091c048a1c477aecabf560375edef53089cb3fb7c1434ab14a22acfe8382aca7

General

Target

091c048a1c477aecabf560375edef53089cb3fb7c1434ab14a22acfe8382aca7
Size

40KB
MD5

6afe031383ebc25934957c7a441a2e53
SHA1

6b7c227d5f378ef7ea8ca2d2af22cee457d421c2
SHA256

091c048a1c477aecabf560375edef53089cb3fb7c1434ab14a22acfe8382aca7
SHA512

de1766b2d2418665877c952afcc247d10b143212409eb46a371cb66c12c9da614f8b082c8584d2b1bcca9c48b423acbeb72b9666547a0756d6e2483badc25b9b
SSDEEP

768:+m5YmJ8RHjYIPhQiQbut4YLt9zNoeI++cre3XVgl8uFAIoqlK98XV2TLZ/8mm:9YmJ8PQiKIZoeI++cu+8XbqlKSF0Z1m

Score

N/A

Malware Config

Signatures

Files

091c048a1c477aecabf560375edef53089cb3fb7c1434ab14a22acfe8382aca7
.exe windows x86

5ec015532d9dfc1fdf80749531ae2ecd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
IoDeviceObjectType
ZwSetValueKey
_snwprintf
wcsncpy
wcslen
wcschr
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsrchr
KeQuerySystemTime
strncmp
strncpy
PsLookupProcessByProcessId
_stricmp
KeDelayExecutionThread
RtlCompareUnicodeString
ZwQueryValueKey
_except_handler3
IoRegisterDriverReinitialization
KeTickCount
KeQueryTimeIncrement
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsicmp
RtlAnsiStringToUnicodeString
wcsstr
_wcslwr
swprintf
_wcsnicmp
ZwDeleteKey
ZwCreateFile
IoGetCurrentProcess
IofCompleteRequest
PsGetVersion
ZwSetInformationFile
wcscpy
wcscat
PsSetCreateProcessNotifyRoutine
ZwCreateKey
RtlCopyUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
MmGetSystemRoutineAddress

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 58B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ec015532d9dfc1fdf80749531ae2ecd

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 6KB

PAGE Size: 64B - Virtual size: 58B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 6KB

PAGE
Size: 64B - Virtual size: 58B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB