4390eca9813c55860f7305dd94a3b4016f394bd5cbecf544246ace29b9e26693

Sharing

Copy URL Twitter E-mail

General

Target

4390eca9813c55860f7305dd94a3b4016f394bd5cbecf544246ace29b9e26693
Size

1.8MB
MD5

82fc6e4680cecb132fa672d819c291db
SHA1

d30aa01deb3c1195bda6cb8a9047dcc2709304a0
SHA256

4390eca9813c55860f7305dd94a3b4016f394bd5cbecf544246ace29b9e26693
SHA512

dd15e1af6e9da3d612d11beb44d64f4397159771c429c4bdc134ea10c522b2be18deaebc1018b2f648b35536bbb4cbc610dee0e9ffc634bafeeae2f7f7b8a766
SSDEEP

49152:QniY1jj2GEuxi17jmGFweXYsAR8dZHkt:QniY1X2Pdjm9eXW8dyt

Score

N/A

Malware Config

Signatures

Files

4390eca9813c55860f7305dd94a3b4016f394bd5cbecf544246ace29b9e26693
.exe windows x86

83db7c185a29473880a8a676cf0d7e96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dxapi.sys

_DxApiGetVersion@0

hal

ExAcquireFastMutex
ExReleaseFastMutex
KeQueryPerformanceCounter

ntoskrnl.exe

PsSetProcessWin32Process
PsGetProcessWin32Process
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
PsGetCurrentProcessId
PsSetThreadWin32Thread
KeTickCount
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
ObfDereferenceObject
ObfReferenceObject
RtlNtStatusToDosError
strchr
strncpy
KeAreApcsDisabled
ExAllocatePoolWithTagPriority
RtlRandom
MmIsVerifierEnabled
PsGetCurrentThread
KeBugCheckEx
PsGetCurrentProcess
ProbeForWrite
_except_handler3
ExRaiseAccessViolation
SeReleaseSecurityDescriptor
SeCaptureSecurityDescriptor
RtlInitUnicodeString
swprintf
_wcsicmp
ExRaiseDatatypeMisalignment
ObReferenceObjectByHandle
PsGetProcessSessionId
PsProcessType
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExRaiseStatus
ObCloseHandle
InterlockedExchange
RtlAreAnyAccessesGranted
memmove
PsGetJobUIRestrictionsClass
PsGetJobLock
PsJobType
wcsncpy
RtlIntegerToUnicode
RtlIntegerToUnicodeString
PsGetThreadId
PsGetThreadProcessId
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
SeTokenType
SeCreateClientSecurity
wcslen
ObOpenObjectByPointer
ExDesktopObjectType
RtlCopyUnicodeString
KeInitializeEvent
ExFreePoolWithTag
ExInitializeResourceLite
ExAllocatePoolWithTag
ZwCreateDirectoryObject
RtlUnicodeStringToInteger
wcschr
wcsstr
MmMapViewOfSection
MmCreateSection
MmMapViewInSessionSpace
MmUnmapViewInSessionSpace
RtlAllocateHeap
ZwSetSystemInformation
NlsMbCodePageTag
NlsAnsiCodePage
PsGetThreadProcess
PsIsSystemThread
PsGetProcessJob
wcscpy
RtlGetNtGlobalFlags
MmGetSystemRoutineAddress
RtlCheckRegistryKey
ExWindowStationObjectType
PsGetCurrentProcessSessionId
PsGetProcessWin32WindowStation
RtlCompareUnicodeString
ZwQueryDefaultLocale
PsGetProcessPeb
InterlockedPopEntrySList
InterlockedPushEntrySList
PsGetProcessCreateTimeQuadPart
KeQuerySystemTime
KeClearEvent
RtlFreeHeap
PsLookupProcessByProcessId
PsGetThreadSessionId
PsLookupThreadByThreadId
ExDeletePagedLookasideList
ExIsResourceAcquiredExclusiveLite
ExInitializePagedLookasideList
KeWaitForMultipleObjects
KeWaitForSingleObject
_allmul
KeSetEvent
PsIsThreadTerminating
ZwClose
ExEventObjectType
ZwCreateEvent
ObReferenceObjectByPointer
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsGetProcessImageFileName
PsThreadType
SeQueryAuthenticationIdToken
PsReferencePrimaryToken
PsGetProcessInheritedFromUniqueProcessId
PsSetProcessWindowStation
RtlInitializeBitMap
PsGetProcessId
PsGetProcessExitStatus
PsGetProcessExitProcessCalled
ZwQueryInformationProcess
KeSetKernelStackSwapEnable
SeTokenIsWriteRestricted
PsGetProcessSectionBaseAddress
ZwTerminateProcess
ExRaiseHardError
RtlWalkFrameChain
ExAllocatePoolWithQuotaTag
DbgBreakPoint
DbgPrint
KdDebuggerEnabled
ZwQueryValueKey
ZwOpenKey
RtlDestroyHeap
_wcsnicmp
wcscat
KeDelayExecutionThread
InterlockedDecrement
NtQueryInformationProcess
RtlDestroyAtomTable
ExDeleteResourceLite
KeCancelTimer
KeRemoveSystemServiceTable
KeQueryInterruptTime
MmPageEntireDriver
MmUserProbeAddress
PsEstablishWin32Callouts
KeAddSystemServiceTable
ZwQueryDefaultUILanguage
ZwSetDefaultUILanguage
ZwSetDefaultLocale
ExIsResourceAcquiredSharedLite
ExAcquireResourceSharedLite
RtlQueryRegistryValues
ZwPowerInformation
KeResetEvent
ZwDeviceIoControlFile
IoGetRelatedDeviceObject
KeInitializeTimerEx
PsGetCurrentThreadId
InitSafeBootMode
RtlAreAllAccessesGranted
SeDeleteAccessState
ObCheckObjectAccess
SeCreateAccessState
SeReleaseSubjectContext
SeUnlockSubjectContext
