3c6a32359acab8c8ffa2a94bcbb250f588e4811ce7bf3af1316279f7512e80db

General

Target

3c6a32359acab8c8ffa2a94bcbb250f588e4811ce7bf3af1316279f7512e80db
Size

21KB
MD5

ffa098f4b0a53ed38149a86b15be379a
SHA1

a67e9d26f5623218d48edc7d4cbae47c4cb1a4e4
SHA256

3c6a32359acab8c8ffa2a94bcbb250f588e4811ce7bf3af1316279f7512e80db
SHA512

8a94cb0e8f02274f3624be139b8a1701cc035f3f15974582124348cb0d9ff1b5d4b16deedb584414a6ebf8346d945bb40d12fba355526377dd72df09ffaf48d8
SSDEEP

384:srlktChdR1jpperwYslHcD1/OlZEngW7PWiuf:nWLoYE1/vn1D6

Score

N/A

Malware Config

Signatures

Files

3c6a32359acab8c8ffa2a94bcbb250f588e4811ce7bf3af1316279f7512e80db
.exe windows x86

5d1dde690200750916f2e397a95df91c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_except_handler3
RtlInitUnicodeString
IoFreeMdl
MmUnmapLockedPages
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeInitializeSpinLock
wcsstr
ExFreePoolWithTag
_wcslwr
wcsncat
wcscat
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
ExAllocatePoolWithTag
_local_unwind2
wcslen
KeGetCurrentThread
_stricmp
ZwQuerySystemInformation
RtlQueryRegistryValues
PsGetCurrentProcessId
IofCompleteRequest
IoDeleteDevice
KeServiceDescriptorTable
wcscpy
ObOpenObjectByName
IoCreateSymbolicLink
IoCreateDevice
wcsncpy
ZwCreateKey
KeTickCount
KeBugCheckEx
MmGetSystemRoutineAddress
RtlAppendUnicodeToString

hal

KeGetCurrentIrql

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d1dde690200750916f2e397a95df91c

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 1024B - Virtual size: 996B

.data Size: 1KB - Virtual size: 1KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 1024B - Virtual size: 996B

.data
Size: 1KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 1KB - Virtual size: 1KB