06754d4aecd63a437c593f6f31ecb3c7cfd4a1cbe5974e1c281fe08841e7f21b

General

Target

06754d4aecd63a437c593f6f31ecb3c7cfd4a1cbe5974e1c281fe08841e7f21b
Size

393KB
MD5

5179092bb601c37690b0a274ff9217c1
SHA1

52cb46ef5743241699e7466b6dafe8a5babdcce4
SHA256

06754d4aecd63a437c593f6f31ecb3c7cfd4a1cbe5974e1c281fe08841e7f21b
SHA512

7f4c1181a13a5e4b98299a0fea6637dcca573aa07ff1116226f5c5834004fa430c908cd798dea6805cc81955265e5f8464fddf0d466c3944bfc8bd06ef5f15ff
SSDEEP

6144:vg0ZpBBO0B6ChZsKVou0O+ahBW+XqgEwmDnwEswhJATBw:lBOq6uZsKVdWfDnCwhJATa

Score

N/A

Malware Config

Signatures

Files

06754d4aecd63a437c593f6f31ecb3c7cfd4a1cbe5974e1c281fe08841e7f21b
.exe windows x86

7933588655fc220320e82e2b9225dcdd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
_allmul
_alldiv
ExRaiseStatus
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ZwQueryInformationProcess
RtlCompareUnicodeString
KeReleaseMutex
KeWaitForSingleObject
ZwEnumerateKey
ZwDeleteKey
ZwOpenKey
wcsncat
memset
IoDeleteDevice
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeMutex
memcpy
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ZwOpenProcess
ZwQueryValueKey
ZwSetValueKey
ZwLoadDriver
ZwCreateKey
ZwReadFile
ZwCreateFile
ZwSetInformationFile
ZwWriteFile
ZwQueryInformationFile
ZwQueryVolumeInformationFile
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
swprintf
SeCreateClientSecurity
KeGetCurrentThread
KeQuerySystemTime
sprintf
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
KeTickCount
KeBugCheckEx
ObfDereferenceObject
ZwClose
RtlUnwind

hal

KeGetCurrentIrql

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 337KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7933588655fc220320e82e2b9225dcdd

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 337KB - Virtual size: 337KB

.data Size: 3KB - Virtual size: 3KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 896B - Virtual size: 776B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 337KB - Virtual size: 337KB

.data
Size: 3KB - Virtual size: 3KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 896B - Virtual size: 776B

.reloc
Size: 3KB - Virtual size: 3KB