892289309219fe92108c2c6e0b1c4199368afba495b1b1c9fb02a073833cf111

General

Target

892289309219fe92108c2c6e0b1c4199368afba495b1b1c9fb02a073833cf111
Size

34KB
MD5

6df3a85bfef79daf00bdf0cc112dec50
SHA1

86dca0fd2e4f059031579157f99ce3f75b366072
SHA256

892289309219fe92108c2c6e0b1c4199368afba495b1b1c9fb02a073833cf111
SHA512

29831f096a826a406c5d63f4d932593d0bbae58c94236639b9fc6ee19966fa8a0fa261dd4289ebbb2c9fab4b91ff18cc741ee947bbb57e60562bdf73b6d63ccf
SSDEEP

768:HEHEE4rt9FEcC6XHUt3vkD59vpnA0m4cy34phJB/tLfC0H:HEH2rEKqvkTvcry34p9/tfC

Score

N/A

Malware Config

Signatures

Files

892289309219fe92108c2c6e0b1c4199368afba495b1b1c9fb02a073833cf111
.exe windows x86

3315229a895ede02ee99ce93dfbf797d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwSetValueKey
wcslen
_except_handler3
_snwprintf
ExAllocatePoolWithTag
swprintf
MmGetSystemRoutineAddress
ZwDeleteKey
wcscpy
KeQuerySystemTime
_wcsicmp
IofCompleteRequest
_wcsnicmp
ObReferenceObjectByHandle
RtlConvertSidToUnicodeString
ExFreePool
ZwQueryInformationToken
ObfDereferenceObject
ObOpenObjectByPointer
PsReferencePrimaryToken
MmIsAddressValid
ZwCreateFile
IoDeviceObjectType
RtlCopyUnicodeString
strncpy
IoGetCurrentProcess
ZwSetInformationFile
ZwEnumerateKey
ZwQueryKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_stricmp
wcsstr
_wcslwr
wcsncpy
wcschr
RtlCompareUnicodeString
KeDelayExecutionThread
wcsrchr
strncmp
ZwCreateKey
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
_snprintf
PsSetCreateProcessNotifyRoutine
ObQueryNameString
KeTickCount
KeQueryTimeIncrement
PsCreateSystemThread

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 58B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 640B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3315229a895ede02ee99ce93dfbf797d

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: 5KB - Virtual size: 5KB

PAGE Size: 64B - Virtual size: 58B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 640B - Virtual size: 616B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 24KB

.data
Size: 5KB - Virtual size: 5KB

PAGE
Size: 64B - Virtual size: 58B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 640B - Virtual size: 616B

.reloc
Size: 1KB - Virtual size: 1KB