e6b5bb7bd225e3ff45cd2afe4695c48a6077e61c0ca4983c7b223f2afdbf21d2

General

Target

e6b5bb7bd225e3ff45cd2afe4695c48a6077e61c0ca4983c7b223f2afdbf21d2
Size

24KB
MD5

63dcc3b8889c061f8f5be9e80422c060
SHA1

25e37fcde418a568945956555feb41980030254b
SHA256

e6b5bb7bd225e3ff45cd2afe4695c48a6077e61c0ca4983c7b223f2afdbf21d2
SHA512

cb4eb2ef8dbe1c85bf8bc9763b0a30d5ad76c338ac6b94a37000e3b64b81c4d51f1c2398d6afc2b199326441aa9f8afcf7d0e174d581b09fc78417f76309975d
SSDEEP

768:2+j7l7l7l7l7l7l7FEXPNQFG7VheKUW+uyHJP:2gFW+RJ

Score

N/A

Malware Config

Signatures

Files

e6b5bb7bd225e3ff45cd2afe4695c48a6077e61c0ca4983c7b223f2afdbf21d2
.exe windows x86

ddd389ed8e3a00132e912aa2bd41cdc4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ExFreePool
strrchr
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObReferenceObjectByHandle
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
MmUserProbeAddress
ProbeForWrite
ProbeForRead
ZwReadFile
ZwWriteFile
ZwCreateFile
RtlFreeUnicodeString
IoCreateFile
_stricmp
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
RtlAnsiStringToUnicodeString
_except_handler3

hal

KeQueryPerformanceCounter

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 966B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddd389ed8e3a00132e912aa2bd41cdc4

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 896B - Virtual size: 876B

.data Size: 6KB - Virtual size: 6KB

.t1ata Size: 512B - Virtual size: 512B

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 992B - Virtual size: 966B

.reloc Size: 928B - Virtual size: 920B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 896B - Virtual size: 876B

.data
Size: 6KB - Virtual size: 6KB

.t1ata
Size: 512B - Virtual size: 512B

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 992B - Virtual size: 966B

.reloc
Size: 928B - Virtual size: 920B