54a4fc3845d38bf6f60ec91cb3a00a08dc51f31df1e78675f59af917249f83c0

Sharing

Copy URL Twitter E-mail

General

Target

54a4fc3845d38bf6f60ec91cb3a00a08dc51f31df1e78675f59af917249f83c0
Size

253KB
MD5

0ce748c146cb13b325adc1b6f60351f0
SHA1

0200a090783db96e8cbde67c4fc991b293fedfe8
SHA256

54a4fc3845d38bf6f60ec91cb3a00a08dc51f31df1e78675f59af917249f83c0
SHA512

82db4aa24a87a07a5903d3c94ec615ee8deb5db94326cab4ab586d7cafb60307a4699dcf041e335c5218300812e57d03ab1f827c9b38396917f9cf41b0f43803
SSDEEP

6144:PTunsf31gtkvAP5OUjRbQQ1hV1Dxk2FvX9gcBx5CACt:Posf3qG659lp1hV1DL/x5C

Score

N/A

Malware Config

Signatures

Files

54a4fc3845d38bf6f60ec91cb3a00a08dc51f31df1e78675f59af917249f83c0
.exe windows x86

56c449f0f3c2cd4485f6275388d33b3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ZwQueryValueKey
memcpy
memset
ZwClose
ZwOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
swprintf
RtlDeleteRegistryValue
_wcsnicmp
ExAllocatePool
ZwEnumerateKey
ZwCreateKey
ZwEnumerateValueKey
wcsncpy
wcsstr
ZwDeleteValueKey
ExFreePoolWithTag
ZwWriteFile
ZwSetInformationFile
ZwQueryInformationFile
ZwOpenFile
ZwDeleteKey
strncmp
IoGetCurrentProcess
PsGetVersion
MmGetSystemRoutineAddress
KeDelayExecutionThread
ObfDereferenceObject
PsSetCreateProcessNotifyRoutine
KeWaitForSingleObject
KeSetEvent
ObReferenceObjectByHandle
PsCreateSystemThread
_stricmp
PsLookupProcessByProcessId
KeClearEvent
KeInitializeEvent
KeTickCount
KeBugCheckEx
ZwCreateFile
MmMapIoSpace

hal

KeGetCurrentIrql

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 343B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56c449f0f3c2cd4485f6275388d33b3e

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 384B - Virtual size: 343B

.data Size: 1KB - Virtual size: 1KB

PAGE Size: 236KB - Virtual size: 236KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 384B - Virtual size: 343B

.data
Size: 1KB - Virtual size: 1KB

PAGE
Size: 236KB - Virtual size: 236KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB