13ab0b8b0e4686152611011ffaa631e4683bd14e2cad527cc8cbfdc849aba5d0

General

Target

13ab0b8b0e4686152611011ffaa631e4683bd14e2cad527cc8cbfdc849aba5d0
Size

37KB
MD5

5b6f9d096b4bc21c2abebb5ca5c5d730
SHA1

4fcbbcf4de48be5d92b68cded082a6028fc15786
SHA256

13ab0b8b0e4686152611011ffaa631e4683bd14e2cad527cc8cbfdc849aba5d0
SHA512

62a47f856f6c9f8ad1284ecaddf3f1dfaffd28ccae02b12fc7be09c3e6954f1eda3d853086710e528bdd8507edcb451c69ad519291da5af8b37646b0e7bf84ac
SSDEEP

768:J4CcGKcH3NffPLyYEBX8qPM17jrbvnmMdJ+DnBI22m6ndr:J1PH35PLIX8qPUr7nmMdMDJinp

Score

N/A

Malware Config

Signatures

Files

13ab0b8b0e4686152611011ffaa631e4683bd14e2cad527cc8cbfdc849aba5d0
.exe windows x86

f6e9ea872ff0e7bcae62345b21e084bd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlCopyUnicodeString
strncmp
ZwClose
ZwOpenKey
RtlInitUnicodeString
ZwQueryValueKey
MmIsAddressValid
ZwSetValueKey
wcslen
_except_handler3
MmGetSystemRoutineAddress
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_wcsicmp
wcsncpy
wcsrchr
strncpy
IoGetCurrentProcess
PsCreateSystemThread
RtlCompareUnicodeString
_snwprintf
wcschr
ZwDeleteKey
ExAllocatePoolWithTag
KeQuerySystemTime
_wcsnicmp
ExFreePool
_snprintf
IofCompleteRequest
swprintf
ZwCreateKey
ObfDereferenceObject
ObReferenceObjectByHandle
wcscat
wcscpy
RtlAnsiStringToUnicodeString
ZwCreateFile
_stricmp
wcsstr
_wcslwr
IoDeviceObjectType
ZwSetInformationFile
PsLookupProcessByProcessId
KeTickCount
KeQueryTimeIncrement
KeDelayExecutionThread
PsSetCreateProcessNotifyRoutine

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEWMI
Size: 32B - Virtual size: 5B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 96B - Virtual size: 66B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 736B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6e9ea872ff0e7bcae62345b21e084bd

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 6KB - Virtual size: 6KB

PAGEWMI Size: 32B - Virtual size: 5B

PAGE Size: 96B - Virtual size: 66B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 736B - Virtual size: 712B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 6KB

PAGEWMI
Size: 32B - Virtual size: 5B

PAGE
Size: 96B - Virtual size: 66B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 736B - Virtual size: 712B

.reloc
Size: 1KB - Virtual size: 1KB