95ca223913edf440902ba87d597a93343bdf6b1e2f85dda48f95c8fd48ffc365

General

Target

95ca223913edf440902ba87d597a93343bdf6b1e2f85dda48f95c8fd48ffc365
Size

9KB
MD5

9022b65d6470950cd005def306f70f1b
SHA1

59934862abfd6842102e80f203bcf81612a4c546
SHA256

95ca223913edf440902ba87d597a93343bdf6b1e2f85dda48f95c8fd48ffc365
SHA512

baf8130be1b65fec76a086ec66a7bed09a6511c9e96195c8462a280ebbbd7e29d4c90deeb239fd563f17e934a0563289c0580738bf77934d6a5e5840c4af9685
SSDEEP

96:RWe6zSAis+g3rH54KikDcfX2zH19TngfObaLU4v1OLz924VV4:2ysrbCKi0cfGzV9bg3w4v1h4VV4

Score

N/A

Malware Config

Signatures

Files

95ca223913edf440902ba87d597a93343bdf6b1e2f85dda48f95c8fd48ffc365
.exe windows x86

df2bfe961742f16fc18f2004d9dbf98b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ProbeForRead
KeDetachProcess
MmIsAddressValid
KeAttachProcess
PsLookupProcessByProcessId
_except_handler3
ExAllocatePoolWithTag
wcscmp
strncpy
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteSymbolicLink
_stricmp
ZwClose
wcsstr
ExFreePool
strncat
ZwQuerySystemInformation
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsGetVersion
RtlFreeAnsiString
RtlCompareMemory
RtlUnicodeStringToAnsiString
ZwEnumerateKey
ZwCreateKey
ZwSetValueKey
ObfDereferenceObject
IofCompleteRequest
ZwUnmapViewOfSection
DbgPrint

hal

KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 352B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 544B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df2bfe961742f16fc18f2004d9dbf98b

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 352B - Virtual size: 340B

.data Size: 192B - Virtual size: 192B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 544B - Virtual size: 532B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 352B - Virtual size: 340B

.data
Size: 192B - Virtual size: 192B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 544B - Virtual size: 532B