ad76410ace0f556b63b993c09a7467e938e70682467e92418d624a5afafccdb8

General

Target

ad76410ace0f556b63b993c09a7467e938e70682467e92418d624a5afafccdb8
Size

15KB
MD5

617d272a09f75f22dfba38612719a937
SHA1

679f1e814acbc65d9df54ca998230a6b0bed140a
SHA256

ad76410ace0f556b63b993c09a7467e938e70682467e92418d624a5afafccdb8
SHA512

c7cfbe13c7bfe75706c6587bc2ce748928f6ebaa7db23dccbb9b818079b91ff6da162e01b7d1a7598598af6b280f89ea1300c7dd81d5b20fdf8b4251c99a4520
SSDEEP

384:AFXFw5NdfKU37VRzw3Z4U+cr6+g9PflDnjPQ3:Qwj4a7VRzAZ4UCb1nY

Score

N/A

Malware Config

Signatures

Files

ad76410ace0f556b63b993c09a7467e938e70682467e92418d624a5afafccdb8
.exe windows x86

e6336f9fde937aae8dcbfb1e25f9c6cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memmove
ObfDereferenceObject
ExFreeToPagedLookasideList
RtlFreeAnsiString
strncmp
strncat
RtlUnicodeStringToAnsiString
ObQueryNameString
ExFreePool
ExAllocateFromPagedLookasideList
ExAllocatePoolWithTag
_except_handler3
IoGetCurrentProcess
strncpy
wcscpy
wcsstr
_strupr
wcslen
_strnicmp
PsGetCurrentProcessId
ObReferenceObjectByHandle
ZwEnumerateKey
InterlockedExchange
KeServiceDescriptorTable
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
ExDeletePagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoRegisterShutdownNotification
ExInitializePagedLookasideList
IoCreateSymbolicLink
IoCreateDevice
MmUnmapLockedPages
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 672B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6336f9fde937aae8dcbfb1e25f9c6cb

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 384B - Virtual size: 364B

.data Size: 672B - Virtual size: 668B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 576B - Virtual size: 556B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 384B - Virtual size: 364B

.data
Size: 672B - Virtual size: 668B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 576B - Virtual size: 556B