlCompareMemory ExAcquireRundownProtection ExReleaseRundownProtection PsGetThreadProcessId IoVolumeDeviceToDosName PsInitialSystemProcess ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableFullAvl MmGetVirtualForPhysical IoDriverObjectType RtlInt64ToUnicodeString ZwQuerySystemInformation KeNumberProcessors KeRevertToUserAffinityThread KeSetSystemAffinityThread KeSetPriorityThread RtlCompareString RtlEnumerateGenericTableWithoutSplayingAvl ZwOpenThread ZwOpenDirectoryObject ZwEnumerateKey ProbeForRead PsGetProcessWow64Process IoCreateFile ZwOpenFile ZwQueryInformationFile ZwSetInformationFile ZwReadFile IoCreateFileSpecifyDeviceObjectHint IoGetBaseFileSystemDeviceObject IoQueryFileInformation PsGetProcessExitStatus RtlImageDirectoryEntryToData RtlQueryAtomInAtomTable PsGetThreadWin32Thread MmProtectMdlSystemAddress ZwQueryObject NtClose ObGetObjectType ExAcquireFastMutex ExReleaseFastMutex RtlUpcaseUnicodeChar RtlUpcaseUnicodeToMultiByteN RtlAnsiCharToUnicodeChar ZwSetSecurityObject IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeExports RtlCreateSecurityDescriptor wcschr RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlLengthSid IoIsWdmVersionAvailable RtlSetDaclSecurityDescriptor RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString RtlUnicodeStringToInteger __C_specific_handler RtlAppendStringToString RtlPrefixUnicodeString ObfDereferenceObject IoGetAttachedDeviceReference IofCallDriver IoBuildSynchronousFsdRequest ExFreePoolWithTag ExAllocatePool KeWaitForSingleObject KeInitializeEvent RtlFreeAnsiString RtlUnicodeStringToAnsiString RtlInitUnicodeString PsGetCurrentProcessId IoGetCurrentProcess KeBugCheckEx PsLookupProcessByProcessId MmIsAddressValid KeStackAttachProcess PsGetProcessImageFileName ExAllocatePoolWithTag KeReleaseGuardedMutex KeAcquireGuardedMutex RtlCompareUnicodeString PsSetCreateProcessNotifyRoutineEx IoGetDeviceProperty IoBuildDeviceIoControlRequest IoGetDeviceObjectPointer PsIsThreadTerminating PsLookupThreadByThreadId ZwQueryInformationThread KeInitializeApc KeInsertQueueApc ZwOpenProcess RtlAppendUnicodeStringToString ZwCreateSection MmMapViewInSystemSpace MmUnmapViewInSystemSpace RtlGetVersion ZwUnloadDriver ZwQueryInformationProcess ExGetPreviousMode strncpy_s HalDispatchTable KeSetSystemGroupAffinityThread KeRevertToUserGroupAffinityThread KeGetProcessorNumberFromIndex MmAllocateContiguousMemory MmFreeContiguousMemory MmProbeAndLockProcessPages DbgPrint ObReferenceObjectByName IoAllocateIrp IoFreeIrp wcsncpy_s IoGetLowerDeviceObject ZwAllocateVirtualMemory ExFreePool MmGetPhysicalAddress PsTerminateSystemThread MmUnmapIoSpace ZwQueryValueKey MmMapIoSpace

fltmgr.sys

FltParseFileNameInformation FltReleaseFileNameInformation FltGetVolumeProperties FltGetVolumeFromInstance FltClose FltSetInformationFile FltWriteFile FltReadFile FltCreateFileEx FltGetFileNameInformationUnsafe FltGetFileNameInformation FltFreePoolAlignedWithTag FltAllocatePoolAlignedWithTag FltObjectDereference FltUnregisterFilter FltGetRequestorProcessId

hidparse.sys

HidP_GetCollectionDescription

ndis.sys

NdisCloseConfiguration NdisReadConfiguration NdisOpenConfigurationEx

hal

HalGetBusDataByOffset KeStallExecutionProcessor HalSetBusDataByOffset KeQueryPerformanceCounter

Name

.text

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c0b89a26d75bf2736866955dfe66c526b0784226d41ba386cfe9621cde540502

ntoskrnl.exe

fltmgr.sys

hidparse.sys

ndis.sys

hal

generic