SePrivilegeObjectAuditAlarm
SePrivilegeCheck
SeLockSubjectContext
SeCaptureSubjectContext
RtlCopySid
RtlLengthSid
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlCreateSecurityDescriptor
SeExports
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ZwQueryInformationToken
RtlEqualUnicodeString
ZwSetInformationObject
ZwQueryObject
ObCreateObject
KeUnstackDetachProcess
KeStackAttachProcess
ZwDuplicateObject
ObFindHandleForObject
RtlClearBits
RtlSetBits
ZwSetSecurityObject
RtlInitializeSid
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlMapGenericMask
ObReleaseObjectSecurity
ObAssignSecurity
ObGetObjectSecurity
ObCheckCreateObjectAccess
MmUnmapViewOfSection
ObOpenObjectByName
PsGetThreadTeb
KeDetachProcess
KeAttachProcess
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KePulseEvent
ObQueryNameString
ZwOpenEvent
ZwSetInformationThread
RtlPinAtomInAtomTable
RtlAddAtomToAtomTable
RtlCreateAtomTable
ExReleaseRundownProtection
LpcRequestWaitReplyPort
SeDeassignSecurity
ObSetSecurityDescriptorInfo
SeAssignSecurity
ObInsertObject
ZwOpenDirectoryObject
ExAcquireRundownProtection
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
PsReferenceImpersonationToken
SeQueryInformationToken
SeTokenIsRestricted
PsCreateSystemThread
ObSetHandleAttributes
PsGetProcessDebugPort
ZwYieldExecution
RtlIntegerToChar
RtlUnicodeStringToAnsiString
PsSetProcessPriorityByClass
PsSetProcessPriorityClass
PsGetProcessPriorityClass
KeSetPriorityThread
RtlUnicodeToMultiByteN
SeImpersonateClientEx
MmAdjustWorkingSetSize
KeSetTimer
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
ZwQueryKey
ZwEnumerateValueKey
ZwSetValueKey
RtlMultiByteToUnicodeN
RtlFindMessage
wcsrchr
RtlEqualString
strrchr
ExGetSharedWaiterCount
ExGetExclusiveWaiterCount
IoQueryDeviceDescription
ExRundownCompleted
ExWaitForRundownProtectionRelease
ZwSetEvent
PoSetSystemState
PoRequestShutdownEvent
KeInitializeTimer
NlsOemCodePage
RtlLookupAtomInAtomTable
RtlDeleteAtomFromAtomTable
RtlQueryAtomInAtomTable
ZwReadFile
ZwQueryInformationFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwCreateFile
IoFileObjectType
PsGetThreadFreezeCount
InterlockedIncrement
RtlUnicodeToMultiByteSize
RtlMultiByteToUnicodeSize
KeUserModeCallback
MmSystemRangeStart
ZwOpenFile
IofCallDriver
IoBuildSynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoGetStackLimits
MmCommitSessionMappedView
RtlCreateHeap
IoUnregisterPlugPlayNotification
IoWMIQuerySingleInstance
IoWMIHandleToInstanceName
IoWMIOpenBlock
ZwCancelIoFile
wcsncmp
IoGetDeviceObjectPointer
IoRegisterPlugPlayNotification
ObReferenceObjectByName
IoDriverObjectType
IoCreateDriver
IoPnPDeliverServicePowerNotification
IoInvalidateDeviceRelations
LpcRequestPort
KeIsAttachedProcess
RtlEmptyAtomTable
RtlZeroHeap
_alldiv
_allshr
vsprintf
MmSecureVirtualMemory
KeRestoreFloatingPointState
KeSaveFloatingPointState
ZwQuerySystemInformation
ExSystemTimeToLocalTime
InterlockedCompareExchange
MmUnsecureVirtualMemory
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
KeInitializeDpc
ExIsProcessorFeaturePresent
RtlFillMemoryUlong
RtlTimeToTimeFields
MmGrowKernelStack
PsGetCurrentThreadStackBase
ExSystemExceptionFilter
KeReadStateEvent
LdrAccessResource
LdrFindResource_U
RtlUnicodeToCustomCPN
RtlCustomCPToUnicodeN
RtlInitCodePageTable
RtlGetDefaultCodePage
ZwDeleteFile
LdrFindResourceDirectory_U
RtlEqualSid
MmHighestUserAddress
PsRevertToSelf
RtlUnicodeToOemN
ZwCreateKey
RtlFreeAnsiString
RtlImageNtHeader
RtlImageDirectoryEntryToData
_strnicmp
PsSetThreadHardErrorsAreDisabled
PsGetThreadHardErrorsAreDisabled
strncmp
toupper
RtlWriteRegistryValue
ZwEnumerateKey
IoOpenDeviceRegistryKey
wcscmp
IoGetDeviceProperty
ZwDeleteKey
IoOpenDeviceInterfaceRegistryKey
IoGetDeviceInterfaces
IoSynchronousInvalidateDeviceRelations
IoCreateFile
MmSectionObjectType
ZwCreateSection
ZwSetInformationFile
ZwQueryVolumeInformationFile
IoSetThreadHardErrorMode
_alldvrm
_aulldiv
ZwUnmapViewOfSection
PsGetCurrentThreadPreviousMode
RtlCompareMemory
RtlCreateRegistryKey
MmQuerySystemSize
RtlEnumerateGenericTableAvl
ZwMapViewOfSection
RtlInitializeGenericTableAvl
PsTerminateSystemThread
RtlUpcaseUnicodeString
RtlExtendedLargeIntegerDivide
_aulldvrm
IoQueueThreadIrp
IoBuildAsynchronousFsdRequest
qsort
MmAddVerifierThunks
PsGetThreadWin32Thread

