b03515267125e3ee44917acf010de9d09fdede99f7d58bdc3b1facf354bf4dde

General

Target

b03515267125e3ee44917acf010de9d09fdede99f7d58bdc3b1facf354bf4dde
Size

53KB
MD5

0af5b58fb1f0c5e8f56d8e4504fd1f20
SHA1

8f5b943da3b150ff84265b9f907c5896eb1884d4
SHA256

b03515267125e3ee44917acf010de9d09fdede99f7d58bdc3b1facf354bf4dde
SHA512

aae2df9e411a8d37de8067c03fd82f7b39dc4f3934995dc07928993a60b7f8a34a9324c2d8fe5bc6e868ad56ac3203ee38ed26b74b30acf452e12005202d2942
SSDEEP

768:Ko3eL7P5ODF3jvHRmmxwuFLEGjurB/SLIyKNoukC6fiDKYnIWmla:Ko3eP5y3rx3FLEJtSE3gC6fHzdl

Score

N/A

Malware Config

Signatures

Files

b03515267125e3ee44917acf010de9d09fdede99f7d58bdc3b1facf354bf4dde
.exe windows x86

282edf89fde9193cc476b0c83d9ce6f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlInitUnicodeString
DbgPrint
ZwOpenProcess
ObOpenObjectByPointer
PsProcessType
ZwClose
ZwWriteFile
ZwCreateFile
ZwDeleteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePool
ZwQueryInformationFile
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
KeServiceDescriptorTable
PsGetVersion
memset
KefAcquireSpinLockAtDpcLevel
RtlCopyUnicodeString
RtlCompareUnicodeString
PsLookupProcessByProcessId
ZwQuerySystemInformation
PsTerminateSystemThread
KeInsertQueueApc
KeInitializeApc
MmIsAddressValid
IoThreadToProcess
PsLookupThreadByThreadId
ZwSetValueKey
ZwCreateKey
ZwDeleteKey
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
IoFreeMdl
MmUnmapLockedPages
IoCheckShareAccess
RtlCompareMemory
IoDeleteDevice
PsCreateSystemThread
_allmul
RtlFreeUnicodeString
KeDelayExecutionThread

hal

KeRaiseIrqlToDpcLevel
KfLowerIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

282edf89fde9193cc476b0c83d9ce6f2

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 31KB - Virtual size: 31KB

PAGE Size: 8KB - Virtual size: 7KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 31KB - Virtual size: 31KB

PAGE
Size: 8KB - Virtual size: 7KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB