8953b3080921de6e20c92aa6529de9430a4fbaaf12968401f7da4f9374840287

General

Target

8953b3080921de6e20c92aa6529de9430a4fbaaf12968401f7da4f9374840287
Size

18KB
MD5

31b83ffc329291ef1c66a0e93e6d4430
SHA1

e1ced72b18d2b644a96d0363a74597c53915e835
SHA256

8953b3080921de6e20c92aa6529de9430a4fbaaf12968401f7da4f9374840287
SHA512

ce33f3ab88df66eff1f62d8b374f9483bf83b67de788d9fb1bc8f161211db3d3715623bedcd82151df7dc488c56d4ef770aa3faa57d3f19886157cb6b2a3a490
SSDEEP

192:CpF6+TtteNijL/N/wlSINaNJ2HBqJR2VLgLQzADtHA9l/ldlqvp6KuW/l5Y1Jp8D:0PkQSM2hqygFtg3/ldm3uGOTpv3a

Score

N/A

Malware Config

Signatures

Files

8953b3080921de6e20c92aa6529de9430a4fbaaf12968401f7da4f9374840287
.exe windows x86

f2f115e4618337f0a2f46af8c060463d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
wcscpy
wcsstr
_wcsupr
ObQueryNameString
ExAllocatePoolWithTag
KeServiceDescriptorTable
DbgPrint
IofCompleteRequest
ZwClose
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQueryValueKey
ZwOpenKey
RtlFreeUnicodeString
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
IoDeleteDevice
RtlInitAnsiString
strstr
_strlwr
ZwQuerySystemInformation
_except_handler3
wcscat
RtlStringFromGUID
ExUuidCreate
ObfDereferenceObject
KeWaitForSingleObject
KeSetEvent
PsTerminateSystemThread
_strnicmp
IoGetCurrentProcess
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeEvent
IoFreeMdl
MmUnlockPages
PsLookupProcessByProcessId
MmProbeAndLockPages
IoAllocateMdl
RtlAnsiStringToUnicodeString
ExFreePoolWithTag

hal

KeGetCurrentIrql

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.c
Size: 640B - Virtual size: 599B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 768B - Virtual size: 682B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2f115e4618337f0a2f46af8c060463d

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 7KB - Virtual size: 7KB

.c Size: 640B - Virtual size: 599B

.rdata Size: 512B - Virtual size: 460B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 768B - Virtual size: 682B

.text
Size: 7KB - Virtual size: 7KB

.c
Size: 640B - Virtual size: 599B

.rdata
Size: 512B - Virtual size: 460B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 768B - Virtual size: 682B