e3d15f976d51df5564371c58dcd1fd9b7b270295df34553d2c4b2a6ad659f0b0

General

Target

e3d15f976d51df5564371c58dcd1fd9b7b270295df34553d2c4b2a6ad659f0b0
Size

32KB
MD5

7253c8a32b7b674e704732a1ac31db37
SHA1

704c9f8a516af4505744df40e52ae792081e9124
SHA256

e3d15f976d51df5564371c58dcd1fd9b7b270295df34553d2c4b2a6ad659f0b0
SHA512

7e1816121fff0ddeb65d6a424bb1cb4e686b23680458d711677fb92be10c913bd34c952645c73a091909317f0614c130de90f3306fe77c7a88630d6f7f6a1aa3
SSDEEP

768:PL0CQgDcsdBTRBkd9OLb3KvWk/yQlJxcHjO5Lyfeczo:DUMBkPOLbxyyQ/xmjfzo

Score

N/A

Malware Config

Signatures

Files

e3d15f976d51df5564371c58dcd1fd9b7b270295df34553d2c4b2a6ad659f0b0
.exe windows x86

19a7283fd76e852cd92339a0f90ba264

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmGetSystemRoutineAddress
RtlInitUnicodeString
towlower
wcscat
wcscpy
wcsrchr
IoDeleteDevice
IoAttachDeviceToDeviceStackSafe
IoCreateDevice
ObfDereferenceObject
IoGetRelatedDeviceObject
ZwClose
ObReferenceObjectByHandle
ZwCreateFile
swprintf
IofCallDriver
IofCompleteRequest
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
ExAllocatePoolWithTag
IoDetachDevice
ExFreePoolWithTag
RtlCopyUnicodeString
IoGetCurrentProcess
RtlCompareUnicodeString
memmove
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
ZwWaitForSingleObject
ObOpenObjectByPointer
PsProcessType
KeDelayExecutionThread
_wcsnicmp
wcslen
RtlGetVersion
_strnicmp
ZwReadFile
ZwQueryInformationFile
ZwWriteFile
ZwDeleteFile
_stricmp
RtlUnicodeStringToAnsiString

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 640B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19a7283fd76e852cd92339a0f90ba264

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 256B - Virtual size: 180B

.data Size: 16KB - Virtual size: 16KB

PAGE Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 606B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 256B - Virtual size: 180B

.data
Size: 16KB - Virtual size: 16KB

PAGE
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 606B