d8a69f9f284cf4a3d1030df06629215c3fd4a158e6d134ea3b46ab2686f8a235

Sharing

Copy URL

Twitter E-mail

General

Target

d8a69f9f284cf4a3d1030df06629215c3fd4a158e6d134ea3b46ab2686f8a235
Size

35KB
MD5

6505111f23c29bcb1d2218f021d70f70
SHA1

6c43a972cd0d740558e9fea4bbae3e4645b2aa31
SHA256

d8a69f9f284cf4a3d1030df06629215c3fd4a158e6d134ea3b46ab2686f8a235
SHA512

8f0f574ed21549bc4eb6da0dd3e138b37bdddb8806a4f351589fd5b381c9ee9b3a029b8f27032b340169c30931da6fc0383f92f40cf61988741dddaf8978288c
SSDEEP

384:eoSVg+SGOcg3rprg/iSix0gUAEan7aXCocTeDG5AXE/xWIOLq9sl7Fz7p+8oZVH3:fSV/p+9ZVAM+v6urg

Score

N/A

Malware Config

Signatures

Files

d8a69f9f284cf4a3d1030df06629215c3fd4a158e6d134ea3b46ab2686f8a235
.exe windows x86

dbf4174115d9038aba230c1886f94a0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IofCompleteRequest
IoFileObjectType
strncmp
IoGetCurrentProcess
_strlwr
ZwQuerySystemInformation
_strupr
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
MmUserProbeAddress
_stricmp
ObReferenceObjectByHandle
_except_handler3

hal

KeGetCurrentIrql
KeQueryPerformanceCounter

Sections

YYusT
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1gata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1fata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1eata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1data
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1cata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1bata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t1aata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t19ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t18ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t17ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t16ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t15ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t14ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t13ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t12ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

t11ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tzata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tyata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

txata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

twata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tvata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tuata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ttata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tsata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

trata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tqata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tpata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.toata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tnata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tmata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tlata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tkata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tjata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tiata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.thata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tgata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tfata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.teata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tdata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tcata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tbata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.taata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t9ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t8ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t7ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t6ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t5ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t4ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t2ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 862B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 704B - Virtual size: 698B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbf4174115d9038aba230c1886f94a0a