watchdog.sys

WdDdiWatchdogDpcCallback
WdResumeDeferredWatch
WdSuspendDeferredWatch
WdAllocateDeferredWatchdog
WdStartDeferredWatch
WdStopDeferredWatch
WdFreeDeferredWatchdog
WdExitMonitoredSection
WdEnterMonitoredSection

Exports

Exports

BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvAllocRbrush
BRUSHOBJ_pvGetRbrush
BRUSHOBJ_ulGetBrushColor
CLIPOBJ_bEnum
CLIPOBJ_cEnumStart
CLIPOBJ_ppoGetPath
EngAcquireSemaphore
EngAllocMem
EngAllocPrivateUserMem
EngAllocSectionMem
EngAllocUserMem
EngAlphaBlend
EngAssociateSurface
EngBitBlt
EngBugCheckEx
EngCheckAbort
EngClearEvent
EngComputeGlyphSet
EngControlSprites
EngCopyBits
EngCreateBitmap
EngCreateClip
EngCreateDeviceBitmap
EngCreateDeviceSurface
EngCreateDriverObj
EngCreateEvent
EngCreatePalette
EngCreatePath
EngCreateSemaphore
EngCreateWnd
EngDebugBreak
EngDebugPrint
EngDeleteClip
EngDeleteDriverObj
EngDeleteEvent
EngDeleteFile
EngDeletePalette
EngDeletePath
EngDeleteSafeSemaphore
EngDeleteSemaphore
EngDeleteSurface
EngDeleteWnd
EngDeviceIoControl
EngDitherColor
EngDxIoctl
EngEnumForms
EngEraseSurface
EngFileIoControl
EngFileWrite
EngFillPath
EngFindImageProcAddress
EngFindResource
EngFntCacheAlloc
EngFntCacheFault
EngFntCacheLookUp
EngFreeMem
EngFreeModule
EngFreePrivateUserMem
EngFreeSectionMem
EngFreeUserMem
EngGetCurrentCodePage
EngGetCurrentProcessId
EngGetCurrentThreadId
EngGetDriverName
EngGetFileChangeTime
EngGetFilePath
EngGetForm
EngGetLastError
EngGetPrinter
EngGetPrinterData
EngGetPrinterDataFileName
EngGetPrinterDriver
EngGetProcessHandle
EngGetTickCount
EngGetType1FontList
EngGradientFill
EngHangNotification
EngInitializeSafeSemaphore
EngIsSemaphoreOwned
EngIsSemaphoreOwnedByCurrentThread
EngLineTo
EngLoadImage
EngLoadModule
EngLoadModuleForWrite
EngLockDirectDrawSurface
EngLockDriverObj
EngLockSurface
EngLpkInstalled
EngMapEvent
EngMapFile
EngMapFontFile
EngMapFontFileFD
EngMapModule
EngMapSection
EngMarkBandingSurface
EngModifySurface
EngMovePointer
EngMulDiv
EngMultiByteToUnicodeN
EngMultiByteToWideChar
EngNineGrid
EngPaint
EngPlgBlt
EngProbeForRead
EngProbeForReadAndWrite
EngQueryDeviceAttribute
EngQueryLocalTime
EngQueryPalette
EngQueryPerformanceCounter
EngQueryPerformanceFrequency
EngQuerySystemAttribute
EngReadStateEvent
EngReleaseSemaphore
EngRestoreFloatingPointState
EngSaveFloatingPointState
EngSecureMem
EngSetEvent
EngSetLastError
EngSetPointerShape
EngSetPointerTag
EngSetPrinterData
EngSort
EngStretchBlt
EngStretchBltROP
EngStrokeAndFillPath
EngStrokePath
EngTextOut
EngTransparentBlt
EngUnicodeToMultiByteN
EngUnloadImage
EngUnlockDirectDrawSurface
EngUnlockDriverObj
