6bdd085f3520f5bc62c63df8a5493e9b5026d2c8e01bbf34716b5d5d83454ddd

General

Target

6bdd085f3520f5bc62c63df8a5493e9b5026d2c8e01bbf34716b5d5d83454ddd
Size

35KB
MD5

688b014af6de748276a7d5b9b4d0da3b
SHA1

89a53ba95742cd611304e7d9a84d40a043267011
SHA256

6bdd085f3520f5bc62c63df8a5493e9b5026d2c8e01bbf34716b5d5d83454ddd
SHA512

0879522bafff4131cf683fdc083feaf71472ec737a98b264be5d4d84f52310f8ed745a49034d2cea939897926e0d2514ec79d1f53a66456d6508d7b933d8d24f
SSDEEP

768:Y3vRkm0Ym4TNOYlVTEiueBE0GtEUtX4kAfoqLNNaMIeaJzCvlS:Y3ZkTYm4cYoiz+vtXXjMI9zCdS

Score

N/A

Malware Config

Signatures

Files

6bdd085f3520f5bc62c63df8a5493e9b5026d2c8e01bbf34716b5d5d83454ddd
.exe windows x86

18c2c8e464436c973b255ef449bbdde5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_wcsicmp
wcsncpy
wcslen
wcsrchr
ZwClose
ZwCreateFile
RtlInitUnicodeString
RtlCompareUnicodeString
ZwSetValueKey
ZwCreateKey
strncpy
IoGetCurrentProcess
strncmp
wcscat
wcscpy
KeTickCount
ZwQueryValueKey
ZwOpenKey
_except_handler3
RtlCopyUnicodeString
ZwDeleteKey
swprintf
ObReferenceObjectByHandle
_snwprintf
wcschr
ZwQueryKey
_stricmp
PsLookupProcessByProcessId
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
wcsstr
_wcslwr
_wcsnicmp
ObQueryNameString
KeDelayExecutionThread
KeQuerySystemTime
_snprintf
MmIsAddressValid
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
KeQueryTimeIncrement
ZwSetInformationFile
IofCompleteRequest
IoDeviceObjectType
RtlAnsiStringToUnicodeString
PsCreateSystemThread
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 96B - Virtual size: 77B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 640B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18c2c8e464436c973b255ef449bbdde5

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 25KB - Virtual size: 25KB

.data Size: 5KB - Virtual size: 5KB

PAGE Size: 96B - Virtual size: 77B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 640B - Virtual size: 616B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 25KB - Virtual size: 25KB

.data
Size: 5KB - Virtual size: 5KB

PAGE
Size: 96B - Virtual size: 77B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 640B - Virtual size: 616B

.reloc
Size: 1KB - Virtual size: 1KB