8d849c53d179fc28d863d1eacd999f7b6c41ee58c0c63fee251b9a2328bc7cfb

General

Target

8d849c53d179fc28d863d1eacd999f7b6c41ee58c0c63fee251b9a2328bc7cfb
Size

288KB
MD5

8089c7d5dc15444a2e2326505525cae2
SHA1

b739373c18c2c53b68a96e4e2938f2e940b4f148
SHA256

8d849c53d179fc28d863d1eacd999f7b6c41ee58c0c63fee251b9a2328bc7cfb
SHA512

cafe1170c7ea82bf340c7f7fca2f068199a7180e7e1782a37a392527ff9442333a659125949b34f0b2f12f33532cac2d4ebf796ef41a76e6234441c5b8894473
SSDEEP

6144:dMcZyjKIaztQufvuvg4PfMx8lW9Jj8oQXrcLPp/oiKGVD7cATnoPta+p7GV31Gzg:9Q94tQuHF4WBo8noFa+p8t7

Score

N/A

Malware Config

Signatures

Files

8d849c53d179fc28d863d1eacd999f7b6c41ee58c0c63fee251b9a2328bc7cfb
.exe windows x86

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTagPriority
IoReleaseCancelSpinLock
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
WmiTraceMessage
IofCompleteRequest
RtlLargeIntegerNegate
ProbeForRead
IoCheckShareAccess
wcslen
ObfDereferenceObject
_except_handler3
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
RtlCompareMemory
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ExRaiseStatus
ExRaiseAccessViolation
MmUserProbeAddress
_purecall
IoSetShareAccess
IoGetRequestorProcess
IoFreeWorkItem
IoAllocateWorkItem
KeAttachProcess
KeDetachProcess
IoGetCurrentProcess
ZwDeleteFile
RtlInitUnicodeString
swprintf
ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
ObCloseHandle
KeInitializeEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoQueueWorkItem
_allmul
_alldiv
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
IoRemoveShareAccess
KeSetTimer
KeCancelTimer
KeInitializeDpc
KeInitializeTimer
KeTickCount
KeBugCheckEx

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 15KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 210B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 15KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 210B