75c870360cce74f2bfe38208cb898cfd4865bd9a6a4b994efd0cb03c77249a94

General

Target

75c870360cce74f2bfe38208cb898cfd4865bd9a6a4b994efd0cb03c77249a94
Size

18KB
MD5

91b85031c374f2db7c68228b11fa4e90
SHA1

aca8c583bc3dd703a3428935a9ecf15241fa688b
SHA256

75c870360cce74f2bfe38208cb898cfd4865bd9a6a4b994efd0cb03c77249a94
SHA512

ffbddede2cc274b177aa426b471bdd2d10a1ccdb6e73729447201e6f2ee992bfdb3a01d82f863abc464d59822b24d49d67627b096b531314b7adad2340172dc6
SSDEEP

384:u9v3EyuvymGVCa5MIMo8iPjyf6gUGBoPcnZeBma+2kofTBzIX9twd81rPDDR+/2a:8CGG+gkoaX

Score

N/A

Malware Config

Signatures

Files

75c870360cce74f2bfe38208cb898cfd4865bd9a6a4b994efd0cb03c77249a94
.exe windows x86

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQueryInformationProcess
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwClose
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 982B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

zdata Size: 288B - Virtual size: 260B

vdata Size: 288B - Virtual size: 260B

INIT Size: 992B - Virtual size: 982B

.reloc Size: 416B - Virtual size: 388B

.text
Size: 16KB - Virtual size: 16KB

zdata
Size: 288B - Virtual size: 260B

vdata
Size: 288B - Virtual size: 260B

INIT
Size: 992B - Virtual size: 982B

.reloc
Size: 416B - Virtual size: 388B