f7eb5fda0ac5c0abb97bead81e0545617d0562915675a7f2f34b789c648f27a6

Sharing

Copy URL Twitter E-mail

General

Target

f7eb5fda0ac5c0abb97bead81e0545617d0562915675a7f2f34b789c648f27a6
Size

48KB
MD5

3b29466daa6279529225738f8dda4e69
SHA1

8cc9291b7e83e29ce1e3f3998f76347f513669d4
SHA256

f7eb5fda0ac5c0abb97bead81e0545617d0562915675a7f2f34b789c648f27a6
SHA512

453b6a77ec3decc50c21520256cd511f7251403ec02f9ac3dd06d4b26d4cc62e65bd0969a1fce261c0710e4b443391424c9ceb2327a8a0f39b21460a33fa43dc
SSDEEP

1536:G9FRF1yrgIE1FCb7DuCLP27fmZnFRmRW3HXaudrx3:IFhOzE1BCLu7AF4UHXVrx3

Score

N/A

Malware Config

Signatures

Files

f7eb5fda0ac5c0abb97bead81e0545617d0562915675a7f2f34b789c648f27a6
.exe windows x86

b84b0f7bf139a2bb994066d95004f1c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock

ntoskrnl.exe

ZwClose
RtlQueryRegistryValues
ZwCreateKey
RtlInitUnicodeString
IoOpenDeviceRegistryKey
ZwOpenKey
IoFreeIrp
RtlCompareMemory
IoStopTimer
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeQueryTimeIncrement
KeQuerySystemTime
_allmul
IofCallDriver
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IoFreeWorkItem
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
KeInitializeMutex
IoAllocateIrp
IoQueueWorkItem
IoAllocateWorkItem
IoStartTimer
IoInitializeTimer
KeSetEvent
IoGetDriverObjectExtension
_allshl
IoStartNextPacket
MmUnlockPages
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
KeInitializeSpinLock
IoInitializeIrp
KefReleaseSpinLockFromDpcLevel
KeBugCheckEx
KeWaitForSingleObject
KeGetCurrentThread
KeSetTimerEx
KeTickCount
IoGetDeviceProperty
IoStartPacket
IoSetHardErrorOrVerifyDevice
ObReferenceObjectByPointer
MmProbeAndLockPages
_alldvrm
IoDeleteDevice
IoDetachDevice
IoInvalidateDeviceRelations
IoWMIRegistrationControl
ZwSetValueKey
RtlInitString
_snprintf
KeInitializeDpc
KeInitializeTimer
KeBugCheck
ObfReferenceObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeDelayExecutionThread
_except_handler3
IofCompleteRequest
RtlDeleteRegistryValue
RtlCopyUnicodeString
IoAllocateDriverObjectExtension
IoCreateDevice
IoWMIWriteEvent
InterlockedPopEntrySList
PoStartNextPowerIrp
PoCallDriver
PoSetPowerState
InterlockedPushEntrySList
ExVerifySuite
IoReuseIrp
KeSetTimer
strncmp
RtlWriteRegistryValue
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
KeReleaseMutex
ExAllocatePoolWithTag
IoReportTargetDeviceChangeAsynchronous
KefAcquireSpinLockAtDpcLevel
ExFreePoolWithTag

Exports

Exports

ClassAcquireChildLock
ClassAcquireRemoveLockEx
ClassAsynchronousCompletion
ClassBuildRequest
ClassCheckMediaState
ClassClaimDevice
ClassCleanupMediaChangeDetection
ClassCompleteRequest
ClassCreateDeviceObject
ClassDebugPrint
ClassDeleteSrbLookasideList
ClassDeviceControl
ClassDisableMediaChangeDetection
ClassEnableMediaChangeDetection
ClassFindModePage
ClassForwardIrpSynchronous
ClassGetDescriptor
ClassGetDeviceParameter
ClassGetDriverExtension
ClassGetVpb
ClassInitialize
ClassInitializeEx
ClassInitializeMediaChangeDetection
ClassInitializeSrbLookasideList
ClassInitializeTestUnitPolling
ClassInternalIoControl
ClassInterpretSenseInfo
ClassInvalidateBusRelations
ClassIoComplete
ClassIoCompleteAssociated
ClassMarkChildMissing
ClassMarkChildrenMissing
ClassModeSense
ClassNotifyFailurePredicted
ClassQueryTimeOutRegistryValue
ClassReadDriveCapacity
ClassReleaseChildLock
ClassReleaseQueue
ClassReleaseRemoveLock
ClassRemoveDevice
ClassResetMediaChangeTimer
ClassScanForSpecial
ClassSendDeviceIoControlSynchronous
ClassSendIrpSynchronous
ClassSendSrbAsynchronous
ClassSendSrbSynchronous
ClassSendStartUnit
ClassSetDeviceParameter
ClassSetFailurePredictionPoll
ClassS�(�3diaChangeState
ClassSignalCompletion
ClassSpinDownPowerHandler
ClassSplitRequest
ClassStopUnitPowerHandler
ClassUpdateInformationInRegistry
ClassWmiCompleteRequest
ClassWmiFireEvent

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 768B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 128B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b84b0f7bf139a2bb994066d95004f1c7

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 768B - Virtual size: 692B

.data Size: 128B - Virtual size: 36B

PAGE Size: 14KB - Virtual size: 14KB

.edata Size: 2KB - Virtual size: 1KB

PAGE Size: 128B - Virtual size: 96B

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 768B - Virtual size: 692B

.data
Size: 128B - Virtual size: 36B

PAGE
Size: 14KB - Virtual size: 14KB

.edata
Size: 2KB - Virtual size: 1KB

PAGE
Size: 128B - Virtual size: 96B

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 1KB - Virtual size: 1KB