ce8b8e4c45777e07b2923dbff64e3eb0ef870a8747c5eb67729d61ba2b6e948f

Sharing

Copy URL Twitter E-mail

General

Target

ce8b8e4c45777e07b2923dbff64e3eb0ef870a8747c5eb67729d61ba2b6e948f
Size

44KB
MD5

75e01c9bfa60cfbf02a07c9b50793fa1
SHA1

bb532d785e9ee361e48f6c8f6779b45f618903c5
SHA256

ce8b8e4c45777e07b2923dbff64e3eb0ef870a8747c5eb67729d61ba2b6e948f
SHA512

6540cd4d82740ef44f182f1f0a76d1691f0ef41f1542b81d00e6bcb649d6ad2227dabdc7e8338cd362d37f95dcf38300e1361d48ce1d989512cc8514bd42f229
SSDEEP

768:3R2YhYhFR+A1cHW1+Bnijge0JU1QBnP1XbUBBbNINTMc93T0jzFjnWnuQSc20YQe:3RkmA1cHWAB0gnPpUB/IZMc9AAZ

Score

N/A

Malware Config

Signatures

Files

ce8b8e4c45777e07b2923dbff64e3eb0ef870a8747c5eb67729d61ba2b6e948f
.exe windows x86

d32e93bf3bc0c551a306686bf487f7aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

RtlQueryRegistryValues
memmove
DbgBreakPoint
ExAllocatePoolWithTag
MmLockPagableDataSection
IoDeleteDevice
KeInitializeDpc
KeInitializeTimer
KeInitializeSpinLock
RtlInitUnicodeString
IoCreateDevice
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
MmUnmapIoSpace
KeRemoveQueueDpc
KeCancelTimer
IoDisconnectInterrupt
RtlIntegerToUnicodeString
ExFreePool
RtlWriteRegistryValue
wcslen
ZwEnumerateKey
ZwOpenKey
RtlEqualUnicodeString
MmMapIoSpace
IoCreateSymbolicLink
RtlDeleteRegistryValue
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoReportResourceUsage
ExAllocatePoolWithQuotaTag
KeInsertQueueDpc
MmQuerySystemSize
KeDelayExecutionThread
KeQuerySystemTime
RtlUnwind
IoGetConfigurationInformation
IoConnectInterrupt
MmUnlockPagableImageSection
IoAcquireCancelSpinLock
IofCompleteRequest
InterlockedExchange
KeSetTimer
KeSynchronizeExecution
IoReleaseCancelSpinLock
IoQueryDeviceDescription
ZwClose

hal

WRITE_PORT_BUFFER_UCHAR
HalTranslateBusAddress
KfRaiseIrql
KfLowerIrql
READ_PORT_UCHAR
KdComPortInUse
HalGetInterruptVector
WRITE_PORT_UCHAR
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGESER
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d32e93bf3bc0c551a306686bf487f7aa

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 416B - Virtual size: 404B

PAGESER Size: 18KB - Virtual size: 18KB

INIT Size: 15KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 416B - Virtual size: 404B

PAGESER
Size: 18KB - Virtual size: 18KB

INIT
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 1KB