b85c4051d44ce27d4374a6fd406749548b7cf868db63350c3910e9cbd63344e9

General

Target

b85c4051d44ce27d4374a6fd406749548b7cf868db63350c3910e9cbd63344e9
Size

715KB
MD5

90d49e5c0c138a593233e898c19f1ed0
SHA1

de8d0bf4f3e5f8fd711fc7bb555c1e0fd3806252
SHA256

b85c4051d44ce27d4374a6fd406749548b7cf868db63350c3910e9cbd63344e9
SHA512

bb173ce93eb0fdac95682c355fdea7f3594ca3553ed3182a4e3550fd4a5c0089136c9305044b5960bdb96283a05bdcf164f47fb47b938d57e9f03d8b50d0f47c
SSDEEP

12288:LAQ6bjKydiD+B2plEkAa52UjH1wl5gaA1s60NOcXq0FMdj:yiUiBpikzjS5gNs6Mjp0

Score

N/A

Malware Config

Signatures

Files

b85c4051d44ce27d4374a6fd406749548b7cf868db63350c3910e9cbd63344e9
.exe windows x86

ab6afd8ea45d655bde7b8c65a56d469a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwWriteFile
ZwCreateFile
RtlInitUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
_strnicmp
wcslen
IoGetCurrentProcess
wcsstr
ZwReadFile
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQueryInformationFile
strrchr
ZwSetInformationFile
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
PsRemoveCreateThreadNotifyRoutine
PsSetCreateThreadNotifyRoutine
IoRegisterShutdownNotification
IoCreateSymbolicLink
IoCreateDevice
IoFreeMdl
MmUnlockPages
wcsrchr
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
RtlWriteRegistryValue
RtlQueryRegistryValues
memmove
_wcsicmp
KeTickCount
KeBugCheckEx

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 697KB - Virtual size: 697KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab6afd8ea45d655bde7b8c65a56d469a

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 512B - Virtual size: 388B

.data Size: 697KB - Virtual size: 697KB

PAGE Size: 1KB - Virtual size: 1KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 512B - Virtual size: 388B

.data
Size: 697KB - Virtual size: 697KB

PAGE
Size: 1KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB