d734ed2425a2d370e47421dd062408661907cabd61fe9256834f48851fb40681

General

Target

d734ed2425a2d370e47421dd062408661907cabd61fe9256834f48851fb40681
Size

81KB
MD5

80ff0fb00d9068b9a32997b7ee0224c2
SHA1

21891884090e4847a6a8cb1e147d3dc890d8ed91
SHA256

d734ed2425a2d370e47421dd062408661907cabd61fe9256834f48851fb40681
SHA512

e9e7a22a59434aea6fdc1925a51d5babaebd10f4d9c0e430a2c77a320225e771c2c2317fbb49fa1cc0c76bc77eed0eec93a69b1ba33da9326a7ffc21a2682a70
SSDEEP

1536:P0wbQh9hEJtXXwhwApQb6E5bH2tL4iRXjt:P0rh9hEJWbpQbn5bAL4ot

Score

N/A

Malware Config

Signatures

Files

d734ed2425a2d370e47421dd062408661907cabd61fe9256834f48851fb40681
.dll windows x86

f6e00b9cf6d9e80382ae0b871f3f5768

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeSetTargetProcessorDpc
MmLockPagableDataSection
RtlAppendUnicodeToString
KeInitializeDeviceQueue
RtlRemoveUnicodePrefix
CcSetDirtyPinnedData
CcZeroData
RtlFreeAnsiString
ObReferenceObjectByPointer
ZwReadFile
RtlAnsiStringToUnicodeString
IoDeleteDevice
KeInitializeSemaphore
RtlCopySid
IoGetDeviceAttachmentBaseRef
RtlValidSecurityDescriptor
RtlIsNameLegalDOS8Dot3
ZwOpenSection
KeInsertDeviceQueue
IoCreateNotificationEvent
RtlSplay
RtlRandom
SeImpersonateClientEx
ExFreePoolWithTag
IoInitializeRemoveLockEx
SeFreePrivileges
IoEnumerateDeviceObjectList
IoQueryFileInformation
PsDereferencePrimaryToken
ExReleaseResourceLite
IoRaiseHardError
IoFreeMdl
KeSaveFloatingPointState
ExAllocatePoolWithQuota
FsRtlCheckLockForReadAccess
KeSetTimer
FsRtlMdlWriteCompleteDev
KeInsertQueueDpc
IoAcquireCancelSpinLock
DbgBreakPoint
ZwDeleteKey
ExAllocatePool
IoVerifyPartitionTable
IoCancelIrp
ObReleaseObjectSecurity
IoUnregisterFileSystem
RtlxAnsiStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
MmCanFileBeTruncated
IofCallDriver

Exports

Exports

?RtlArgumentAppNameThreadProfileA@@ADHPAKKG<V
?GlobalEventTimeArgumentExW@@ADMPAIPAIPAFH<V
?FreeMessageTimerPenEx@@ADPAXPAM<V
?CopyListRectFileDataExW@@ADEE<V
?StringOptionWindowInfoProcessExA@@ADPAXPAJIE<V
?FormatWidthFolderPathListAppNameOld@@ADEFPAD<V

Sections

.text
Size: 28KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 355B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f6e00b9cf6d9e80382ae0b871f3f5768

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 45KB

.edata Size: 512B - Virtual size: 355B

.data Size: 33KB - Virtual size: 32KB

.text
Size: 28KB - Virtual size: 45KB

.edata
Size: 512B - Virtual size: 355B

.data
Size: 33KB - Virtual size: 32KB