2c2f42da24c4e5a1fb89a557ce58632fdf12c2493cc13bb4f161246781ce5cc6

General

Target

2c2f42da24c4e5a1fb89a557ce58632fdf12c2493cc13bb4f161246781ce5cc6
Size

99KB
MD5

66c1a3087ec89090b196757f4a7a6e72
SHA1

aab390fb2b63173f92416ea703ffecebaf44bd20
SHA256

2c2f42da24c4e5a1fb89a557ce58632fdf12c2493cc13bb4f161246781ce5cc6
SHA512

bc246647d1a0a43cf50337296ad995b73877f0a3911a682376adcd4bc0a78124b8a4485537ea0e3b5888d40f81611768b18ac0c16f5308baee646b2710f96b05
SSDEEP

1536:rrbYaqcoGCtVNJMCDGULYa9fTFKeophs/CD3vMZEMP6q5U8w0:rbShMCTUeophKEyf5T

Score

N/A

Malware Config

Signatures

Files

2c2f42da24c4e5a1fb89a557ce58632fdf12c2493cc13bb4f161246781ce5cc6
.exe windows x86

8de2fe96ab5d92251053f935ff6ff1f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_strnset
memcpy
ExAllocatePool
strstr
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
wcsstr
_wcsnset
ZwReadFile
ExFreePoolWithTag
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
ZwSetValueKey
ZwCreateKey
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
atoi
IoDriverObjectType
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
IoBuildAsynchronousFsdRequest
memset
ZwPulseEvent
ZwAllocateVirtualMemory
ObOpenObjectByPointer
ProbeForRead
IoGetCurrentProcess
_strupr
PsGetProcessImageFileName
PsLookupProcessByProcessId
_wcsupr
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsGetVersion
DbgPrint
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
RtlUnwind
ObReferenceObjectByName
strchr

hal

KeGetCurrentIrql

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8de2fe96ab5d92251053f935ff6ff1f9

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 81KB - Virtual size: 85KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 744B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 81KB - Virtual size: 85KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 744B

.reloc
Size: 1KB - Virtual size: 1KB