d615c6081a7ea42152d75a39c55462ecb50ab76699c82aabae9c107ca97602c2

Sharing

Copy URL Twitter E-mail

General

Target

d615c6081a7ea42152d75a39c55462ecb50ab76699c82aabae9c107ca97602c2
Size

23KB
MD5

6d477bfe1e67b373aeef530348b80f20
SHA1

14a6d08b485adf1a71bef57c73fc680ad04b9281
SHA256

d615c6081a7ea42152d75a39c55462ecb50ab76699c82aabae9c107ca97602c2
SHA512

8cf114ab124640705bf6907cbc77ff9e7b731b3253dc37997509d9ba3161f7aa679ea4debc4ec1cc4bdcfac41b19aad85ef1e163ba183f217714ea60354d0e68
SSDEEP

384:D+PGGGGGGo9mZrZJJxPlFG7vrMnDNResW29+YbS0XSWE:D+PGGGGGGo9CrZJJZlFG74pRbW29nbSQ

Score

N/A

Malware Config

Signatures

Files

d615c6081a7ea42152d75a39c55462ecb50ab76699c82aabae9c107ca97602c2
.exe windows x86

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
_stricmp
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
ZwQuerySystemInformation
IoGetRelatedDeviceObject
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 608B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 736B - Virtual size: 716B

.data Size: 608B - Virtual size: 608B

sosata2 Size: 32B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 928B - Virtual size: 912B

.reloc Size: 928B - Virtual size: 926B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 736B - Virtual size: 716B

.data
Size: 608B - Virtual size: 608B

sosata2
Size: 32B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 928B - Virtual size: 926B