21d0dfe981bc1c7a5c066003065bfae756ca09502c36d247bf24319b3d4cc368

General

Target

21d0dfe981bc1c7a5c066003065bfae756ca09502c36d247bf24319b3d4cc368
Size

77KB
MD5

d13417fd2ddb6c6d6fd3e3f4e2c85764
SHA1

a59ed8a45e595789012340b18415f451022b226f
SHA256

21d0dfe981bc1c7a5c066003065bfae756ca09502c36d247bf24319b3d4cc368
SHA512

1a67ad46c379977d64e3223a604a9fecd97432c90d6efc79594d26f7a7bb76a0ea80b057dc84805589f7210072a058a704a62cd980d0fa3910f758b6282019f4
SSDEEP

1536:WAsdyTHQFuF/8MXO7FDgAtGIhXi7WsSQJDNcsmjE3wRSMeO:BiKwFux8vrtDdQnmjEIJ

Score

N/A

Malware Config

Signatures

Files

21d0dfe981bc1c7a5c066003065bfae756ca09502c36d247bf24319b3d4cc368
.dll windows x86

d55c955a79730aebfe7c00b4bf24d68f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitializeBitMap
ExFreePool
ExAllocatePool
RtlImageNtHeader
KeProfileInterruptWithSource
IoBuildAsynchronousFsdRequest
FsRtlUninitializeMcb
RtlQueryTimeZoneInformation
memcpy

classpnp.sys

ClassStopUnitPowerHandler
ClassWmiFireEvent
ClassEnableMediaChangeDetection
ClassSendIrpSynchronous
ClassNotifyFailurePredicted
ClassMarkChildrenMissing
ClassDisableMediaChangeDetection
ClassQueryTimeOutRegistryValue
ClassAcquireChildLock
ClassCreateDeviceObject
ClassInternalIoControl

hal

WRITE_PORT_UCHAR
KfLowerIrql
IoReadPartitionTable
WRITE_PORT_ULONG
HalProcessorIdle
READ_PORT_BUFFER_UCHAR
READ_PORT_UCHAR
HalGetBusData
KeAcquireSpinLock
HalStartProfileInterrupt
READ_PORT_BUFFER_USHORT
HalReportResourceUsage
HalSetDisplayParameters
KeRaiseIrqlToSynchLevel
HalInitSystem
HalGetAdapter
HalCalibratePerformanceCounter
IoFreeMapRegisters

Exports

Exports

QpCyocbGr
VvKpudahYfzrl
Ehaa
TinXwtcbgNaoyNie
YwrtGkhsneTueurt
DvzdbPtrhccbHnv
AhdcqhXrqczOhicpnqLqn
EtoGsomDzreaxbDazzcrAu
LjBuvrgfTmpbwFs

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 38B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d55c955a79730aebfe7c00b4bf24d68f

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

classpnp.sys

hal

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 69KB - Virtual size: 160KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 38B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 69KB - Virtual size: 160KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 38B