5c7314f89127f0b6590a1a3555aacab58d4df06576fccd0df1346e0d1b663b0d

Sharing

Copy URL Twitter E-mail

General

Target

5c7314f89127f0b6590a1a3555aacab58d4df06576fccd0df1346e0d1b663b0d
Size

181KB
MD5

8adb642389b8bf999e2017d731edcb00
SHA1

b1f31aa1ae751e415193d636054f478a1fce962d
SHA256

5c7314f89127f0b6590a1a3555aacab58d4df06576fccd0df1346e0d1b663b0d
SHA512

8b694c25a199949494d9abbfad4d8f4f75b225c6b12422fa564c00b2369468e13f5df583b1c3ae008db4837f58315cfb68c867934445d826a2eca5211ad5793f
SSDEEP

3072:CQkrcfQKtH05TND/jqqdGPiC30TXD2KGQWEh4cHfv9:CQkFKtU5TNDO9Pi5/1OcH

Score

N/A

Malware Config

Signatures

Files

5c7314f89127f0b6590a1a3555aacab58d4df06576fccd0df1346e0d1b663b0d
.exe windows x86

2243d9da8f33b21222255e3c21cec8a8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
RtlFreeAnsiString
RtlFreeUnicodeString
IoDeleteDevice
sprintf
KeSetEvent
PsCreateSystemThread
RtlUnicodeStringToAnsiString
ZwClose
IoCreateDevice
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
ExGetPreviousMode
wcsncpy
RtlInitAnsiString
wcsncat
IoFreeMdl
IoDriverObjectType
MmProbeAndLockPages
MmUnlockPages
ObReferenceObjectByName
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
IoAllocateMdl
ExAllocatePoolWithTag
ExFreePoolWithTag
KeDelayExecutionThread
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
ZwReadFile
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
ObReferenceObjectByHandle
isupper
ZwDeleteFile
ZwOpenFile
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryValueKey
isdigit
ZwQueryDirectoryObject
_wcsicmp
RtlCompareUnicodeString
MmMapLockedPages
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwEnumerateValueKey
KeServiceDescriptorTable
ZwLoadDriver
ZwEnumerateKey
ZwOpenKey
strchr
RtlInitUnicodeString
RtlTimeToTimeFields
KeTickCount
KeInitializeEvent
PsTerminateSystemThread
ZwDeleteKey
ZwFlushKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
isspace
toupper
RtlAnsiStringToUnicodeString
IofCompleteRequest
ExFreePool
memcpy
memset
_except_handler3
_allrem

hal

KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2243d9da8f33b21222255e3c21cec8a8

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 127KB - Virtual size: 127KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 24KB - Virtual size: 24KB

INIT Size: 3KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 127KB - Virtual size: 127KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 24KB - Virtual size: 24KB

INIT
Size: 3KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 8KB