7132d9794934b8bf89a4dcd7246ca2ac7056fbd5b0c6541188bc700d8a595a11

Sharing

Copy URL Twitter E-mail

General

Target

7132d9794934b8bf89a4dcd7246ca2ac7056fbd5b0c6541188bc700d8a595a11
Size

40KB
MD5

07e0e488502181261cf23a5107534752
SHA1

09423cb2cfa6b88bea1bf073195388a56d038c82
SHA256

7132d9794934b8bf89a4dcd7246ca2ac7056fbd5b0c6541188bc700d8a595a11
SHA512

afbe04cf3af40b39caf27ae1886fbd40aa12640e60463ca2db079e930c21f125bb1c4fee4122362602f4345f97e43fcc443ec9b98676a6b4214baa9662975d15
SSDEEP

768:P61TBjS6w1Axkq/HPRsDLkMBLP/9/ExGtRNiKqzKzpyjuE9iuuiJMv6:RlAxk4vR0BPl/Pn5qzYpy6E9yiJMi

Score

N/A

Malware Config

Signatures

Files

7132d9794934b8bf89a4dcd7246ca2ac7056fbd5b0c6541188bc700d8a595a11
.exe windows x86

f117a07878ae62b4d080f8eec86fb405

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwOpenKey
RtlInitUnicodeString
ZwCreateFile
swprintf
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
KeQuerySystemTime
_stricmp
wcsstr
_wcslwr
ZwSetValueKey
wcslen
RtlCompareUnicodeString
RtlCopyUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwDeleteKey
wcscat
wcscpy
_wcsicmp
_except_handler3
wcsrchr
MmGetSystemRoutineAddress
IoDeviceObjectType
ObReferenceObjectByHandle
ObfDereferenceObject
strncmp
ZwCreateKey
RtlAnsiStringToUnicodeString
IofCompleteRequest
_wcsnicmp
ZwSetInformationFile
_snwprintf
strncpy
PsLookupProcessByProcessId
wcschr
KeDelayExecutionThread
PsCreateSystemThread
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEWMI
Size: 32B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDRV
Size: 32B - Virtual size: 3B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 96B - Virtual size: 73B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f117a07878ae62b4d080f8eec86fb405

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 7KB

PAGEWMI Size: 32B - Virtual size: 10B

PAGEDRV Size: 32B - Virtual size: 3B

PAGE Size: 96B - Virtual size: 73B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 7KB

PAGEWMI
Size: 32B - Virtual size: 10B

PAGEDRV
Size: 32B - Virtual size: 3B

PAGE
Size: 96B - Virtual size: 73B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB