4410cd84495e1e6650d5b8062117d99dede4de9a51802a2b679d8d7bda88d750

General

Target

4410cd84495e1e6650d5b8062117d99dede4de9a51802a2b679d8d7bda88d750
Size

15KB
MD5

f66452baf06c960f74f72e8cec5b36c5
SHA1

e0a9c6b57e970a025bd48d8948d6d3ef770b9dd3
SHA256

4410cd84495e1e6650d5b8062117d99dede4de9a51802a2b679d8d7bda88d750
SHA512

9ff61fe57ccabd9ec04a2b8d1dd30d6573f90178dff07dd6bfee28be26320534fe07e3bef1596deaa8b17626991e6bb51bb22228b0f4e61f890cfded85018f22
SSDEEP

192:nwFn2GIjtPMi0dl8DPDtcBc/jsmxQaP8FfFKQJdEerH7JB3UKvPJa+oSz:nwF5mL0P8bDtcBqKfFRJGeZNnPpz

Score

N/A

Malware Config

Signatures

Files

4410cd84495e1e6650d5b8062117d99dede4de9a51802a2b679d8d7bda88d750
.exe windows x86

308b4551244f2687791fce6838e06366

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
_snprintf
ZwCreateFile
RtlInitUnicodeString
_snwprintf
PsTerminateSystemThread
KeDelayExecutionThread
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
strchr
atoi
wcstombs
ZwWaitForSingleObject
ZwEnumerateKey
ZwQueryValueKey
wcscat
wcslen
ZwOpenKey
wcscpy
KeServiceDescriptorTable
ZwSetValueKey
MmIsAddressValid
KeAddSystemServiceTable
wcscmp
ZwQuerySystemInformation
ZwFreeVirtualMemory
KeUserModeCallback
ZwAllocateVirtualMemory
ZwQueryInformationProcess
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
KeClearEvent
KeSetEvent
PsGetCurrentProcessId
KeWaitForSingleObject
NtBuildNumber
KeInitializeEvent
ZwDeleteFile
ZwWriteFile
strstr
ObfDereferenceObject
ObReferenceObjectByHandle
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
_except_handler3

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 576B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 960B - Virtual size: 942B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

308b4551244f2687791fce6838e06366

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 416B - Virtual size: 412B

.data Size: 576B - Virtual size: 568B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 960B - Virtual size: 942B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 416B - Virtual size: 412B

.data
Size: 576B - Virtual size: 568B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 960B - Virtual size: 942B