a2cc307dee74062769b781455512aa9e5b37a6e72ce5b32e1e0a4515afe4bf57

General

Target

a2cc307dee74062769b781455512aa9e5b37a6e72ce5b32e1e0a4515afe4bf57
Size

38KB
MD5

67dfaedaafb142af0931dcde699ea2a0
SHA1

9a6f07f826968aa99f87576e0407021d18f35949
SHA256

a2cc307dee74062769b781455512aa9e5b37a6e72ce5b32e1e0a4515afe4bf57
SHA512

ab5f6c2b4cbf449c19854f3c1563f4ea008ee6b0705c231f4601293fb6d27983e29f29b7f614c3f52bf03415993c2aefd36d349ab7c82918feee1d3251797250
SSDEEP

768:Xxct1hfzoNt24g1ZSFt/JIz5FNj1klKfOuGasUqJ:Xxf45mVQqJ

Score

N/A

Malware Config

Signatures

Files

a2cc307dee74062769b781455512aa9e5b37a6e72ce5b32e1e0a4515afe4bf57
.exe windows x86

cf96e5641762c59a16ee202d27968fa4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ObfDereferenceObject
DbgPrint
ObReferenceObjectByHandle
ObOpenObjectByName
RtlInitUnicodeString
ExRaiseStatus
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCopyUnicodeString
ZwQueryInformationProcess
wcslen
RtlCompareUnicodeString
KeReleaseMutex
KeWaitForSingleObject
IoDeleteDevice
RtlImageDirectoryEntryToData
KeDetachProcess
wcscat
KeAttachProcess
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ZwOpenProcess
wcscpy
ZwQueryInformationThread
ZwQuerySystemInformation
ZwClose
memmove
wcscmp
wcsncpy
_local_unwind2
KeServiceDescriptorTable
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
IofCompleteRequest
SeImpersonateClientEx
RtlImageNtHeader
KeInitializeMutex
IoCreateSymbolicLink
IoCreateDevice
swprintf
SeCreateClientSecurity
KeGetCurrentThread
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwUnmapViewOfSection
KeTickCount
KeBugCheckEx
_except_handler3
wcsncmp

hal

KfLowerIrql
KfRaiseIrql

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf96e5641762c59a16ee202d27968fa4

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 560B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 560B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB