eaf92c395a9da7da51f27af7bdfff5dc346f0a2f7f7d60c63cb728d33fc6110d

General

Target

eaf92c395a9da7da51f27af7bdfff5dc346f0a2f7f7d60c63cb728d33fc6110d
Size

12KB
MD5

0590b0f3b73e403a9bdc4cb5f4c4673f
SHA1

2e9024b46410255d5fc02d55dec6524d6a665306
SHA256

eaf92c395a9da7da51f27af7bdfff5dc346f0a2f7f7d60c63cb728d33fc6110d
SHA512

f34ab5c05b11b20c3542916f12cecca8ba2b78b8ae343be6e51579b76e102f08820b960f6d0041be083fe86974644a6bbdf1685100fa3d9080028e906c3246c8
SSDEEP

192:kFdmZI+vm9w2QyPs2ir7D/WH+F8zvHP8ekeC:Qz1cvs+oP0ekeC

Score

N/A

Malware Config

Signatures

Files

eaf92c395a9da7da51f27af7bdfff5dc346f0a2f7f7d60c63cb728d33fc6110d
.exe windows x86

82c9ba3f471a7c62022396d1e2c30090

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memcpy
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
KeGetCurrentThread
IoAllocateIrp
IoGetBaseFileSystemDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
IofCompleteRequest
IoDetachDevice
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePool
MmIsAddressValid
strrchr
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObReferenceObjectByName
IoDriverObjectType
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
InterlockedExchange
strcmp
RtlFreeAnsiString
strstr
_strlwr
RtlUnicodeStringToAnsiString
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
KeServiceDescriptorTable
_stricmp
RtlCompareMemory

hal

KeGetCurrentIrql

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82c9ba3f471a7c62022396d1e2c30090

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 932B

.data Size: 512B - Virtual size: 20B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 512B - Virtual size: 420B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 932B

.data
Size: 512B - Virtual size: 20B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 512B - Virtual size: 420B