2726093bf5d54dcc8ee8f7a680d4954bfb0b1d50436cf4856906a967de6c1454

Sharing

Copy URL Twitter E-mail

General

Target

2726093bf5d54dcc8ee8f7a680d4954bfb0b1d50436cf4856906a967de6c1454
Size

200KB
MD5

c4ec1acd3a8dda88809787c8c4808bf6
SHA1

a36bf122dda6673219517aa9d6854f9888252ed1
SHA256

2726093bf5d54dcc8ee8f7a680d4954bfb0b1d50436cf4856906a967de6c1454
SHA512

4026a56195d229c17ee15f22323b27da92cf3deed3032fc308a9ffe8cc2dbb8c5250dab3731d784dc0387db4c557444b220922d998ff9ed69952a3492eeb42c1
SSDEEP

3072:BD95hBQB+w5Mhb6Le+sgT+ntwRo4Av5eUeMeUeCt:hhBQBzKhbEdYeUeMeUes

Score

N/A

Malware Config

Signatures

Files

2726093bf5d54dcc8ee8f7a680d4954bfb0b1d50436cf4856906a967de6c1454
.dll windows x86

34223097362b78fc847db0204b476092

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendA

kernel32

LockResource
LoadResource
SizeofResource
FindResourceA
HeapFree
HeapAlloc
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
FatalAppExitA
VirtualAlloc
IsBadWritePtr
Sleep
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
GetWindowsDirectoryA
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
RtlUnwind
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
GetACP
GetOEMCP
LoadLibraryA
FlushFileBuffers
SetFilePointer
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteFile
CloseHandle
SetEndOfFile
GetSystemDirectoryA
DeleteFileA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
DeviceIoControl
CreateFileA
GetLastError
SetLastError

advapi32

RegDeleteKeyA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService
ControlService
StartServiceA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegCreateKeyA

Exports

Exports

LoadDriver
ReadSectors
UnloadDriver
WriteSectors
testRegDrv1

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34223097362b78fc847db0204b476092

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 12KB - Virtual size: 16KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 40KB - Virtual size: 37KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 12KB - Virtual size: 16KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 40KB - Virtual size: 37KB

.reloc
Size: 8KB - Virtual size: 4KB