c0cf92663d50835a2cbcd0c8da710b364e9b563e61731036f4138abb4c55b136

General

Target

c0cf92663d50835a2cbcd0c8da710b364e9b563e61731036f4138abb4c55b136
Size

39KB
MD5

6a3a9a57849e780d0df9337db54a7782
SHA1

46bfa4819863a3d15ea34a2f26dd064b56245e2c
SHA256

c0cf92663d50835a2cbcd0c8da710b364e9b563e61731036f4138abb4c55b136
SHA512

45ba04cf917454bec14bf25afc46e2eecaf6e8837194305cfe9faf7541d2a37b8e5738652171379464e368adb050a2d3eb421ea064b151c6ebc93fe9da34c76a
SSDEEP

768:sot22ytt7qNfYOtuFS0K/pueabgTZNZF4FJf8zgzf9H4iBt2a4mKG6a0i0i5t6z5:ztg7qNfYBS0neawz4bf8cLJfF6ri5tFk

Score

N/A

Malware Config

Signatures

Files

c0cf92663d50835a2cbcd0c8da710b364e9b563e61731036f4138abb4c55b136
.exe windows x86

fc04ce3a0429eb8e9891d4e5cf6f9b55

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
IoDeviceObjectType
wcsncpy
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
RtlInitUnicodeString
strncpy
RtlCompareUnicodeString
MmGetSystemRoutineAddress
ZwClose
ZwSetValueKey
ZwCreateKey
PsSetCreateProcessNotifyRoutine
ZwCreateFile
swprintf
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenKey
wcsrchr
PsLookupProcessByProcessId
_stricmp
_wcsnicmp
wcslen
_except_handler3
_snwprintf
ExAllocatePoolWithTag
IofCompleteRequest
wcsstr
_wcslwr
wcscat
wcscpy
wcschr
KeQuerySystemTime
PsCreateSystemThread
RtlCopyUnicodeString
strncmp
IoRegisterDriverReinitialization
KeDelayExecutionThread
_wcsicmp
ExFreePool
_snprintf
KeTickCount
KeQueryTimeIncrement
ZwSetInformationFile
ZwDeleteKey
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 50B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc04ce3a0429eb8e9891d4e5cf6f9b55

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 6KB - Virtual size: 6KB

PAGE Size: 64B - Virtual size: 50B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 6KB - Virtual size: 6KB

PAGE
Size: 64B - Virtual size: 50B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB