b5bbe64f83cbad5aa1db608079a2a16c9f3ce06c55b8b006ff989910440012be

General

Target

b5bbe64f83cbad5aa1db608079a2a16c9f3ce06c55b8b006ff989910440012be
Size

181KB
MD5

5dec98fb5d68525fa55ecee9a421b359
SHA1

fb74ce9eb76c876a88af8553107c0ae12a26a937
SHA256

b5bbe64f83cbad5aa1db608079a2a16c9f3ce06c55b8b006ff989910440012be
SHA512

00896d2c7b6f94791d256ee498ccbacca2f955092888bba946e8698ffc50a5025982291d98c2cf4f63399fba927d886e9c86afc6a144ad17098a8e6166e46a62
SSDEEP

3072:nH3tF/FoU3IvQ3FCnU9oOQqb9IcFsN+msn8REcitf0+R3TKEUx41eR:nXtF/JIvLwQq18REztfDRDEM

Score

N/A

Malware Config

Signatures

Files

b5bbe64f83cbad5aa1db608079a2a16c9f3ce06c55b8b006ff989910440012be
.exe windows x86

63dcbb8d3702dc918067c3dcaf9e7804

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KeAcquireQueuedSpinLock

ntoskrnl.exe

RtlInitUnicodeString
ExInitializeZone
ZwCreateKey
ZwQueryValueKey
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
ExAllocatePoolWithTag
ExInterlockedDecrementLong
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IoDeleteDevice
ExDeleteNPagedLookasideList
IoQueueWorkItem
ZwNotifyChangeKey
MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63dcbb8d3702dc918067c3dcaf9e7804

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 16KB

.INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 228B

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 16KB

.INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 228B