f8eff355a77da2ce23b1a4455a21b0dcc4c038360922a1988d9072e7b8833fad

General

Target

f8eff355a77da2ce23b1a4455a21b0dcc4c038360922a1988d9072e7b8833fad
Size

15KB
MD5

59fb1f8d5bbedbfb8598720389349510
SHA1

f1bed7f9d4a31cbdb4a8d30fe637a5d825aa502f
SHA256

f8eff355a77da2ce23b1a4455a21b0dcc4c038360922a1988d9072e7b8833fad
SHA512

a68edd83bd4f185ffe711eb1ca4383466f5e75ea57f7da0cdb998c074ae8f9c12a0cad68a4957dd6fd7cc4f219c959bb3eb1cf24604a938b9c0f5a9395629639
SSDEEP

384:j7ftxGUswdNRVOUt6F+y5P3r9mMHPK/XWAQW6:PtFsqby+y/m8PK/z

Score

N/A

Malware Config

Signatures

Files

f8eff355a77da2ce23b1a4455a21b0dcc4c038360922a1988d9072e7b8833fad
.exe windows x86

80593df224fe5516b8e3ab5e61af2b50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
towlower
wcscat
wcscpy
wcsrchr
PsTerminateSystemThread
KeDelayExecutionThread
RtlWriteRegistryValue
RtlCreateRegistryKey
RtlQueryRegistryValues
ExFreePoolWithTag
ZwOpenKey
ZwEnumerateKey
ObfDereferenceObject
ZwWaitForSingleObject
ObOpenObjectByPointer
PsProcessType
_wcsnicmp
wcslen
ExAllocatePoolWithTag
RtlGetVersion
_strnicmp
IoGetCurrentProcess
ZwCreateFile
ZwReadFile
ZwQueryInformationFile
ZwWriteFile
ZwDeleteFile
DbgPrint
KeServiceDescriptorTable
_stricmp
RtlUnicodeStringToAnsiString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 828B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 640B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80593df224fe5516b8e3ab5e61af2b50

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 256B - Virtual size: 140B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 896B - Virtual size: 828B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 620B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 256B - Virtual size: 140B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 896B - Virtual size: 828B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 620B