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

YYusT Size: 15KB - Virtual size: 15KB

t1gata Size: 256B - Virtual size: 256B

t1fata Size: 256B - Virtual size: 256B

t1eata Size: 256B - Virtual size: 256B

t1data Size: 256B - Virtual size: 256B

t1cata Size: 256B - Virtual size: 256B

t1bata Size: 256B - Virtual size: 256B

t1aata Size: 256B - Virtual size: 256B

t19ata Size: 256B - Virtual size: 256B

t18ata Size: 256B - Virtual size: 256B

t17ata Size: 256B - Virtual size: 256B

t16ata Size: 256B - Virtual size: 256B

t15ata Size: 256B - Virtual size: 256B

t14ata Size: 256B - Virtual size: 256B

t13ata Size: 256B - Virtual size: 256B

t12ata Size: 256B - Virtual size: 256B

t11ata Size: 256B - Virtual size: 256B

tzata Size: 256B - Virtual size: 256B

tyata Size: 256B - Virtual size: 256B

txata Size: 256B - Virtual size: 256B

twata Size: 256B - Virtual size: 256B

tvata Size: 256B - Virtual size: 256B

tuata Size: 256B - Virtual size: 256B

ttata Size: 256B - Virtual size: 256B

tsata Size: 256B - Virtual size: 256B

trata Size: 256B - Virtual size: 256B

tqata Size: 256B - Virtual size: 256B

tpata Size: 256B - Virtual size: 256B

.toata Size: 256B - Virtual size: 256B

.tnata Size: 256B - Virtual size: 256B

.tmata Size: 256B - Virtual size: 256B

.tlata Size: 256B - Virtual size: 256B

.tkata Size: 256B - Virtual size: 256B

.tjata Size: 256B - Virtual size: 256B

.tiata Size: 256B - Virtual size: 256B

.thata Size: 256B - Virtual size: 256B

.tgata Size: 256B - Virtual size: 256B

.tfata Size: 256B - Virtual size: 256B

.teata Size: 256B - Virtual size: 256B

.tdata Size: 256B - Virtual size: 256B

.tcata Size: 256B - Virtual size: 256B

.tbata Size: 256B - Virtual size: 256B

.taata Size: 256B - Virtual size: 256B

.t9ata Size: 256B - Virtual size: 256B

.t8ata Size: 256B - Virtual size: 256B

.t7ata Size: 256B - Virtual size: 256B

.t6ata Size: 256B - Virtual size: 256B

.t5ata Size: 256B - Virtual size: 256B

.t4ata Size: 256B - Virtual size: 256B

.t3ata Size: 256B - Virtual size: 256B

.t2ata Size: 256B - Virtual size: 256B

.t1ata Size: 512B - Virtual size: 512B

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 864B - Virtual size: 862B

.reloc Size: 704B - Virtual size: 698B

YYusT
Size: 15KB - Virtual size: 15KB

t1gata
Size: 256B - Virtual size: 256B

t1fata
Size: 256B - Virtual size: 256B

t1eata
Size: 256B - Virtual size: 256B

t1data
Size: 256B - Virtual size: 256B

t1cata
Size: 256B - Virtual size: 256B

t1bata
Size: 256B - Virtual size: 256B

t1aata
Size: 256B - Virtual size: 256B

t19ata
Size: 256B - Virtual size: 256B

t18ata
Size: 256B - Virtual size: 256B

t17ata
Size: 256B - Virtual size: 256B

t16ata
Size: 256B - Virtual size: 256B

t15ata
Size: 256B - Virtual size: 256B

t14ata
Size: 256B - Virtual size: 256B

t13ata
Size: 256B - Virtual size: 256B

t12ata
Size: 256B - Virtual size: 256B

t11ata
Size: 256B - Virtual size: 256B

tzata
Size: 256B - Virtual size: 256B

tyata
Size: 256B - Virtual size: 256B

txata
Size: 256B - Virtual size: 256B

twata
Size: 256B - Virtual size: 256B

tvata
Size: 256B - Virtual size: 256B

tuata
Size: 256B - Virtual size: 256B

ttata
Size: 256B - Virtual size: 256B

tsata
Size: 256B - Virtual size: 256B

trata
Size: 256B - Virtual size: 256B

tqata
Size: 256B - Virtual size: 256B

tpata
Size: 256B - Virtual size: 256B

.toata
Size: 256B - Virtual size: 256B

.tnata
Size: 256B - Virtual size: 256B

.tmata
Size: 256B - Virtual size: 256B

.tlata
Size: 256B - Virtual size: 256B

.tkata
Size: 256B - Virtual size: 256B

.tjata
Size: 256B - Virtual size: 256B

.tiata
Size: 256B - Virtual size: 256B

.thata
Size: 256B - Virtual size: 256B

.tgata
Size: 256B - Virtual size: 256B

.tfata
Size: 256B - Virtual size: 256B

.teata
Size: 256B - Virtual size: 256B

.tdata
Size: 256B - Virtual size: 256B

.tcata
Size: 256B - Virtual size: 256B

.tbata
Size: 256B - Virtual size: 256B

.taata
Size: 256B - Virtual size: 256B

.t9ata
Size: 256B - Virtual size: 256B

.t8ata
Size: 256B - Virtual size: 256B

.t7ata
Size: 256B - Virtual size: 256B

.t6ata
Size: 256B - Virtual size: 256B

.t5ata
Size: 256B - Virtual size: 256B

.t4ata
Size: 256B - Virtual size: 256B

.t3ata
Size: 256B - Virtual size: 256B

.t2ata
Size: 256B - Virtual size: 256B

.t1ata
Size: 512B - Virtual size: 512B

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 864B - Virtual size: 862B

.reloc
Size: 704B - Virtual size: 698B