27d81a889f71dd81f0b8d9b1614270542a5d56294c9c400fcc1dbb83b1161ce8

Sharing

Copy URL Twitter E-mail

General

Target

27d81a889f71dd81f0b8d9b1614270542a5d56294c9c400fcc1dbb83b1161ce8
Size

122KB
MD5

8363b58dc6dab65672fa73e8c1641d87
SHA1

9d20e1d600acd767ccb6ed67abe08783fdc14f93
SHA256

27d81a889f71dd81f0b8d9b1614270542a5d56294c9c400fcc1dbb83b1161ce8
SHA512

1a5fcc7d4ed4feb6ab4bffe116f0dc912e8fc99c2855971a78bf0fe946749e5b3715a9db6ecd8a8db7dae045b17ae77a01145686315aca8088f09d6c55ede410
SSDEEP

3072:bmu+dxn48u0OH7L3LHLeP9c8c5MNy3ANHWbRQdtA:CJxne0KwWtuNyvbRA

Score

N/A

Malware Config

Signatures

Files

27d81a889f71dd81f0b8d9b1614270542a5d56294c9c400fcc1dbb83b1161ce8
.exe windows x64

3e87146865820bbec7b2204387db838c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeAcquireInStackQueuedSpinLockAtDpcLevel
KeTestSpinLock
IoFreeMdl
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeReleaseInStackQueuedSpinLock
KeWaitForSingleObject
KeAcquireInStackQueuedSpinLock
KeInitializeEvent
KeSetEvent
RtlInitUnicodeString
IofCompleteRequest
KeResetEvent
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoReleaseCancelSpinLock
KeDelayExecutionThread
IoAllocateMdl
MmBuildMdlForNonPagedPool
ExAllocatePoolWithTag
ExFreePoolWithTag
IoWMIWriteEvent
MmGetSystemRoutineAddress
RtlCompareMemory
IoWMIRegistrationControl
KeInitializeDpc
KeInitializeTimerEx
KeSetCoalescableTimer
KeCancelTimer
KeFlushQueuedDpcs
KeReleaseMutex
KeBugCheckEx
ZwClose
ZwQueryValueKey
ZwOpenKey
EtwWriteTransfer
KeInsertQueueDpc
KeSetImportanceDpc
EtwUnregister
EtwRegister
ExDeleteNPagedLookasideList
ookasideList
IoBuildPartialMdl
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTagPriority
ExQueryDepthSList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
KeGetCurrentProcessorNumberEx
KeExpandKernelStackAndCalloutEx
KeReleaseSpinLockFromDpcLevel
IoQueueWorkItem
KeAcquireSpinLockAtDpcLevel
IoUninitializeWorkItem
IoInitializeWorkItem
IoSizeofWorkItem
EtwWrite
KeInitializeMutex
KeQueryMaximumProcessorCountEx
ExDeleteLookasideListEx
__C_specific_handler

ndis.sys

NdisAllocateIoWorkItem
NdisAllocateNetBufferList
NdisFreeIoWorkItem
NdisQueueIoWorkItem
NdisRegisterDeviceEx
NdisCloseConfiguration
NdisReadNetworkAddress
NdisOpenConfigurationEx
NdisMSetMiniportAttributes
NdisMIndicateStatusEx
NdisMOidRequestComplete
NdisMPauseComplete
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeCloneNetBufferList
NdisReadConfiguration
NdisAdjustNetBufferCurrentMdl
NdisAllocateCloneNetBufferList
NdisMDeregisterMiniportDriver
NdisMRegisterMiniportDriver
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisMIndicateReceiveNetBufferLists
NdisAllocateNetBufferAndNetBufferList
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisDeregisterDeviceEx
NdisGetDataBuffer
NdisFreeNetBufferList
NdisMSendNetBufferListsComplete

netio.sys

NetioFreeStackBlock
NsiGetParameter
NmrClientDetachProviderComplete
NmrClientAttachProvider
NmrWaitForClientDeregisterComplete
NmrDeregisterClient
NmrRegisterClient
NetioSqmTerminate
NetioUnInitializeNetBufferListLibrary
NetioUnRegisterProcessorAddCallback
NetioSqmInitialize
NetioAllocateAndInitializeStackBlock
NetioRegisterProcessorAddCallback
NetioInitializeNetBufferListLibrary
NetioStackBlockProcessorAddHandler
RtlCopyMdlToBuffer
NetioAllocateAndReferenceCopyNetBufferListEx
NetioDereferenceNetBufferList
NetioFreeMdl
NetioFreeCloneNetBufferList
NetioAllocateAndReferenceCloneNetBufferListEx
NetioSqmWriteEvent
NetioDereferenceNetBufferListChain
NetioAllocateMdl
RtlCopyBufferToMdl
FsbAllocate
FsbFree
FsbDestroyPool
NsiGetAllParameters
RtlCopyMdlToMdl
NetioCompleteCopyNetBufferListChain

fwpkclnt.sys

FwpmFilterAdd0
FwpsDereferenceNetBufferList0
FwpsReferenceNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFlowAssociateContext0
FwpsCalloutRegister0
FwpsFreeCloneNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpiParseIPv6Protocol0
FwpsFlowRemoveContext0
FwpmCalloutAdd0
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpmEngineOpen0
FwpmTransactionBegin0
FwpmSubLayerAdd0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmEngineClose0
FwpsInjectionHandleDestroy0
FwpsNetBufferListRetrieveContext0
FwpsNetBufferListGetTagForContext0
FwpsCalloutUnregisterByKey0
FwpsAcquireClassiJZnndle0
FwpsPendClassify0
FwpsRele`seBlarshgyHandld1nFvqrBammoutRegisterWithoutDevice0
FvqrBammoutRegisterWithoutDevice0
FwpsCompleteClassify0
FwpiNetBufferListAssociateContextWithoutDevice0
FwpsInjectTransportSendAsync0

msrpc.sys

RpcBindingCreateW
RpcBindingSetOption
RpcAsyncInitializeHandle
RpcBindingBind
RpcAsyncGetCallStatus
RpcAsyncCancelCall
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcBindingUnbind
RpcBindingFree
Ndr64AsyncClientCall

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 866B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e87146865820bbec7b2204387db838c

Headers

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

netio.sys

fwpkclnt.sys

msrpc.sys

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 15KB

.pdata Size: 3KB - Virtual size: 3KB

PAGE Size: 3KB - Virtual size: 2KB

INIT Size: 6KB - Virtual size: 5KB

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 1024B - Virtual size: 866B

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 15KB

.pdata
Size: 3KB - Virtual size: 3KB

PAGE
Size: 3KB - Virtual size: 2KB

INIT
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 1024B - Virtual size: 866B