b05d2351ad2fa5877229761cf5fd2c3ed52990524aa9665d1285277c50175f06

Sharing

Copy URL Twitter E-mail

General

Target

b05d2351ad2fa5877229761cf5fd2c3ed52990524aa9665d1285277c50175f06
Size

23KB
MD5

42d49fec074abe204c89f9210826ffe0
SHA1

d21f90044e4364d0b27e142e197f968a56572af7
SHA256

b05d2351ad2fa5877229761cf5fd2c3ed52990524aa9665d1285277c50175f06
SHA512

2bf63028c933c8f3900901090d224f0025f6bfe8951c732b2efe57def4c9c09e331863d206973b90c3c937671fa9bc29e2034f1dc3c1afa01f6ac949eccafb1c
SSDEEP

384:nS+PGGGGGGo9mZrZJJxPlFG7vrMnDNResW29+YbS0XSWE:nS+PGGGGGGo9CrZJJZlFG74pRbW29nbP

Score

N/A

Malware Config

Signatures

Files

b05d2351ad2fa5877229761cf5fd2c3ed52990524aa9665d1285277c50175f06
.exe windows x86

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
_stricmp
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
ZwQuerySystemInformation
IoGetRelatedDeviceObject
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 608B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 736B - Virtual size: 716B

.data Size: 608B - Virtual size: 608B

sosata2 Size: 32B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 928B - Virtual size: 912B

.reloc Size: 928B - Virtual size: 926B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 736B - Virtual size: 716B

.data
Size: 608B - Virtual size: 608B

sosata2
Size: 32B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 928B - Virtual size: 926B