d849bf08ed57b6f24968319bb08182673fa72aef53453634f0a7693520288c62

Sharing

Copy URL Twitter E-mail

General

Target

d849bf08ed57b6f24968319bb08182673fa72aef53453634f0a7693520288c62
Size

130KB
MD5

31e34a8761749b84b518c32e26918f00
SHA1

81e8e51dc167022f86566974b38fc6db452fbd85
SHA256

d849bf08ed57b6f24968319bb08182673fa72aef53453634f0a7693520288c62
SHA512

c90798ed4c35d7dd93bc7b08f1ad42ac58fec00111f3b7dcbeab044cce4bb82baa04d6648a359385495026ec7687d8f973842b6c68c279fc4add033851e89a8a
SSDEEP

3072:ZSd359LMHogkg/vcqW6lUx/fXlQdGqjg+f9pOrgcOLI:ILyoB8WnkGqjg+f9O

Score

N/A

Malware Config

Signatures

Files

d849bf08ed57b6f24968319bb08182673fa72aef53453634f0a7693520288c62
.exe windows x86

78d1c146fcb33f0b02c4c6a578f70636

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeSpinLock
RtlFreeAnsiString
RtlFreeUnicodeString
IoDeleteDevice
sprintf
KeSetEvent
PsCreateSystemThread
RtlUnicodeStringToAnsiString
ZwClose
IoCreateDevice
KeQuerySystemTime
strncpy
strncmp
strstr
MmIsAddressValid
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
IoAllocateMdl
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
wcsncpy
RtlInitAnsiString
wcsncat
IoFreeMdl
IoDriverObjectType
MmProbeAndLockPages
MmUnlockPages
ObReferenceObjectByName
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
ExAllocatePool
ExFreePool
isupper
ZwQuerySystemInformation
KeWaitForSingleObject
tolower
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
isdigit
ZwQueryDirectoryObject
_wcsicmp
RtlCompareUnicodeString
MmMapLockedPages
ZwOpenDirectoryObject
ZwQueryValueKey
KeServiceDescriptorTable
ZwLoadDriver
ZwEnumerateKey
ZwOpenKey
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwEnumerateValueKey
strchr
RtlInitUnicodeString
RtlTimeToTimeFields
KeInitializeEvent
PsTerminateSystemThread
KeTickCount
ZwFlushKey
ZwDeleteKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
toupper
isspace
ObReferenceObjectByHandle
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
IofCompleteRequest
memcpy
memset
_except_handler3
_allrem

hal

KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql

Sections

4ZE@oyY6
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

g_6FebTL
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nxOL/Dri
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

WrWept K
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

;N2T.JNf
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0roCh7&7
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

N5>aQtD^
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SZ(b5#-r
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78d1c146fcb33f0b02c4c6a578f70636

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

4ZE@oyY6 Size: - Virtual size: 129KB

g_6FebTL Size: - Virtual size: 17KB

nxOL/Dri Size: - Virtual size: 24KB

WrWept K Size: - Virtual size: 1KB

;N2T.JNf Size: - Virtual size: 8KB

0roCh7&7 Size: - Virtual size: 17KB

N5>aQtD^ Size: 128KB - Virtual size: 128KB

SZ(b5#-r Size: 512B - Virtual size: 116B

4ZE@oyY6
Size: - Virtual size: 129KB

g_6FebTL
Size: - Virtual size: 17KB

nxOL/Dri
Size: - Virtual size: 24KB

WrWept K
Size: - Virtual size: 1KB

;N2T.JNf
Size: - Virtual size: 8KB

0roCh7&7
Size: - Virtual size: 17KB

N5>aQtD^
Size: 128KB - Virtual size: 128KB

SZ(b5#-r
Size: 512B - Virtual size: 116B