3a101d63006aadf3b9de38ceaa1da34124fdd0ea74009acac692329c50d1c551

Sharing

Copy URL Twitter E-mail

General

Target

3a101d63006aadf3b9de38ceaa1da34124fdd0ea74009acac692329c50d1c551
Size

295KB
MD5

072d440af10cf629f3ded47cbc2b41f0
SHA1

f88ebd2eb9468098850f5f47d7b5bd9cffd794dd
SHA256

3a101d63006aadf3b9de38ceaa1da34124fdd0ea74009acac692329c50d1c551
SHA512

aaf936fc050817bda44350d6e15f300e46ee7436e9fd974dc754247951b66771a008f6be5c657652644befdf0237e2fde6d01688441561e3b3b28e0b79d65691
SSDEEP

6144:0Hdq+RiDTE0pAmvJJ6oyKhGOjnO/0I53akDKTs:0HdF8DrpAmxJj4Ojnq5Lcs

Score

N/A

Malware Config

Signatures

Files

3a101d63006aadf3b9de38ceaa1da34124fdd0ea74009acac692329c50d1c551
.dll windows x86

0cc716be1e1f12354494aa6cfd0258d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kload

getConfig
HookCallPoint
unhookFunction
getPesInfo
RegisterKModule
_LogX
hookFunction

kernel32

WideCharToMultiByte
CreateFileA
SetEndOfFile
VirtualProtect
HeapAlloc
GetProcessHeap
HeapFree
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
ReadFile
InitializeCriticalSectionAndSpinCount
CreateFileW
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Exports

Exports

lodAtModeCheck

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0cc716be1e1f12354494aa6cfd0258d3

Headers

File Characteristics

Imports

kload

kernel32

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 22KB - Virtual size: 29KB

.rsrc Size: 1024B - Virtual size: 760B

.reloc Size: 8KB - Virtual size: 7KB

.rmnet Size: 113KB - Virtual size: 116KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 22KB - Virtual size: 29KB

.rsrc
Size: 1024B - Virtual size: 760B

.reloc
Size: 8KB - Virtual size: 7KB

.rmnet
Size: 113KB - Virtual size: 116KB