cd306e8666f7429015ae3c20c05408d6d270f5e5157d61a08db4fb9355fa792d

General

Target

cd306e8666f7429015ae3c20c05408d6d270f5e5157d61a08db4fb9355fa792d
Size

48KB
MD5

730c3041cec493845e0b707d31a681d0
SHA1

2249e5a9dd0101180dcd31afb6cb9268b213cca8
SHA256

cd306e8666f7429015ae3c20c05408d6d270f5e5157d61a08db4fb9355fa792d
SHA512

f485eb21c5dbd4885948d9a782ca11fb62eb819416de9097c94b84c5efa12f152f474f1fecaf5c73c9895e50569c7905a37048faa53c486ca2a7ae85190e980a
SSDEEP

768:d1B2pFjEETcYZ/tMPiUgSKVtGVI/vcJQKB/PNUWK0oec6kXrcRh:d1BcAETD6qUf0wI43NC1PoT

Score

N/A

Malware Config

Signatures

Files

cd306e8666f7429015ae3c20c05408d6d270f5e5157d61a08db4fb9355fa792d
.exe windows x86

daebfde0e48ad75ef1c7cc02b0cbb699

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ObfDereferenceObject
IoDetachDevice
IofCallDriver
IoFreeMdl
memcpy
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
PsGetCurrentProcessId
KeInsertQueueDpc
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoFreeIrp
IoDeleteDevice
MmMapLockedPagesSpecifyCache
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
RtlInitUnicodeString
ObfReferenceObject
KeWaitForSingleObject
KeInitializeEvent
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
IoAllocateIrp
ExAllocatePoolWithTag
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daebfde0e48ad75ef1c7cc02b0cbb699

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

tdi.sys

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 896B - Virtual size: 804B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 896B - Virtual size: 808B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 896B - Virtual size: 804B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 896B - Virtual size: 808B

.reloc
Size: 2KB - Virtual size: 2KB