be0c8e6708eeca4583b4ec3452ecba9df22d1c7d57ee17e9d3925813ef9f2598

Sharing

Copy URL Twitter E-mail

General

Target

be0c8e6708eeca4583b4ec3452ecba9df22d1c7d57ee17e9d3925813ef9f2598
Size

36KB
MD5

6b5558450ac5eb143c0fbfd90e28f420
SHA1

b1846d2a840c77dec8592ed787930365d0b703e5
SHA256

be0c8e6708eeca4583b4ec3452ecba9df22d1c7d57ee17e9d3925813ef9f2598
SHA512

1b26724494f752620335707b6a8b1895d762e874de93902f12f1b01cdde799942229982752facb03b522fb39d5d4e099c2f4c3a76f9f31f1fae851fed9844867
SSDEEP

768:sN2gkl4g+S8T3kgT64rY0BJVXhSKpIJj5/WHxN1StYu:sNFkygz8TJv8SIJ1/WRX

Score

N/A

Malware Config

Signatures

Files

be0c8e6708eeca4583b4ec3452ecba9df22d1c7d57ee17e9d3925813ef9f2598
.exe windows x86

16a3947e5fd288767bf0f5a06a761c9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeBugCheckEx
KeTickCount
MmMapLockedPagesSpecifyCache
IoFreeMdl
IoReleaseCancelSpinLock
IoDeleteDevice
IoCreateSymbolicLink
KeInitializeSpinLock
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
MmGetSystemRoutineAddress
wcslen
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
ExFreePoolWithTag
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
ExAllocatePoolWithTag
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisUnchainBufferAtFront
NdisFreePacket
NdisReturnPackets
NdisAllocatePacket
NdisReadConfiguration
NdisCloseConfiguration
NdisAllocateMemoryWithTag
NdisAllocatePacketPoolEx
NdisCancelSendPackets
NdisOpenProtocolConfiguration
NdisAllocateBuffer
NdisFreeMemory
NdisWaitEvent
NdisGeneratePartialCancelId
NdisRegisterProtocol
NdisInitializeEvent
NdisSetEvent
NdisFreeBufferPool
NdisFreePacketPool
NdisQueryPendingIOCount
NdisDeregisterProtocol
NdisRequest
NdisCloseAdapter
NdisQueryAdapterInstanceName
NdisOpenAdapter
NdisAllocateBufferPool

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16a3947e5fd288767bf0f5a06a761c9c

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 484B

PAGE Size: 5KB - Virtual size: 5KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 1024B - Virtual size: 920B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 484B

PAGE
Size: 5KB - Virtual size: 5KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 1024B - Virtual size: 920B