e47cd3a246af495692365238f4ed66f7e85e95f9c56c11135018125a4328db2c

Sharing

Copy URL Twitter E-mail

General

Target

e47cd3a246af495692365238f4ed66f7e85e95f9c56c11135018125a4328db2c
Size

23KB
MD5

2c2cef38643117be36058de32f37f340
SHA1

442cb1254b46c7298dfcc27587125da9229a08b0
SHA256

e47cd3a246af495692365238f4ed66f7e85e95f9c56c11135018125a4328db2c
SHA512

9d38f614de96655f6a9db4e4c327f121f494a46990990703eab0f78abf6584662637d8e99d15398ed94147335673214327877134fbbc3267d3785a98b09b463f
SSDEEP

384:h+PGGGGGGo9mZrZJJxPlFG7vrMnDNResW29+YbS0XSWE:h+PGGGGGGo9CrZJJZlFG74pRbW29nbSQ

Score

N/A

Malware Config

Signatures

Files

e47cd3a246af495692365238f4ed66f7e85e95f9c56c11135018125a4328db2c
.exe windows x86

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
_stricmp
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
ZwQuerySystemInformation
IoGetRelatedDeviceObject
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 608B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 736B - Virtual size: 716B

.data Size: 608B - Virtual size: 608B

sosata2 Size: 32B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 928B - Virtual size: 912B

.reloc Size: 928B - Virtual size: 926B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 736B - Virtual size: 716B

.data
Size: 608B - Virtual size: 608B

sosata2
Size: 32B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 928B - Virtual size: 926B