4203b541e7679622623a1a1e6a4469bcc406696df48cac69a6ae283a29c71424

Sharing

Copy URL Twitter E-mail

General

Target

4203b541e7679622623a1a1e6a4469bcc406696df48cac69a6ae283a29c71424
Size

420KB
MD5

1cb4c47bfe1e956ac548cbea38c059da
SHA1

2be91aafcbe91d4fd8c9f7161a42721a597171ae
SHA256

4203b541e7679622623a1a1e6a4469bcc406696df48cac69a6ae283a29c71424
SHA512

e8645efdfd448c4afa3e275655672f7f6895eaae8ab47ee858886419271ab3adef2cd3666680294e0f5cb00163787a04059b3bd954f56b0d64f5981ca46d58bb
SSDEEP

6144:Dioxb7lNqCjO/3ZFR/I5AA3AepeV2fbRa:DioxbDqCO2jRa

Score

N/A

Malware Config

Signatures

Files

4203b541e7679622623a1a1e6a4469bcc406696df48cac69a6ae283a29c71424
.exe windows x86

af97f748cfdba2bcfd594628f5600d51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PoSetPowerState
IoDeleteDevice
KeInitializeEvent
KeInitializeSpinLock
IoCreateDevice
memmove
memset
KeSetEvent
RtlQueryRegistryValues
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
memcpy
ZwSetValueKey
ZwCreateKey
ZwDeleteValueKey
KeClearEvent
InterlockedIncrement
InterlockedDecrement
IoFreeIrp
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
IoFreeWorkItem
IofCompleteRequest
InterlockedExchange
KeCancelTimer
IoSetDeviceInterfaceState
KeInitializeDpc
IoAllocateWorkItem
IoAttachDeviceToDeviceStack
KeSetTimerEx
KeDelayExecutionThread
PoStartNextPowerIrp
PoCallDriver
PoRequestPowerIrp
IoBuildDeviceIoControlRequest
IoWMIRegistrationControl
IoFreeMdl
IoBuildPartialMdl
IoAllocateMdl
_alldiv
_allmul
swprintf
KeReleaseMutex
KeSetTimer
_aulldiv
IoSetCompletionRoutineEx
KeReleaseSemaphore
ObfDereferenceObject
KeWaitForMultipleObjects
KeInitializeMutex
sprintf
KeQuerySystemTime
_allshr
KeBugCheckEx
KeInitializeTimerEx
KeQueryTimeIncrement
KeTickCount
ExAllocatePoolWithTag
IoDetachDevice
IoRegisterDeviceInterface
wcsstr
IoIsWdmVersionAvailable
ExFreePool
IoQueueWorkItem
DbgPrintEx
strncmp

hal

KfAcquireSpinLock
KeQueryPerformanceCounter
KeGetCurrentIrql
KfReleaseSpinLock

wmilib.sys

WmiSystemControl
WmiCompleteRequest

usbd.sys

USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af97f748cfdba2bcfd594628f5600d51

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wmilib.sys

usbd.sys

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 190KB - Virtual size: 190KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 152KB - Virtual size: 151KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 190KB - Virtual size: 190KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 152KB - Virtual size: 151KB

.reloc
Size: 3KB - Virtual size: 3KB