026b26f952df7ccaac5b07e5ae00816a2af7fae65db2d15d903d8c96015572f9

Sharing

Copy URL Twitter E-mail

General

Target

026b26f952df7ccaac5b07e5ae00816a2af7fae65db2d15d903d8c96015572f9
Size

23KB
MD5

82a5276dd2a09663d041d26ae2076100
SHA1

a30fbff16325a9d652a4a8e5ad112716153a2949
SHA256

026b26f952df7ccaac5b07e5ae00816a2af7fae65db2d15d903d8c96015572f9
SHA512

b24f52d61b96e3c0c6ea31ea5a10c70ca3b86f48de93d3d3aa6d99de85f985804c23e088d6b8f7f919c704c0225d7afa18741fb3192592090c73de2ef82d3ec8
SSDEEP

384:C+PGGGGGGo9mZrZJJxPlFG7vrMnDNResW29+YbS0XSWE:C+PGGGGGGo9CrZJJZlFG74pRbW29nbSQ

Score

N/A

Malware Config

Signatures

Files

026b26f952df7ccaac5b07e5ae00816a2af7fae65db2d15d903d8c96015572f9
.exe windows x86

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
_stricmp
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
ZwQuerySystemInformation
IoGetRelatedDeviceObject
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 608B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 32B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44eaafa39695e0469d474f5d3b84017f

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 736B - Virtual size: 716B

.data Size: 608B - Virtual size: 608B

sosata2 Size: 32B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 928B - Virtual size: 912B

.reloc Size: 928B - Virtual size: 926B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 736B - Virtual size: 716B

.data
Size: 608B - Virtual size: 608B

sosata2
Size: 32B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 928B - Virtual size: 926B