61eb026b3e6de78ca49c823b40e732536c7d86a8e8dafb1b8d4f50d29e4601e6

General

Target

61eb026b3e6de78ca49c823b40e732536c7d86a8e8dafb1b8d4f50d29e4601e6
Size

440KB
MD5

0c206eef6b2d3bd6ed1ea52f86484b5d
SHA1

d4c25bd983328d64466b2b0297baca6c1052b9d4
SHA256

61eb026b3e6de78ca49c823b40e732536c7d86a8e8dafb1b8d4f50d29e4601e6
SHA512

a2cb8bb8c4bf1b9eb73f9fa2de25f86301d60379bdb7ec0bbd5fada575bab0cd74951ecf396203bbf57c8d73d0fccbfede820e296e231c3a718fd3da46b5df7c
SSDEEP

12288:tJkfMBPTg+hBodU6mML9Fege4I02fqzv:tJkf2PTgmlK9FegeE2yz

Score

N/A

Malware Config

Signatures

Files

61eb026b3e6de78ca49c823b40e732536c7d86a8e8dafb1b8d4f50d29e4601e6
.exe windows x86

2325e1f52352fa7799e70510d78dc807

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KeGetCurrentIrql

ntoskrnl.exe

MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
RtlDecompressBuffer
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
ExInterlockedAddLargeStatistic
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc
KeCancelTimer
_alldiv
RtlEqualUnicodeString
ExAllocatePoolWithQuota
MmUnmapLockedPages
IoCancelIrp
ExQueueWorkItem
FsRtlMdlReadComplete
KeDetachProcess
FsRtlMdlRead
KeAttachProcess
IoGetRequestorProcess
FsRtlCopyRead
IoQueryFileInformation
_aullrem
PsGetCurrentProcessId
ObFindHandleForObject
ObCloseHandle
ObOpenObjectByName
IoThreadToProcess
KeTickCount
KeInitializeApc
KeInsertQueueApc
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ObfReferenceObject
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2325e1f52352fa7799e70510d78dc807

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 14KB - Virtual size: 14KB

.INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 224B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 14KB - Virtual size: 14KB

.INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 224B