895150b9cfc79a91d7fe478694213ff08043fe460173f912df1ff622f59ca370

Sharing

Copy URL Twitter E-mail

General

Target

895150b9cfc79a91d7fe478694213ff08043fe460173f912df1ff622f59ca370
Size

23KB
MD5

6f0efa6a3d80da75e3acfc8d07ea48f0
SHA1

c6d6ab15a0e78a6c2c91dd14915098be5c132009
SHA256

895150b9cfc79a91d7fe478694213ff08043fe460173f912df1ff622f59ca370
SHA512

3b529b432b3d6a28a67ef52bc552892ca620f95d448a5b06e4fa0bb07561805c0a718edaa7265136d9b8f6e907bdee5440b4686823dde2495422b91633445252
SSDEEP

384:c+PGGGGGGo9mZrZJJxPlFG7vrMnDNResW29+YbS0XSWE:c+PGGGGGGo9CrZJJZlFG74pRbW29nbSQ

Score

N/A

Malware Config

Signatures

Files

895150b9cfc79a91d7fe478694213ff08043fe460173f912df1ff622f59ca370
.exe windows x86

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
_stricmp
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
ZwQuerySystemInformation
IoGetRelatedDeviceObject
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 608B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 736B - Virtual size: 716B

.data Size: 608B - Virtual size: 608B

sosata2 Size: 32B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 928B - Virtual size: 912B

.reloc Size: 928B - Virtual size: 926B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 736B - Virtual size: 716B

.data
Size: 608B - Virtual size: 608B

sosata2
Size: 32B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 928B - Virtual size: 926B