e647fa2810c4a8e64f8e29807563ee0224da0b72a7ca53ff5cf6d5fd33860176

Sharing

Copy URL Twitter E-mail

General

Target

e647fa2810c4a8e64f8e29807563ee0224da0b72a7ca53ff5cf6d5fd33860176
Size

29KB
MD5

8272b80735d48b761bd6c7b857bf4a50
SHA1

cf5fb7427753a73d5d9be1df7af2b40d2c93cdcb
SHA256

e647fa2810c4a8e64f8e29807563ee0224da0b72a7ca53ff5cf6d5fd33860176
SHA512

37f360438e1c1c2362e9496f5e21fe1f7c200d982ce62d087e5aaca18665d8e5081e85616d6c1c924ef9a8003b4e214b70d9b0ab47a3095a6a678c9363e6ddf9
SSDEEP

384:mkhw8jEZljjvu8fxCc///1l+FG7vB/3529+YbS0X11d7:xhw8jEZljjXf//Nl+FG7hp29nbS0X5

Score

N/A

Malware Config

Signatures

Files

e647fa2810c4a8e64f8e29807563ee0224da0b72a7ca53ff5cf6d5fd33860176
.exe windows x86

f923a39c9372fc1f4893fd95eb594ca9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_except_handler3
ZwQuerySystemInformation
ExFreePool
_stricmp
strrchr
ExAllocatePoolWithTag
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoFileObjectType
IofCompleteRequest
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ZwPulseEvent
PsCreateSystemThread
MmFreePagesFromMdl
MmSizeOfMdl
MmCreateMdl
KePulseEvent
KeInitializeSemaphore
MmMapIoSpace
KeTickCount
KeBugCheckEx

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 768B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata2
Size: 128B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sosata1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.toata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tnata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tmata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tlata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tkata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tjata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tiata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.thata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tgata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tfata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.teata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tdata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tcata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tbata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.taata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t9ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t8ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t7ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t6ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t5ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t4ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t2ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ESTisb
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 896B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f923a39c9372fc1f4893fd95eb594ca9

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 768B - Virtual size: 716B

sosata2 Size: 128B - Virtual size: 28B

sosata1 Size: 4KB - Virtual size: 4KB

.toata Size: 256B - Virtual size: 256B

.tnata Size: 256B - Virtual size: 256B

.tmata Size: 256B - Virtual size: 256B

.tlata Size: 256B - Virtual size: 256B

.tkata Size: 256B - Virtual size: 256B

.tjata Size: 256B - Virtual size: 256B

.tiata Size: 256B - Virtual size: 256B

.thata Size: 256B - Virtual size: 256B

.tgata Size: 256B - Virtual size: 256B

.tfata Size: 256B - Virtual size: 256B

.teata Size: 256B - Virtual size: 256B

.tdata Size: 256B - Virtual size: 256B

.tcata Size: 256B - Virtual size: 256B

.tbata Size: 256B - Virtual size: 256B

.taata Size: 256B - Virtual size: 256B

.t9ata Size: 256B - Virtual size: 256B

.t8ata Size: 256B - Virtual size: 256B

.t7ata Size: 256B - Virtual size: 256B

.t6ata Size: 256B - Virtual size: 256B

.t5ata Size: 256B - Virtual size: 256B

.t4ata Size: 256B - Virtual size: 256B

.t3ata Size: 256B - Virtual size: 256B

.t2ata Size: 256B - Virtual size: 256B

.t1ata Size: 512B - Virtual size: 512B

.ESTisb Size: 2KB - Virtual size: 2KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 896B - Virtual size: 840B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 768B - Virtual size: 716B

sosata2
Size: 128B - Virtual size: 28B

sosata1
Size: 4KB - Virtual size: 4KB

.toata
Size: 256B - Virtual size: 256B

.tnata
Size: 256B - Virtual size: 256B

.tmata
Size: 256B - Virtual size: 256B

.tlata
Size: 256B - Virtual size: 256B

.tkata
Size: 256B - Virtual size: 256B

.tjata
Size: 256B - Virtual size: 256B

.tiata
Size: 256B - Virtual size: 256B

.thata
Size: 256B - Virtual size: 256B

.tgata
Size: 256B - Virtual size: 256B

.tfata
Size: 256B - Virtual size: 256B

.teata
Size: 256B - Virtual size: 256B

.tdata
Size: 256B - Virtual size: 256B

.tcata
Size: 256B - Virtual size: 256B

.tbata
Size: 256B - Virtual size: 256B

.taata
Size: 256B - Virtual size: 256B

.t9ata
Size: 256B - Virtual size: 256B

.t8ata
Size: 256B - Virtual size: 256B

.t7ata
Size: 256B - Virtual size: 256B

.t6ata
Size: 256B - Virtual size: 256B

.t5ata
Size: 256B - Virtual size: 256B

.t4ata
Size: 256B - Virtual size: 256B

.t3ata
Size: 256B - Virtual size: 256B

.t2ata
Size: 256B - Virtual size: 256B

.t1ata
Size: 512B - Virtual size: 512B

.ESTisb
Size: 2KB - Virtual size: 2KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 896B - Virtual size: 840B