698e3e120daade414d3bae046939c7ed570b921e29a8d86d9130b949b22588e4

General

Target

698e3e120daade414d3bae046939c7ed570b921e29a8d86d9130b949b22588e4
Size

18KB
MD5

7d2f3ae595dba346fde0a66e1bdda440
SHA1

e4208475d69383e8f1789e54f0677a3bff93a875
SHA256

698e3e120daade414d3bae046939c7ed570b921e29a8d86d9130b949b22588e4
SHA512

4e8c02b83bf8106c36339321f222f4dc7e8b5bd5e5329dd558989bbc4feb87930b855b6fa369758bc2bd4c1db392058fa4cb338a23ccc16cfc0d8e37d141593c
SSDEEP

384:H9v3EyuvymGVCa5MIMo8iPjyf6gUGBoPcnZeBma+2kofTBzIX9twd81rPDDR+/2a:dCGG+gkoaX

Score

N/A

Malware Config

Signatures

Files

698e3e120daade414d3bae046939c7ed570b921e29a8d86d9130b949b22588e4
.exe windows x86

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQueryInformationProcess
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwClose
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 982B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

zdata Size: 288B - Virtual size: 260B

vdata Size: 288B - Virtual size: 260B

INIT Size: 992B - Virtual size: 982B

.reloc Size: 416B - Virtual size: 388B

.text
Size: 16KB - Virtual size: 16KB

zdata
Size: 288B - Virtual size: 260B

vdata
Size: 288B - Virtual size: 260B

INIT
Size: 992B - Virtual size: 982B

.reloc
Size: 416B - Virtual size: 388B