EngUnlockSurface
EngUnmapEvent
EngUnmapFile
EngUnmapFontFile
EngUnmapFontFileFD
EngUnsecureMem
EngWaitForSingleObject
EngWideCharToMultiByte
EngWritePrinter
FLOATOBJ_Add
FLOATOBJ_AddFloat
FLOATOBJ_AddFloatObj
FLOATOBJ_AddLong
FLOATOBJ_Div
FLOATOBJ_DivFloat
FLOATOBJ_DivFloatObj
FLOATOBJ_DivLong
FLOATOBJ_Equal
FLOATOBJ_EqualLong
FLOATOBJ_GetFloat
FLOATOBJ_GetLong
FLOATOBJ_GreaterThan
FLOATOBJ_GreaterThanLong
FLOATOBJ_LessThan
FLOATOBJ_LessThanLong
FLOATOBJ_Mul
FLOATOBJ_MulFloat
FLOATOBJ_MulFloatObj
FLOATOBJ_MulLong
FLOATOBJ_Neg
FLOATOBJ_SetFloat
FLOATOBJ_SetLong
FLOATOBJ_Sub
FLOATOBJ_SubFloat
FLOATOBJ_SubFloatObj
FLOATOBJ_SubLong
FONTOBJ_cGetAllGlyphHandles
FONTOBJ_cGetGlyphs
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_pfdg
FONTOBJ_pifi
FONTOBJ_pjOpenTypeTablePointer
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pwszFontFilePaths
FONTOBJ_pxoGetXform
FONTOBJ_vGetInfo
HT_ComputeRGBGammaTable
HT_Get8BPPFormatPalette
HT_Get8BPPMaskPalette
HeapVidMemAllocAligned
PALOBJ_cGetColors
PATHOBJ_bCloseFigure
PATHOBJ_bEnum
PATHOBJ_bEnumClipLines
PATHOBJ_bMoveTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bPolyLineTo
PATHOBJ_vEnumStart
PATHOBJ_vEnumStartClipLines
PATHOBJ_vGetBounds
RtlAnsiCharToUnicodeChar
RtlMultiByteToUnicodeN
RtlRaiseException
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnwind
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeToMultiByteN
STROBJ_bEnum
STROBJ_bEnumPositionsOnly
STROBJ_bGetAdvanceWidths
STROBJ_dwGetCodePage
STROBJ_fxBreakExtra
STROBJ_fxCharacterExtra
STROBJ_vEnumStart
VidMemFree
WNDOBJ_bEnum
WNDOBJ_cEnumStart
WNDOBJ_vSetConsumer
XFORMOBJ_bApplyXform
XFORMOBJ_iGetFloatObjXform
XFORMOBJ_iGetXform
XLATEOBJ_cGetPalette
XLATEOBJ_hGetColorTransform
XLATEOBJ_iXlate
XLATEOBJ_piVector
_abnormal_termination
_except_handler2
_global_unwind2
_itoa
_itow
_local_unwind2

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kbdfall
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83db7c185a29473880a8a676cf0d7e96

Headers

File Characteristics

Imports

dxapi.sys

hal

ntoskrnl.exe

watchdog.sys

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 74KB - Virtual size: 74KB

.kbdfall Size: 1KB - Virtual size: 1KB

.edata Size: 6KB - Virtual size: 6KB

INIT Size: 22KB - Virtual size: 22KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 51KB - Virtual size: 51KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 74KB - Virtual size: 74KB

.kbdfall
Size: 1KB - Virtual size: 1KB

.edata
Size: 6KB - Virtual size: 6KB

INIT
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 51KB - Virtual size: 51KB