ab8eabba4195df6c1ba6f845dfe49b13ab1f312cbc3887c6cc2d2f674ebec5f5_unpacked_x64

Reason

config extraction: missing cfgextr callback for rule "Gozi_FJ_loader_0"

General

Target

ab8eabba4195df6c1ba6f845dfe49b13ab1f312cbc3887c6cc2d2f674ebec5f5_unpacked_x64
Size

75KB
MD5

f204f080026fd5ffbd155779a409e128
SHA1

48cc3b83fb78857e6eff348ba02a436e84ce3497
SHA256

9841186a9158e8442607e65c6d2a9a7e8ccddb2a5b016cc1b7a4e1b84256182f
SHA512

4b3a89edda2dac2c3ead1269b09a79de69fbfb2989ceabe3654983d866c7c581592f098303fea4562f9a0c31aae89b6bd077adb979f76dd6a94587669050c147
SSDEEP

1536:IU+vRurFqFCNT4Jo1Plkdmo3yyCCO7cHDHRcbKZ/dIduYxgR:KvRurgnJo1PGdp3y/yt5jI4Y2

Score

N/A

Malware Config

Signatures

Files

ab8eabba4195df6c1ba6f845dfe49b13ab1f312cbc3887c6cc2d2f674ebec5f5_unpacked_x64
.exe windows x64

5835c8465fcd606302013c3054b7fb34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExFreePoolWithTag
RtlAnsiStringToUnicodeString
PsSetLoadImageNotifyRoutine
PsLookupProcessByProcessId
KeInitializeApc
ZwMapViewOfSection
ProbeForWrite
strchr
KeInsertQueueApc
RtlInitAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
KeReleaseSpinLock
PsSetCreateProcessNotifyRoutine
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
_wcslwr
RtlImageDirectoryEntryToData
KeDelayExecutionThread
RtlFreeUnicodeString
strncpy
wcsrchr
wcsstr
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ZwUnmapViewOfSection
ExAllocatePool
ZwClose
RtlUpperString
RtlFreeAnsiString
ZwOpenProcess
ZwQueryInformationProcess
MmIsAddressValid
ZwCreateSection
ZwOpenFile
ProbeForRead
IoAllocateMdl
KeAcquireSpinLockRaiseToDpc
_snwprintf
RtlAppendUnicodeToString
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
IoGetLowerDeviceObject
KeSetEvent
KeInitializeEvent
IoFreeMdl
IoFileObjectType
ObReferenceObjectByHandle
KeWaitForSingleObject
IoFreeIrp
MmProbeAndLockPages
IoAllocateIrp
MmUnlockPages
ObfDereferenceObject
IofCallDriver
ExUnregisterCallback
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
ExRegisterCallback
ExCreateCallback
KeInitializeMutex
RtlTimeFieldsToTime
KeReleaseMutex
RtlTimeToTimeFields
_stricmp
ZwReadFile
IoCreateDriver
ZwQueryInformationFile
ZwTerminateProcess
ExAllocatePoolWithTag
ZwCreateFile
ZwWriteFile
ZwDeviceIoControlFile
__C_specific_handler

hal

KeQueryPerformanceCounter

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

5835c8465fcd606302013c3054b7fb34

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 33KB - Virtual size: 33KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 2KB

.reloc Size: 31KB - Virtual size: 32KB

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 31KB - Virtual size: 32KB