a1539e162f0d5c593637338137f6621c093b3d2106e0623782d5eb61cd02cf50

General

Target

a1539e162f0d5c593637338137f6621c093b3d2106e0623782d5eb61cd02cf50
Size

327KB
MD5

80c9149b74cd417b8a3daf38d035d60a
SHA1

870dea29aca05c75054ede8aaf2b4e39bd9a0415
SHA256

a1539e162f0d5c593637338137f6621c093b3d2106e0623782d5eb61cd02cf50
SHA512

71b956840fc12d86c12d0ccb03832f67b5e4ce825c484d1dad30c40932d824f9938459e88b8bb120246acedee861e5185f0d38183b28230d641fc4b526f1747b
SSDEEP

6144:uMcZyjKIaztQRXrEW1+12EfqvgewNP/b9q29THyxTB5Yii3ofXyIPhz:WQ94tQRwg+1ffLP04TSxTbYl4fXywhz

Score

N/A

Malware Config

Signatures

Files

a1539e162f0d5c593637338137f6621c093b3d2106e0623782d5eb61cd02cf50
.exe windows x86

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTagPriority
IoReleaseCancelSpinLock
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
WmiTraceMessage
IofCompleteRequest
RtlLargeIntegerNegate
ProbeForRead
IoCheckShareAccess
wcslen
ObfDereferenceObject
_except_handler3
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
RtlCompareMemory
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ExRaiseStatus
ExRaiseAccessViolation
MmUserProbeAddress
_purecall
IoSetShareAccess
IoGetRequestorProcess
IoFreeWorkItem
IoAllocateWorkItem
KeAttachProcess
KeDetachProcess
IoGetCurrentProcess
ZwDeleteFile
RtlInitUnicodeString
swprintf
ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
ObCloseHandle
KeInitializeEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoQueueWorkItem
_allmul
_alldiv
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
IoRemoveShareAccess
KeSetTimer
KeCancelTimer
KeInitializeDpc
KeInitializeTimer
KeTickCount
KeBugCheckEx

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 15KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 210B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 15KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 210B