d7739f36f98e3c088b6e0acf3b733997f8acd5e3a1d20672f3c3c98f09a4071d

General

Target

d7739f36f98e3c088b6e0acf3b733997f8acd5e3a1d20672f3c3c98f09a4071d
Size

14KB
MD5

58e8238f6d8e5d5efd4988ae23f21704
SHA1

63fc1b61b28a1b323ea9cdca2a6d4f2f744cb71b
SHA256

d7739f36f98e3c088b6e0acf3b733997f8acd5e3a1d20672f3c3c98f09a4071d
SHA512

ec557a459fccc9c4b905455daf29dffaba0f9b292bed74b00b6ea355b84719c58a82af83bce19164c5fefbf9c6fc5cc20e14982fd7719ed65ed648099b7d1fa6
SSDEEP

192:o+9sp1xHQ+C1kEusfV2+KO2XX8owLTBUbe/FG:o+3YEPfV2+KX8owLTBUU

Score

N/A

Malware Config

Signatures

Files

d7739f36f98e3c088b6e0acf3b733997f8acd5e3a1d20672f3c3c98f09a4071d
.exe windows x86

64a335fd1fd6e2822eaa0794ec1ee8bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
_stricmp
_strupr
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
ZwQuerySystemInformation
ZwPulseEvent
MmGetSystemRoutineAddress
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64a335fd1fd6e2822eaa0794ec1ee8bc

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 288B - Virtual size: 280B

.data Size: 8KB - Virtual size: 8KB

INIT Size: 960B - Virtual size: 946B

.reloc Size: 384B - Virtual size: 360B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 288B - Virtual size: 280B

.data
Size: 8KB - Virtual size: 8KB

INIT
Size: 960B - Virtual size: 946B

.reloc
Size: 384B - Virtual size: 360B